Attachment 2 - Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT

Credit Card Reader Machines

Part I General Information

1. GENERAL: This is a non-personnel services contract to provide Credit Card Machine Readers. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. AT/OPSEC/IA Contract Requirements Package Antiterrorism/Operations Security Review Coversheet is a part of this PWS.

1.1 Description of Services/Introduction on: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Credit Card Reader functions as defined in this Performance Work Statement except for those items specified as government furnished property and services . The contractor shall perform to the standards in this contract.

1.2 Background: For face-to-face transactions in a traditional retail setting, Credit Card Machine Readers must be compatible with Computrition point-of-sale software system terminals for securely processing credit cards, debit cards, prepaid cards, checks, electronic benefits transfers (EBTs) and other electronic transactions. Simply swipe or chip the customer ' s card through the card reader and the terminal does the rest; additional option to use a PIN pad to input credit card machine to process PIN debit cards and EBT transactions.

1.3 Objectives: Credit card rental service package that provides the strongest, fastest and most reliable processing terminals on the market , offering cutting-edge technology and easy-to-use features that customer will appreciate. This countertop terminal must provide the next-generation processing power that delivers security and flexibility to fit the needs of government requirements.

1.4 Scope: Compatible with cmTent system Computrition software, keys and additional coding that is required in order to be installed on the network; This requirement is a must in order to have the Credit Card Readers work with current systems; high-speed internet connection with dial-up backup for completing transactions quickly. Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of contract award. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a Microsoft Windows 7 or Microsoft Windows 10 certification . The CompTIA A+ ce1iification will also satisfy the CE certification requirement.

1.5 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four (4) option years. Period of Performance (POP) as described below.

Period of Performance: Base Year: 01 October 2022 to 30 September 2023 Option Year 1: 01 October 2023 to 30 September 2024 Option Year 2: 01 October 2024 to 30 September 2025 Option Year 3: 01 October 2025 to 30 September 2026 Option Year 4: 01 October 2026 to 30 September 2027

1.1 General Info1mation

1.1.1 Quality of Product or Service

Addresses the extent to which the contractor (a) met contract technical requirements, including the accuracy and completeness of repo1ts/data delivered; (b) employed methods and approaches to ensure fully successful performance; (c) consistently conveyed his intended approach clearly and completely to ensure that there were no surprises; (d) was proactive and demonstrated initiative; (e) remained flexible to internal or external changes; and

(f) was effective in developing and implementing process improvements to make the end product development more efficient and the end product more effective. Contractor shall submit payment request using Wide Area Workflow (WAWF) no later than the 15th of the month for the previous month billing.

Schedule

Addresses the extent to which the contractor met contract schedules, including the need for deadline extensions.

Cost Control

Addresses the contractor's overall effectiveness in controlling both direct and indirect costs that impact the government.

Business-Relations

Addresses the responsiveness of the contractor's upper-level management to government concerns and needs, the effectiveness of the contractor's management interface with the customer and the overall cooperativeness and receptiveness of the contractor in dealing with the government on both technical and management issues.

The following evaluation ratings will be assigned to each area for the above-listed performance areas on a quarterly basis by the government.

A = Exceptional

Performance meets contractual requirements and exceeds many to the customer's benefit. The contractual performance of the element or sub-element being assessed was accomplished with few minor problems for which corrective actions taken by the contractor were highly effective.

B =Very Good

Performance meets contractual requirements and exceeds some to the customer's benefit. The contractual performance of the element or sub-element being assessed was accomplished with some minor problems for which corrective actions taken by the contractor were effective.

C = Satisfactory

Performance meets contractual requirements. The contractual perfo1mance of the element or sub-element contains some minor problems for which corrective actions taken by the contractor appear satisfactory.

D =Marginal

Performance does not meet contractual requirements. The contractual performance of the element or sub-element being assessed reflects a serious problem for which the contractor has not yet identified corrective actions. The contractors' proposed actions appear only marginally effective or were not fully implemented

F = Unsatisfactory

Performance did not meet contractual requirements and recovery is not likely in a timely manner. The contractual performance of the element or sub-element being assessed contains serious problem(s) for which the contractor's corrective actions appear or were ineffective.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays:

New Year's Day

Martin Luther King Jr.'s Birthday President's Day

Memorial Day Independence Da

Labor Day Columbus Day Veteran's Day Thanksgiving Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of0S00-1630 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: The work to be performed under this contract will be performed a.t Martin Army Community Hospital

6600 Van Aalst Blvd. Bldg. 9250 (Nutrition Care Division) Fort Benning, GA 31905

1.6.6 Type of Contract: The government will award a Supply /Service contract. The government may extend to services of this contract by written notice to the Contractor within 60 days; provided that the government gives the Contractor a written notice of its intent to extend at least 60 days before contract expires.

1.6.7 Safety Specifications: Contractor personnel performing work under this contract must have IA Training ;

DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signa l.army.mil /DoDIAA/at time of the proposal submission, and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254; Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted a TAMC network account. The Army Standard AUP is available at the following website : https://atc.us.army.mi l/iastar/docs /aup.pdf

1.6.7.1 Security Requirements: The contractor shall be responsible for safeguarding all government equipment, inf01mation and property provided for contractor use TAMC Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance /Cyber Security Branch for contractors requiring remote access to the TAMC network. Remote access must be through a Defense Health Agency (DHA) Business-To- Business (B2B) solution. The package includes -

DD Form 2875 - System Authorization Access Request (SAAR). All contractors requiring a TAMC network account will complete the DD Form 2875 to include validation of a Security Background Investigation NACI (9.9.1.1).

Information Assurance Branch will be the sponsor for all contractors requiring elevated privileged-level access. The department chief will sign the DD2875 as the contractor supervisor. Note: contractors requiring a

' Privileged' account will check 'Box 14.' on the form. The DD2875 SAAR Form is available at the following website: https://atc.us .army.m il/iastar/docs/DD Form 2875 System Access Agreement Regues t.pdf. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.2 Key Control (If applicable). The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.2.1.In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however , the Government , at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government , the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.2.2.The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor ' s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.3 Lock Combinations (If applicable). The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

These procedures shall be included in the Contractor’ s Quality Control Plan.

1.6.8 Special Qualifications: Information Assurance Contractor Training arid Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army /TAMC network will meet Army requirements for a privileged-level account before being granted a TAMC network account.

Requirements include - Cyber (Information assurance (IA)/information technology (IT)) certification . PerDoD-85- 70.01-M, DF-ARS-2-5±. ;39, -7001- and-AR-2-5-2,- the contmct0r-employees-supp 0rting-Gyber-(-IA!I+)-functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT - II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being 'Disabled' or ' Deleted' until such time as the conditions of this contract are met. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-11 is CompTIA Security+ . Higher certifications (GSCL, CISM, CISSP, etc. will satisfy this requirement.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance . At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.l O Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The follow personnel are considered key personnel by the government: Main Installation Contracting Center is the contracting office. The Contracting Officer Representative and Chief of Nutrition Care Division; located on Fo1i Benning at Martin Army Community Hospital and acts as the liaison between the Contracting Office. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30p.m, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below: The Contracting Officer Representative is credentialed and has all the requirements to oversee the contract and the alternate.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings , answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.6.13 Contractor Travel: Contractor will be required to travel within the NCR during the performance of this contract to attend meetings, conferences, and training. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS. Contractor will not be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. Government will not approve any travel. . .

1.6.14 Other Direct Costs: This category includes travel (outlined in 1.6.13), reproduction, and shipping expenses associated with training activities and visits to contractor facilities. It could also entail the renting of suitable training venue.

1.6.15 Data Rights: The Government has unlimited rights to all documents /material produced under this contract.

All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.16 Organizational Conflict of interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget info1mation or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or pa1iicipation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor's mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.17 PHASE IN /PHASE OUT PERIOD: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the 30 days of phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date.

1.6.18 Mandatory Government Training: Contractor shall meet government training requirements prior to contract being awarded. The following are required:

AT Level I training. This standard language is for contractor employees with an area of perf01mance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army in installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable and annually thereafter. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 05 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.m il.

PART2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.-l DEFINING

1.CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government.

The term used in this contract refers to the prime.

2.1.1. CONTRACTING OFFICER. A person with authority to enter into, administer, and or te1minate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government

2.1.2. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have authority to change the terms and conditions of the contract.

2.1.3. DEFECTIVE SERVICE;, A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.4. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or repo1is.

2.1.5. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.7. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.9. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.10. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.11. WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK . Monday through Friday, unless specified otherwise.

2.2. ACRONYMS

ACOR

AFARS

AR

CCE

CFR

CONUS

COR

COTR

COTS

DA

Alternate Contracting Officer's Representative Army Federal Acquisition Regulation Supplement Army Regulation Contracting Center of Excellence Code of Federal Regulations Continental-United States-( exclude s Alaska-and-Hawaii1 Contracting Officer Representative Contracting Officer's Technical Representative Commercial-Off-the-Shelf Department of the Army

DD250

DD254

DFAR

S

DMDC

DOD

FAR

HIPAA

KO

OCI

OCONU

S ODC

PIPO

POC

PRS

PWS

QA

QAP

QAS

P QC

QCP

TE

Department of Defense Form 250 (Receiving Report) Department of Defense Contract Security Requirement List Defense Federal Acquisition Regulation Supplement Defense Manpower Data Center Department of Defense Federal Acquisition Regulation Health Insurance Portability and Accountability Act of 1996 Contracting Officer Organizational Conflict of Interest Outside Continental United States (includes Alaska and Hawaii)· Other Direct Costs Phase In/Phase Out Point of Contact Performance Requirements Summary Performance Work Statement Quality Assurance Quality Assurance Program Quality Assurance Surveillance Plan Quality Control Quality Control

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICE

3.GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.I. Services: The Government will provide the contractor with an initial list of hospital points of contact. After verifying the list, it will be the responsibility of the contractor to maintain the accuracy of the list.

3.2Facilities: The Government will provide a location to meet up with the Contracting Officer Representative as needed to perfo1m work necessary to maintain services and equipment.

3.3Utilities: The Government will provide a location if needed in order to perform the services to maintain services and equipment.

3.4Equipment: The Government will provide allow the contractor to perform all services and set up shipping, scanning and faxing information pertaining to services.

PART4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS. The Contractor shall instruct employees in utilities conservation practices . The contractor shall be responsible for operating under conditions that preclude the waste of utilities,which include-turning- off-the-water-faucets or-valves after using the required amount to accomplish cleaning vehicles and equipment.

4.2Secret Facility Clearance: The contractor shall possess and maintain a SECRET facility clearance from the Defense Security Service. The Contractor's employees, performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industrial Security Clearance Office. The DD 254.

4.3.Materials: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor's quality control program is the means by which he assures himself that his work complies with the requirement of the contract.

4.4.Equipment: The Contractor shall ensure all equipment is to be fully operational with all required software upon delivery to installation. The equipment is required to be shipped within 5-7 businesses working days of contract agreement. In case of technical issues contractor shall provide services to restore or fix system; replacement

. Equipment shall be provided. After acceptance of the quality control plan the contractor shall receive the contracting officer's acceptance in writing of any proposed change to his QC system. Supplies will not be paid before until services have been rendered. After acceptance of the quality control plan the contractor shall receive the contracting officer's acceptance in writing of any proposed change to his QC system.

PARTS

SPECIFIC TASKS

5. Specific Tasks:

5.1. Basic Services. The contractor shall provide services for non-personnel services contract to provide Credit Card Machine Readers. Credit card rental service package that provides the strongest, fastest and most reliable processing terminals on the market, offering cutting-edge technology and easy-to-use features that customer will appreciate. This countertop terminal must provide the newest generation processing power that delivers security and flexibility to fit the needs of government requirements For face-to-face transactions in a traditional retail setting, Credit Card Machine Readers must be compatible with Computrition point-of-sale software system terminals for securely processing credit cards, debit cards, prepaid cards, checks, electronic benefits transfers (EBTs) and other electronic transact ions. Simply swipe or chip the customer's card through the card reader and the terminal does the rest;

additional option to use a PIN pad to input credit card machine to process PIN debit cards and EBT transactions.

5.2. Special Specifications. Compatible with current system Computrition software, keys and additional coding that is required in order to be installed on the network; This requirement is a must in order to have the Credit Card Readers work with current systems; high-speed internet connection with dial-up backup for completing transactions quickly. Computer Environment (CE) Ce1iification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of contract award . Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a Microsoft Windows 7 or Microsoft Windows 10 certification. The CompTIA A+ ce1iification will also satisfy the CE certification requirement.

5.3. CONTRACTOR MANAGEMENT REPORTING (CMR) The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor shall report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor shall completely fill in all the information in the format using the following web address https://Contractormanpower. army.pentagon.mil. The required information includes: (I) Contracting Office, Contracting Officer, Contracting Officer's Technical Representative (COTR) or also known as the Contracting Officer' s Representative (COR) ; (2) Contract number, including task and delivery order number; (3) Beginning and ending dates covered by repo1iing period ; (4) Contractor's name, address, phone number, e-mail address, identity of

- Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractors) ; (6) Estimated direct labor dollars paid this repelling period (including sub-Contractors); (7) Total payments (including sub- Contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the A1my Requiring Activity (the A1my Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (11) Locations where Contractor and sub-Contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location , using standardized nomenclature provided on website) ; (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-Contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall provide the estimated total cost (if any) incurred to comply with this reporting requirement. Repo1iing period shall be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a Contractor ' s system to the secure website without the need for separate data entries for each required data element at the website e. The specific formats for the XML direct transfer may be downloaded from the website.

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

6.2 Access and general protection/security policy and procedures: This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all

Associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and /or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.3Additional Security Requirements: contractors requiring Common Access Card (CAC). Before CAC issuance , the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries

(NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (I) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non- DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more . At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Ofice of Personnel Management.

6.4 CAC Card Requirements (If applicable): For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III)and Terrorist Screening Database.

6.5 (TSDB) (Army Directive 2014-05/AR 190-13): Applicable in installation , facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

6.6 Army Training Certification Tracking System: (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government information systems must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

6.7 Formal OPSEC program: The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530- l.

6.8 Contracts that require OPSEC Training: Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their

Reporting for duty and annually thereafter. OPSEC Awareness for Military Members, DoD Employees and Contractors is available at the following website: http://cdsetrain .dtic.mi l /opsec/index .htm

6.9 Cyber Awareness (Information assurance (IA)/information technology (IT)) training: All contractor employees and associated sub-contractor employees must complete the DoD Cyber awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions. DoD Cyber Awareness Challenge Training is available at the following website:https://ia.signal.army.mil /DoDIAA

PART 7

ATTAC IDv1ENT/TECHN1CAL EXHIBIT LISTING

(Under this section list all attachments and technical exhibits that will be use fit for the contractor to submit an appropriate proposal. )

7.Attachment ffechnical Exhibit List:

7.1.Attachment 1/Technical Exhibit 1 - Performance Requirements Summary Cybersecurity Requirements

7.2. System Security Requirements

7.3. The vendor shall submit to Government , included in the quote, the blue section of the Medical Device Cybersecurity Assessment provided by government.

7.4. Key System Attributes:

7.5. Failure to meet any key attribute is considered a breach of contract.

7.6. The vendor device or system shall pass a pre-validation screening, administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below :

7.7. No unmitigated Category I (CAT I), findings as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa .mil/stigs/Pages /ind ex.aspx7-,8.-No- unm itigated-Categm:y-11-(CA'.f .J,I) findings as-described -in-the-appropriate-Defense- Information-System.

Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

7.9. No unmitigated critical or high Category I (CAT I) findings from Nessus vulnerability scans.

7.10. No unmitigated Category II (CAT II) findings from Nessus vulnerability scans.

7.11. The vendor shall mitigate all CAT I and CAT II findings discovered during the A&A process according to a schedule published by Government.

7.12. The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

7.13. Attachment 2/Technical Exhibit 2 - Deliverables Schedule is outlined in 1.6.1.

7.14 Attachment 3/Technical Exhibit 3 - Estimated Workload Data (This document should be made available if historical data exists. See attached example for format.)

TECHNICAL EXHIBIT 1

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential it ems. The performance threshold is briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective

(The Service required-usually a shall statement)

Standa rd

Performance Threshold (This is the maximum error rate. It could possibly be "Zero deviation from standard")

Method of Surveillance

PRS# 1.

The contractor shall provide Sustainment services include maintenance, inspecting and labor during normal work hours.

The contractor provided services Monday through Friday between the hours of0830- 1100 & thenl330 - 1500 hours.

No more than three customer complaints per 90 days reported

Validated Customer Complaint received by

COR.

PRS#2

All services provided under this contract including service requests, work-tickets, maintenance activities, and reporting functions will be managed by the contractor and made ava ilable to BMACH upon request.

Contractor shall meet the following objectives relative to the description of work under this contract for the Credit Card Readers.

Payments will be made after services have been provided not before servicers are performed by the contractor.

An invoice will be submitted to WAWF for services unless other arrangements have been set up.

PRS#3

The contractor shall deliver services

- imd·or equipment with in-30·days-after contract has been awarded.

Services are delivered in a timely manner

COR contacted within 24

· hvurn 1bo-rit·services-·- --

Voicemail or via email

··cvmmirniclltion

PRS#4

Invoicing according to contract obligations.

Contractor will follow the guidelines for billing services outlined in the PWS

One courtesy notice to

Contractor before submitting a complaint to Contracting Office

Email communication from the COR Valid complaint

I 00 Percent Inspection: Appropriate for tasks that occur infrequently. Inspect and evaluate performance each time task is performer Periodic Surveillance: Evaluation of samples selected on other than I 00% or statistically random basis . (i.e., monthly, quarterly, semi-annually etc.)

Validated Customer Complaint: Complaints must be validated