ENERGY AUTOMATION OPERATIONAL TECHNOLOGY SUSTAINMENT (EAOTS)

AUTOMATIC TANK GAUGING (ATG), INDEPENDENT ALARM SYSTEMS (IAS), AND

OVERFILL PROTECTION EQUIPMENT (OPE) GLOBAL SUPPORT

BASIC INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ)

PERFORMANCE WORK STATEMENT (PWS)

RFP # SP4706-26-R-0001

SECTION C-1 INTRODUCTION

1.0 Introduction

The Defense Logistics Agency (DLA) (i.e. the Government) is the largest logistics support agency in the United States (U.S.) Department of Defense (DoD). The DLA Director reports to the Under Secretary of Defense for Acquisition, Technology and Logistics (USD AT&L) through the Assistant Secretary of Defense for Logistics and Materiel Readiness (ASD L&MR).

DLA provides worldwide logistics support, acquisition, and technical services to the military services, other federal and civilian agencies, and partner nations in peacetime and wartime. DLA Energy is the executive agent for the management of the DoD wholesale and retail fuels operations including accounting operations within the Defense Working Capital Fund (DWCF).

DLA Information Operations (J62BG), Operational Energy Applications (OEA), is a key entity responsible for providing Information Technology (IT) and Operational Technology (OT) support to DLA Energy in its performance of worldwide supply chain management at numerous DoD fuel facilities including (but not limited to) Defense Fuel Supply Points (DFSPs).

As part of its mission, DLA OEA manages, installs, and maintains automated fuel systems (AFS) and equipment at DFSPs. DLA activities include standardizing, maintaining, or upgrading AFS, hydrant fueling automation maintenance (HFAM), automatic tank gauge (ATG), automated fuel handling equipment (AFHE), and other fuel related IT or OT systems at DFSPs to improve fuel inventory accountability, monitoring, and control as well as preventing fuel spills and environmental hazards. Standardized, modernized, and sustainable IT/OT systems at DFSPs enable DLA to provide real-time data acquisition and automated inventory management for capitalized fuel products. These IT/OT systems are typically comprised of web-enabled application software and internet of things (IOT) technology stacks that are fully integrated with liquified petroleum fuel storage tanks and Industrial Control Systems (ICS) at the DFSPs. The purpose of these systems is to provide worldwide access to mission essential commodities such as petroleum and fuel for the U.S. Armed Forces and North American Treaty Organization (NATO) Allies. Each ICS is unique to its deployed location and can consist of Supervisory Control and Data Acquisition (SCADA) computers, Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), networked data communications, and graphical user interfaces (GUIs), systems/sub-systems, control modules, and sensors/probes. These ICS are typically fully integrated with liquid petroleum fuel facilities and provide the capabilities of active/passive monitoring and remote access.

The DLA OEA ATG/IAS/OPE program is a component of the agency’s mission that provides

EAOTS ATG/IAS/OPE BASIC IDIQ PWS

RFP # SP4706-26-R-0001

comprehensive maintenance to sustain, support, modify, and repair the various ATG, IAS, and OPE solutions deployed globally at the DFSPs. These are mission critical components of the AFS that must be maintained for DLA Energy’s mission to be successfully performed.

The Government has determined that a single award Indefinite Delivery/Indefinite Quantity (IDIQ) contract is the best type of vehicle to accomplish the high volume and variety of requirements anticipated by DLA for the ATG/IAS/OPE program. An IDIQ contract of this nature can act as the primary support vehicle for DLA’s ATG/IAS/OPE program requirements and allow for centralized issuance of Task Orders (TOs). The TOs issued against this IDIQ are anticipated to require the contractor to render supplies and services on a global scale at various geographic locations (e.g. within the Contiguous United States (CONUS) and Outside the Contiguous United States (OCONUS)).

1.1 Purpose / Objectives

This Basic IDIQ PWS establishes an overarching agreement between the Government and the contractor. It defines the contract's purpose, outlines the broad task areas for issuing TOs, and provides DLA with a mechanism to rapidly issue TOs for acquisition of supplies and services to obtain:

a. Administrative support to successfully oversee and execute the ATG/IAS/OPE program.

b. Qualified technical experts to perform preventative maintenance (PM) on the ATG/IAS/OPE solutions deployed globally.

c. Technical support and customer service to troubleshoot problems and assist with

Government inquiries on ATG/IAS/OPE solutions deployed globally.

d. Creation, revision, or sustainment of technical documentation of the ATG/IAS/OPE solutions deployed globally.

e. Qualified technical experts to perform corrective maintenance (CM) or repairs on

ATG/IAS/OPE solutions deployed globally.

f. Engineering, infrastructure, and technical expertise of petroleum storage facilities to perform complex CM, modifications, improvements, or modernizations of ATG/IAS/OPE solutions deployed globally.

g. Cybersecurity compliance and support services to attain and maintain an Authorization to

Operate (ATO) accreditation for the ATG/IAS/OPE solutions deployed globally.

This contracting effort is part of a continuously improving Government approach to providing effective Operations and Support (O&S) of the various DLA OEA programs. The Government recognizes successful contract performance will be performed by an entity that takes responsibility for work performance of the tasks and subtasks identified in this PWS, executes continuous process improvement to increase efficiencies and reduce costs, and establishes a professional rapport with DLA Energy, the DLA program office, and various DoD fuel facility/DFSP representatives.

1.2 Current Incumbent Information

• Contractor: BAE Systems and Technology Solutions and Services Inc. (99789)

• Address: 520 Gaither Road Rockville, MD 20850-6198

• Contract #s: CONUS & Caribbean SP4702-21-D-0005, OCONUS (Pacific, Europe, Alaska & Hawaii) SP4702-21-D-0007

SECTION C-2: SCOPE

2.0 Scope

Supplies or services that are unrelated to the ATG/IAS/OPE program or its solutions as described in this PWS are NOT included within the scope of this IDIQ contract.

DLA intends to leverage the capabilities provided via this IDIQ contract to achieve the Government’s objectives identified in this PWS to the utmost extent practicable. Places of performance for the services and supplies rendered by the contractor are expected to be at DOD Installations located throughout the globe. All TOs issued under this IDIQ will be performance-based acquisitions and will include a PWS but may include detailed additional technical information / requirements when applicable. Each TO awarded will describe the Government’s desired outcome(s) / objective(s), tasks, Government reviews, and required data products for that specific effort.

The scope of this IDIQ will require the contractor to render a wide variety of supplies and services necessary to support the ATG/IAS/OPE program. These supplies and services will require the contractor to possess expertise in sustaining, supporting, maintaining, modifying, and repairing petroleum facilities and petroleum systems to comply with applicable codes, criteria, and federal, state, local and/or host nation regulations. Contractor services will also include operational, technical, maintenance, network, infrastructure, help/service desk, end user, administrative, field/site, cybersecurity, IT, OT, hardware, and software assistance. The supplies and services rendered by the contractor will need to account for the geographical disbursement

RFP # SP4706-26-R-0001

(i.e. CONUS & OCONUS) of the DFSPs due to different military installations/areas of responsibility to perform the work. The contractor will also need to account for and provide any commercial / ancillary software necessary to render services.

The contractor’s support of the ATG/IAS/OPE program is expected to include the overall technology stack of the solutions consisting holistically of all:

• Capabilities and applications

• Network Environments (NE) /

Computing Environments (CE) (i.e.

Development, Test, Stage, Production, Fail/Cut Over, Recovery, etc.)

• IT/OT components

• Software, hardware, and firmware

• Systems and sub-systems

• Data and databases

• Servers and machines

• PLCs

• RTUs

• Interfaces and integrations

• Networked data communications

• Reports and reporting documentation

• Technical artifacts/schematics

• Equipment, automation, and modules

• Edge devices (sensors, actuators, etc.)

• Cybersecurity controls

• Tank Instrumentation

• ATG Monitors

• ATG Sensors

• Auxiliary Equipment

• Communication Devices

• IAS Monitors and Sensors

• OPE Monitors and Sensors

• Acknowledgement Switches

• Warning Switches

• Consoles

• Horn and Lights

• Interstitial Sensors

• Modems

• Probes

• Probe Interfaces

• Tank instrumentation

• Tank Side Indicators

• Conduit and Wiring

• Surge Suppression

• Uninterruptable Power Supply (UPS)

• Emulators

• Converters

• Junction Boxes

• Panels and Panel Heaters

• Power Supplies

In this Basic IDIQ PWS and any TO PWS issued against this IDIQ, 'ATG/IAS/OPE' refers to the program and its solutions, including the complete technology stack, unless otherwise specified.

The contractor must utilize the best available commercial practices (such as Information Technology Infrastructure Library (ITIL), Project Management Institute (PMI), etc.) to influence service delivery supporting the ATG/IAS/OPE program. The contractor will be responsible for coordinating, managing, assigning resources, processes, and activities to successfully achieve the

RFP # SP4706-26-R-0001

Government’s desired outcome(s) / objective(s) described in each TO PWS. As such, the contractor must provide all labor, management, supervision, Quality Control (QC), transportation, supplies, vehicles, tools, materials, facilities, equipment, and incidentals necessary to perform the work. Successful execution of this contract will necessitate the contractor to work as part of an integrated team with Government personnel and other third-party contractors throughout the period of performance.

2.1 ATG/IAS/OPE Sites

The ATG/IAS/OPE program is currently spread across 328 CONUS and 106 OCONUS sites geographically disbursed between CONUS and OCONUS. A list of ATG/IAS/OPE sites where systems are deployed is identified in Attachment # 1 - List of ATG IAS OPE Sites. The contractor will be expected to render supplies and services at any of the sites identified.

2.1.1 Changes to ATG/IAS/OPE Sites

The Government reserves the right to add, remove, update, or realign the ATG/IAS/OPE sites identified in Attachment # 1 - List of ATG IAS OPE Sites as in scope modifications to this IDIQ contract. If required, these additions, removals, updates, or realignments will be considered within the scope and will be performed as a contract modification to be negotiated between the Government and contractor at the time of occurrence. During the life of this IDIQ contract, the contractor should expect the Government may request to add approximately twenty (20) ATG/IAS/OPE sites and remove / decommission approximately ten (10) ATG/IAS/OPE sites. Equitable adjustments for changes to the number of ATG/IAS/OPE sites will only be negotiated for active TOs that are directly affected by the requested revisions.

SECTION C-3: DESCRIPTION OF SUPPLIES AND SERVICES

3.0 Description of Supplies and Services

DLA has an overall requirement to obtain the necessary supplies and services to support the ATG/IAS/OPE program and maintain, troubleshoot, modify, and repair the deployed solutions by issuing TOs against this IDIQ. The contractor is expected to provide supplies and services including (but not limited to) supervision / management, personnel, materials, software, firmware, equipment, tooling, and the transportation necessary to perform the tasks defined each TO PWS. Each TO issued will contain the specific work efforts to be completed. The contractor will have the ultimate responsibility for providing qualified personnel with acceptable supplies and services to meet the requirements described within each TO. Unless otherwise specifically stated, all supplies provided by the Contractor must be in new condition and of the most suitable grade for the intended purposes. The Government reserves the right to perform inspections to ensure conformance of supplies rendered by the Contractor to any stated requirements on any TO

RFP # SP4706-26-R-0001

issued against this IDIQ contract.

All services performed under the auspices of this IDIQ contract must be non-personal in nature.

The Government will not exercise any supervision or control over the contract staff performing the services described herein. Subcontractors or third-party arrangements will be accountable solely to the prime contractor who, in turn, is responsible to the Government for successful performance. The Government and the Contractor understand that the services provided under this IDIQ are non-personal services and that no employer-employee relationship exists. The Government may provide technical direction to assist the contractor in accomplishing the work detailed in the PWS for each TO. However, the Government will not control the methods used and work performed by the contractor to meet the requirements set forth within it. The contractor must submit to the Contracting Officer (KO) or the assigned TO Contracting Officer's Representative (COR) all documentation, data products, and deliverables generated as a result of the work performed.

3.1. Task Areas

Each TO issued against this IDIQ contract will contain a PWS that describes the Government’s specific objective(s), desired outcome(s), requirements, and deliverables with tasks that align to one (1) or more Task Areas. While not all-inclusive of the types of supplies or services the Government may seek on a specific TO, the following information summarizes the Task Areas for this IDIQ contract:

3.1.1. Task Area 1 – Administrative Support

This task area encompasses administrative and program management services necessary to oversee successful completion of Task Orders issued against this IDIQ contract. It ensures coordinated work performance, maintains quality, and facilitates efficient resource management.

Contractor requested services associated with this task area may include:

a. Coordinating resources and personnel to achieve Government objectives for each TO.

b. Assisting with Government oversight and monitoring of daily work progress.

c. Generating Quality Control Plans (QCPs) and verifying acceptable quality levels (AQLs).

d. Drafting and maintaining administrative documentation, plans, reports, and records.

e. Planning, orchestrating, executing, and monitoring the movement/travel of resources.

f. Maintaining accountability of Government Property (GP), Government Furnished Material

(GFM), and Government Furnished Equipment (GFE).

g. Participating in meetings/conferences and documenting events with assigned action items.

h. Coordinating contractor employee onboarding and offboarding activities.

i. Developing project schedule baselines and actively monitoring progress/adherence.

j. Identifying and engaging with Government or third-party contractor stakeholders.

RFP # SP4706-26-R-0001

k. Planning and implementing the transition of work to/from third-party contractors.

l. Monitoring supply inventories and coordinating replenishment.

m. Maintaining security certifications and providing monthly reporting on compliance with cybersecurity requirements for personnel with privileged access.

n. Performing miscellaneous administrative functions to ensure successful work completion, based on specific Government requirements in each TO PWS.

3.1.2. Task Area 2 – Preventative Maintenance (PM) Support

This task area encompasses the supplies and services necessary to perform Preventative Maintenance (PM) on ATG/IAS/OPE solutions deployed globally. PM, or recurring maintenance, focuses on regularly scheduled inspections, inventorying, cleaning, and component replacements to prevent equipment failures. This proactive approach aims to maximize equipment uptime, extend asset lifespan, and reduce unexpected breakdowns. The contractor will ensure PM support services are completed compliant with Government reviewed and approved planned maintenance cycles. Contractor requested services associated with this task area may include:

a. Ensuring operational readiness and reliability of deployed ATG/IAS/OPE solutions.

b. Inspecting ATG/IAS/OPE solutions for breakdowns or failures requiring repairs.

c. Identifying needs for Corrective Maintenance (CM).

d. Testing and verifying the normal operation of ATG/IAS/OPE solutions.

e. Recommending ATG/IAS/OPE solution modifications.

f. Planning, coordinating, and traveling to/from ATG/IAS/OPE sites.

g. Creating, revising, and finalizing technical documentation.

h. Monitoring PM services from start to completion.

i. Coordinating with contractor technical support teams to perform PM work.

j. Prioritizing and rendering PM compliant with Government-approved schedules, frequencies, or Service Level Agreements (SLAs).

k. Generating and updating tickets/cases for PM services within the Government’s Information

Technology Service Management (ITSM) solution.

l. Performing miscellaneous PM functions necessary to ensure successful work completion,

3.1.3. Task Area 3 – Technical Support

This task area encompasses a wide variety of technical services to help the Government with inquiries, troubleshooting, and customer support for the ATG/IAS/OPE solutions deployed globally. Contractor requested services associated with this task area may include:

a. Providing ATG/IAS/OPE technical support teams comprised of qualified and competent

RFP # SP4706-26-R-0001

resources.

b. Creating, revising, and finalizing technical documentation.

c. Assisting customers and troubleshooting deployed ATG/IAS/OPE solutions.

d. Investigating and documenting ATG/IAS/OPE problem statements or failure root causes.

e. Reviewing existing Government technical documentation and performing basic diagnostics.

f. Providing technical knowledge of AFE, petroleum facilities, petroleum systems, etc., to answer Government inquiries and support deployed ATG/IAS/OPE solutions.

g. Identifying needs for CM based on customer-reported breakdowns or failures.

h. Assisting with planning and coordination for CM or repairs.

i. Generating and actively updating tickets/cases for technical support services within the

Government’s ITSM solution.

j. Prioritizing and rendering technical support compliant with Government-approved SLAs.

k. Performing miscellaneous technical support functions necessary to ensure successful work completion, based on specific Government requirements in each TO PWS.

3.1.4. Task Area 4 – Corrective Maintenance / Repair Support

This task area encompasses the wide variety of supplies and services necessary to perform Corrective Maintenance (CM) on the ATS/IAS/OPE solutions deployed globally. CM provides break/fix support after failures or deficiencies are discovered and is a reactive approach requiring on-site investigation, assessment, and problem resolution unique to the deployed ATG/IAS/OPE solutions. Contractor requested services associated with this task area may include:

a. Investigating and documenting ATG/IAS/OPE problem statements or failure root causes.

b. Inspecting, analyzing, and identifying requirements for CM.

c. Planning, coordinating, and traveling to/from ATG/IAS/OPE sites to perform CM.

d. Providing supplies and services to execute CM or repairs.

e. Testing and verifying restoration of normal ATG/IAS/OPE solution operation.

f. Recommending ATG/IAS/OPE solution modifications.

g. Creating, revising, and finalizing technical documentation.

h. Monitoring CM work from start to completion.

i. Coordinating with contractor technical support teams to perform CM work.

j. Generating and updating tickets/cases for CM services within the Government’s ITSM solution.

k. Drafting and revising technical documents or Statements of Work (SOW) to definitize complex CM or repairs into site support projects.

l. Prioritizing and rendering CM services compliant with Government-approved SLAs.

m. Performing miscellaneous CM functions necessary to ensure successful work completion

3.1.5. Task Area 5 – Engineering and Site Support

RFP # SP4706-26-R-0001

This task area encompasses supplies and petroleum facilities/systems engineering expertise to perform Complex Corrective Maintenance (CM) and Site Support projects on ATG/IAS/OPE solutions deployed globally.

• Complex CM: Activities associated with CM that exceed Government-established cost or time thresholds and need to be definitized into a stand-alone TO.

• Site Support: Activities ensuring DFSPs can reliably and efficiently store, handle, and distribute fuel to support military operations. This includes modifications, improvements, modernizations, upgrades, and enhancements to existing deployed ATG/IAS/OPE solutions and its infrastructure. While this does not include construction of new ATG/IAS/OPE sites, it may include work required to bring newly constructed systems up to specifications for continuous maintenance support under the ATG/IAS/OPE program.

Contractor requested services associated with this task area may include:

a. Reviewing and refining requirements, technical documents, or SOWs for Complex CM.

b. Planning, coordinating, and traveling to/from ATG/IAS/OPE sites for Complex CM.

c. Providing supplies and services to execute Complex CM.

d. Verifying restoration of normal ATG/IAS/OPE solution operation and recommending modifications.

e. Creating, revising, and finalizing technical documentation based on Complex CM work.

f. Monitoring Complex CM services from start to completion.

g. Coordinating with contractor technical support teams to render Complex CM services.

h. Generating and updating tickets/cases for Complex CM services within the Government’s

ITSM solution.

i. Designing or engineering ATG/IAS/OPE solution upgrades, improvements, modifications, or modernizations.

j. Upgrading or replacing major ATG/IAS/OPE solution components beyond the scope of PM or CM.

k. Performing miscellaneous petroleum facility/system engineering, Complex CM, or Site

Support functions to ensure successful work completion, based on specific Government requirements in each TO PWS.

3.1.6. Task Area 6 – Cybersecurity Support

This task area provides cybersecurity support services that are unique to the ATG/IAS/OPE program. Throughout the contract's lifecycle, as cybersecurity requirements are identified, the Government may issue new Task Order(s) to address specific, evolving cybersecurity needs, particularly those outside general system configuration. Contractor requested services associated

RFP # SP4706-26-R-0001

with this task area may include:

a. Supporting Government execution of the Risk Management Framework (RMF) process.

b. Assisting with system categorization, security control selection and implementation, system authorization, and continuous monitoring.

c. Scanning ATG/IAS/OPE solutions for cybersecurity vulnerabilities.

d. Implementing Security Technical Implementation Guides (STIGs) and Security

Requirements Guides (SRGs).

e. Generating and maintaining cybersecurity documentation.

f. Ensuring ATG/IAS/OPE program compliance with applicable cybersecurity publications such as:

1. DoDI 8510.01 Risk Management Framework (RMF) for DOD Systems.

2. DoDM 8140.03 Cyberspace Workforce Qualification and Management Program.

3. NIST SP 800-82 Guide to Operational Technology (OT).

4. NIST SP 800-53 Security and Privacy Controls for Information Systems and

Organizations.

5. NIST SP 800-160 Engineering Trustworthy Secure Systems.

g. Providing personnel meeting DODM 8570.01/DoDD 8140.01 requirements with privileged access such as system administration, network administration, etc.

h. Performing miscellaneous cybersecurity functions to ensure successful work completion based on the Government's specific requirements in each TO PWS.

SECTION C-4: GENERAL TERMS, CONDITIONS AND REQUIREMENTS

4.0 General Terms, Conditions and Requirements

The information in this section outlines the overarching general terms, conditions, and requirements that will apply to all TOs issued against the IDIQ.

4.1. Period of Performance (PoP)

This IDIQ contract has a PoP of five (5) twelve (12)-month base periods, resulting in a total potential duration of five (5) years. The PoP is structured as follows:

a. 12-month Base Period 1.

b. 12-month Base Period 2.

c. 12-month Base Period 3.

d. 12-month Base Period 4.

e. 12-month Base Period 5.

4.2. Ordering Period

TOs may be issued at any time during the five (5) base periods. The total ordering period will not exceed five (5) years from the date of the IDIQ contract award unless the term of the contract is extended in accordance with FAR 52.217-9, Option to Extend the Term of the Contract. TOs awarded during the ordering period may have a performance period extending up to one (1) year beyond the IDIQ contract's expiration date.

4.3. Place of Performance

The basic IDIQ contract will be issued through DLA Contracting Services Office (DSCO) located in Columbus, OH. However, the primary place of performance for work performed under this contract is expected to be throughout the globe (e.g. CONUS and OCONUS). Each individual TO placed under this contract will identify the specific location(s) for work performance.

4.4 Language Requirements

The contractor will ensure all personnel performing work for TOs issued against this IDIQ contract are capable of communicating with the Government employees by fluently speaking, reading, writing, and understanding the English language. As applicable, contractor personnel will also need to be versed in unique technical terminology required for the performance of assigned duties and functions.

4.5 Federal Holidays

The DoD recognizes the following Federal holidays, which are applicable to the local DLA Government workforce:

OBSERVED FEDERAL HOLIDAYS

New Year’s Day Labor Day Birthday of Martin Luther King Jr. Columbus Day

Washington’s Birthday Veterans Day Memorial Day Thanksgiving Day

Juneteenth National Independence Day Christmas Day Independence Day

Table 1 – Federal Holidays

RFP # SP4706-26-R-0001

4.6 Government Duty Hours / Working Hours

In general, when working at DLA or other Government locations the contractor must work the Government Duty Hours of that location. The standard Government Duty Hours for the performance of this contract will be between 07:30 and 17:30 hours local time, Monday through Friday, excluding Federal Holidays. However, each TO PWS may contain specific working hours requirements to maximize Government coordination, oversight, or ensure successful performance.

4.7 Contractor Worksite and Contractor Furnished Equipment (CFE)

The contractor will identify to the Government its own primary worksite for the duration of IDIQ execution. If there is a need for the contractor to change the location of its primary worksite, the contractor must request authorization from the Government to change it. Any request to change the primary worksite will need to identify the one (1) following conditions exist:

a. Organizational Need: There must be a predefined need, in keeping with the organization’s mission, for the contractor to work at a new primary worksite. For example, changes to the contractor’s organizational structure, inclement weather, Federal Government closure, etc.

b. Contractor Contingency of Operations Plan (COOP): The contractor may be authorized to perform TOs under this contract at another worksite upon declaration of a COOP or Pandemic situation by the Government.

If authorization is given, the Government will state when the contractor can begin working at the new primary worksite and all existing contract performance outcomes / metrics, deliverables and contract terms or conditions will remain in effect. The Government is not responsible for any costs associated with meeting the above requirements.

4.7.1 Contractor Furnished Equipment (CFE)

The Government anticipates the Contractor will need to provide the following CFE at no additional cost to the Government to perform work from their primary location and meet the objectives of this IDIQ contract:

l. Computer equipment, scanners, readers, and software applications to conduct technical support, monitor SNOW cases as well as diagnose, configure, and calibrate the components associated with the ATG/IAS/OPE program. Some of this CFE will need to be portable so that it can be taken to a specific Government site or DFSP to perform services.

m. Wireless communication equipment to enable contractor personnel access to their own

RFP # SP4706-26-R-0001

network environment (e.g. external of the Government NE or CE). The contractor will not use radio transmission or wireless devices at any Government facility or DFSPs unless they are approved by the Government. CFE wireless communication equipment must be rated as intrinsically safe and non-incendiary if it is used in hazardous environments.

n. The capability of obtaining digital recordings / images to aid in documenting on-site conditions at Government facilities or DFSPs and diagnose or troubleshoot ATG/IAS/OPE solutions. Contractor personnel will be expected to take digital recordings / images of ATG/IAS/OPE equipment and transmit this data as deliverables compliant to the requirements described in each TO PWS. The contractor will coordinate with the local Government facility site points of contact (POCs) to ensure authorization has been obtained to take digital recordings / images. All digital recordings / images will be considered technical data, subject to the Government’s technical data rights as described in this PWS and must be protected by the contractor from unauthorized disclosure or public release.

4.7.2 Contractor Worksite Remote Access Requirements

The contractor will ensure all CFE provided for work performance by their personnel off-site (i.e. computers, hardware, software, etc.) to remotely access the Government’s networks, systems, applications, and databases meet the minimal configuration requirements set forth in Attachment # 2 - VDI Virtual Desktop User Guide 2-2024.

All CFE is strictly prohibited from connecting to the DLA Virtual Private Network.

Contractors accessing the Government NE remotely should go to https://dla.dod.afpims.mil/Remote-VDI/ or https://dladirect.dla.mil/ for access. The Government is not responsible for any costs associated with providing, maintaining, or meeting contractor requirements associated with CFE. Computer equipment, to include network hardware, computers (desktop, laptop, and server), CAC readers, printers, and software intended for use in a contractor facility will be furnished by the contractor at no additional cost to the Government.

The contractor will provide all utilities used in the performance of duties outlined in this PWS for personnel located in contractor facilities.

All liability for issues and troubleshooting CFE is the responsibility of the equipment owner. The Government will not provide support for issues with hardware/software not provided by DLA, including but not limited to CFE hardware, non-DLA networks (e.g., home routers, public hot spots), and non-DLA software compatibility issues with Citrix. However, the Government’s DISA Global Service Desk will support troubleshooting issues that are not related to the CFE, including but not limited to accounts, DLA applications, and server-side issues. Contact 844- DISA-HLP (844-347-2457) for remote assistance.

https://dla.dod.afpims.mil/Remote-VDI/ https://dladirect.dla.mil/

RFP # SP4706-26-R-0001

a. While the Government is not responsible for any costs associated with the contractor’s primary worksite, it is recommended that CFE minimally install:

1. Windows 7, Windows 8/8.1, Windows 10, or Windows 11 Operating Systems

2. Applicable Security Technical Implementation Guides (STIGs)/checklists for operating systems.

3. Anti-virus, Anti-Spyware, and Host Based Intrusion Prevention software that is updated daily (i.e. software revisions, virus definitions). The Host Based Intrusion Prevention Software firewall should be configured to permit traffic by exception only, and dropping all other traffic.

4. Vulnerability scanning (at a minimum of every 15 days) with remediation of vulnerability findings.

5. Government approved CAC readers and middleware.

4.8 Security Requirements

All security requirements described in this Basic IDIQ PWS apply to the prime contractor and its subcontractors, third-party agreements, and temporary employees. For each TO issued against this IDIQ, the contractor will work with the assigned COR to meet all of the security requirements identified herein.

4.8.1 Physical Security Requirements

The contractor will be responsible for complying with all TO specific physical security requirements throughout the duration of this IDIQ contract. The contractor will ensure proper safeguarding of all GP, GFE, and GFM provided for contractor use. At the close of each work period, the Contractor will ensure all Government facilities, equipment, and materials are clean, maintained in an orderly fashion, and locked / protected from unnecessary hazard, damage, etc.

If the contractor observes any physical security concerns, they must immediately report them to the local Government facility security personnel and the COR. It is the contractor’s responsibility to ensure their personnel performing work under TOs issued against this IDIQ contract will meet all requirements for physical security at no additional cost to the Government.

4.8.1.1 Government Facility Access

Prior to gaining access to any Government facility, contractor personnel will be vetted through the local physical security office. Due to DoD security requirements, any individual who has an

RFP # SP4706-26-R-0001

unlawful immigration status, outstanding warrants, or certain convictions will not be permitted access to any Government facility. Names of contractor personnel will be provided to the local POC for vetting purposes no less than one week prior to the scheduled work. Contractor personnel (including foreign nationals) must ensure they have the appropriate identification required to access Government facilities. Contractor personnel entering a Government facility should anticipate their vehicle will undergo a physical security or anti-terrorism check and must ensure that no drugs, alcohol, contraband, or weapons of any kind are present. While on-site at Government facilities, contractor personnel are expected to continuously display identification (e.g. CACs or visitor badges) in a manner that is easily seen using physical devices such as ID card lanyards. These physical devices will be provided by the contractor at no additional cost to the Government.

When contractor personnel are at any Government facility, they will follow all security procedures and processes of the installation as stated and directed by the Government personnel at the site. For example, the contractor will ensure they control access by locking or unlocking the areas or facilities used by their personnel in the performance of work. The contractor will lock all internal overhead doors, cages, vaults, warehouse doors, windows, etc. before leaving an area unattended and prior to the conclusion of any working day. This includes locking up all external cargo and personnel doors when not in use.

4.8.1.2 OCONUS Specific Government Physical Security Requirements

For OCONUS sites, Status of Forces Agreements (SOFAs) between the US and host countries govern the legal status of US personnel and contractors. The contractor must be aware of and comply with the applicable SOFAs and labor laws for each country as applicable in the performance of any TO issued against this IDIQ contract. Security requirements for work in foreign countries will be based on the requirements set by the combatant commander of the particular Area of Responsibility (AOR) in which the work will be performed. If contractor is unable to obtain the specific security requirements for any site, they will contact the TO COR for assistance. Typical additional OCONUS physical security information includes things such as transportation into and out of the operating area, access controls and movement while on-site at a specific Government facility, required protective clothing and equipment, specific employee training prior to entering the operating area, etc.

4.8.1.3 Visitors

Depending on the requirements identified in each TO issued, the contractor will likely need to sponsor or escort subcontractors, suppliers, vendors, or other one-time occasional personnel to successfully perform work. These individuals will be considered by the Government as “Visitors” that are not dedicated contractor personnel. The Government will expect all visitors

RFP # SP4706-26-R-0001

supporting work performance on TOs issued against this IDIQ to be capable of completing security background investigations, even if they are not fully performed.

All visitors to a Government facility must obtain approval from the local security office or law enforcement prior to entry. The contractor must anticipate that certain Government facilities have higher security requirements and require additional measures to authorize visitors. For example, the contractor may be required to submit documentation such as DLA Form 1818 Visitor Request Form (or equivalent) to the local Government facility security office, law enforcement, or COR in advance visitor access. When authorized, the contractor will follow all host Government facility specific security controls, policies, and procedures for visitors. The contractor will be responsible for identifying and sponsoring all visitors supporting TOs issued against this IDIQ, including (but not limited to) their pre-vetting, travel, custody, and escort.

The following information outlines the general process associated with contractor visitor access to Government facilities:

a. The contractor identifies visitor need to perform work at the Government facility, perform pre-vetting, and confirms the personnel possesses positive identification to be authorized access.

b. The contractor contacts the COR assigned to the TO and/or the Government facility security office or law enforcement and submits applicable documentation to request visitor authorization.

1. This may include completing DLA Form 584 or local Government facility forms to provide a record of the identity of the visitor, the time and the duration of the visit, and other pertinent control data.

c. Upon approval for visitor access, the contractor will follow all local Government facility security procedures and coordinate the controlled visitor travel, custody, and escort to perform work.

1. This will include (but is not limited to) the contractor establishing and implementing procedures for controlling any visitor security badges, visitor permits, or other identifying credentials.

d. Upon completion of the work, the contractor will ensure the visitor departs the Government facility and will return all visitor security badges, visitor permits, or other identifying credentials to the local security office, law enforcement, or TO COR.

RFP # SP4706-26-R-0001

4.8.1.3.1 Foreign National Visitors

Judicious care and pre-vetting must be performed by the contractor prior to requesting foreign national visits to Government facilities. The Government will not authorize visits from foreign nationals to any Government facility without the written approval from the local security office, law enforcement, or assigned TO COR. The contractor should expect additional security requirements for all foreign nationals to Government facilities and if approval is obtained, must follow the instructions for coordinating the visit IAW DLAI 4303 Foreign Visits and Disclosure Program.

4.8.2 Personnel Security (PERSEC) Requirements

All dedicated contractor personnel onboarded under any TO issued against this IDIQ will be required, at a minimum, to complete a Government security background check such as a National Agency Check (NAC). ‘Dedicated contractor personnel’ in this context refers to any contractor employe (prime or subcontractor) that are continuously performing work or are directly assigned the responsibility to complete a task, subtask, etc. described in a TO PWS. All contractor activities required to complete the PERSEC requirements described herein (including travel and labor) will be accomplished at no additional cost to the Government and is not directly reimbursable under any TO issued against this IDIQ contract.

The following is a general outline of the process for the contractor to complete the mandatory Government security background checks for employees and onboarding / offboarding:

a. The contractor will need to generate documentation such as DLAH Form 1728 or Standard Form (SF) 85P National Agency Check (NAC)) and coordinate with the TO COR to obtain employee fingerprinting at a Government Real-Time Automated Personnel Identification (RAPID) facility. Completed copies of form DLAH 1728 will contain Personally Identifiable Information (PII) / Controlled Unclassified information (CUI) that must be marked and handled appropriately by the contractor.

The Government anticipates most of the work performed under this IDIQ contract will be non-sensitive. However, to assist the contractor with completing form DLAH 1728, the contractor coordinates with the TO COR and utilizes the following risk-based approach for identifying the applicable personnel security (PERSEC) background investigation based upon the sensitivity of the duties assigned for each employee:

a. Tier 1 – National Agency Check with Inquiries (NACI): The overwhelming majority of employees assigned to perform work on the TO and are assigned non-sensitive duties, as they will not require privileged access to the Government NE or CE, nor will they need access to sensitive information.

b. Tier 3 - National Agency Check with Law and Credit (NACLC) / Access National Agency

Check and Inquiries (ANACI): Few contractor personnel who require privileged access to the Government network environment (NE) or computing environment (CE) to perform work on the TO and are assigned non-critical sensitive duties.

c. Tier 5 - Single Scope Background Investigation (SSBI): Very few (if any) contractor personnel who require privileged access to the Government NE or CE to perform work on the TO and are assigned critical sensitive duties.

PERSEC Tiered Investigation Standards

Position Low Risk Moderate Risk High Risk

Confidential Secret Top Secret SCI Position Sensitivity Non-Sensitive Non-Critical Sensitive Critical Sensitive Special Sensitive Investigation Tier 1/NACI Tier 3/NACLC/ANACI Tier 5/SSBI Formerly Known As IT-III or IT-3 IT-II or IT-2 IT-I or IT-1

Table 2 – PERSEC Tiered Investigation Standards

b. The contractor will use secure electronic methods to transmit the required PERSEC documentation for background investigation to the assigned TO COR. Upon receipt, TO COR will coordinate with the DLA PERSEC office for processing. All PERSEC clearance eligibility will be determined as required by DoDM 5200.02 – Procedures for the DoD Personnel Security Program (PSP).

c. The DLA PERSEC office will coordinate to validate existing security clearance eligibility or request a background investigation for the contractor employee. Once completed, the DLA PERSEC office will provide a determination for onboarding acceptability to the TO COR. Only contractor personnel with a favorable background investigation will be recommended by DLA PERSEC for onboarding. If the background investigation identifies a proposed contractor employee may be a safety / security risk or has a criminal or drug problem, the Government will deny the contractor’s application and onboarding will not be authorized. No dedicated contractor personnel will be authorized for onboarding or CAC issuance without a reviewed and approved Government security background check by DLA PERSEC.

For planning purposes, the contractor should allow for no less than three (3) weeks / 21 calendar days for a PERSEC office decision on any individual contractor employee security background check. However, PERSEC office processing lead times will vary significantly based upon the criticality and sensitivity of the individual’s access requirements (e.g. this timeframe will increase for non-critical sensitive or critical sensitive access).

d. Upon receipt of onboarding acceptability from the DLA PERSEC office, the TO COR will verify the contractor employee’s registration in the Defense Eligibility Enrollment System (DEERS) or other appropriate Defense Manpower Data Center (DMDC) database https://www.dmdc.osd.mil/.

e. If CAC issuance is required, the TO COR will then follow the processes outlined in Appendix B – Common Access Card (CAC) Procedures.

f. The contractor will notify the assigned TO COR within 24 hours whenever contractor employees are reassigned, terminated, or resign to coordinate offboarding and revocation of access. As personnel are replaced or added through the duration of this IDIQ contract, the contractor will ensure their employees are capable of obtaining and maintaining a favorable adjudicated security clearance.

4.8.2.1 Non-Critical Sensitive or Critical Sensitive Access

Contractor employees requiring access to sensitive information must have applicable DLA PERSEC background investigations completed or interim access granted before authorization.

For example, personnel performing Information Assurance (IA) / cybersecurity tasks requiring "privileged access" to Government information systems will be considered higher-risk (non-critical sensitive or critical sensitive). The Government, at its sole discretion, may authorize an interim waiver for non-Key Personnel security clearance investigations on a case-by-case basis, provided no issues exist within the e-QIP Questionnaire for Public Trust Positions or Questionnaire for National Security Positions. The contractor must have the e-QIP form completed, with all other requirements (fingerprints and OF306, if required), and reviewed by DLA PERSEC before hiring personnel for duties requiring sensitive information access. Interim waivers will not be authorized on any TO Key Personnel. Requests for sensitive information access do not imply or convey access to classified information, and the Government will not authorize classified information access for any TO issued under this IDIQ.

4.8.2.2 Foreign Nationals and Non-U.S. Citizens

A foreign national is defined as a person who is not a citizen or national of the United States.

Foreign nationals under this IDIQ contract are only eligible to be assigned and perform non-sensitive duties (e.g. foreign nationals are only eligible for non-sensitive duties and will not be authorized for non-critical sensitive or critical sensitive duties). The contractor is responsible for ensuring that all foreign national employees conform to SOFA agreements and have the appropriate visas or work permits for the country in which they will be performing work. The contractor will assist the Government in any investigation into the suitability and eligibility of foreign nationals supporting or performing work on a TO issued against this IDIQ https://www.dmdc.osd.mil/

RFP # SP4706-26-R-0001

contract. For example, the contractor may be asked to provide the names of all foreign nationals performing work on TOs under this IDIQ contract, along with applicable documentation verifying that each person legally possesses visas or work permits.

4.8.2.3 Contact of a Suspicious Nature

Contractor personnel who have been contacted under suspicious circumstances must report that contact immediately, either verbally or in writing, to their supervisor who must report it within two (2) hours to the KO and COR. For reporting purposes, examples of suspicious contact includes (but is not limited to):

a. Contact with an individual (regardless of nationality) that suggests to the contractor employee that an intelligence gathering or terrorist organization may have targeted them for possible intelligence exploitation.

b. A request by anyone (regardless of nationality) for illegal or unauthorized access to classified or unclassified sensitive information.

c. Contact with a known or suspected intelligence officer from any country.

d. Contact with a foreign diplomatic establishment, whether in the U.S. or abroad, for personal or official reasons. Certain contractor personnel in positions designated as “sensitive” by the Government may also be required to inform their chain of command in advance of the nature and reason for contacting a foreign diplomatic establishment or travel to countries on the State Department list whose interests may be adverse to the United States.

Additionally, contractor personnel who have information about activities pertaining to espionage, terrorism, unauthorized technology transfer, sabotage, sedition, subversion, spying, treason, unauthorized release of classified or unclassified controlled information, or unauthorized intrusions into automated information systems will report that information to the KO and COR.

4.8.2.4 Contactor Personnel Conduct and Government Requests for Removal

Contractor personnel will conduct themselves in a professional manner, comply with government safety and security requirements at all times, and maintain appropriate workplace conduct (e.g.

wearing appropriate business attire, respectful communication, etc.). The Government reserves the right to request removal of any contractor personnel for cause. 'Cause' in this context means contractor personnel whose behavior or actions are clearly contrary to the public interest and deemed by the KO as unacceptable such as unethical behavior, demonstrated incompetence in…