B.08.01 Solicitation – RFQ – W912DQ22Q1060.pdf

SEE ADDENDUM

(No Collect Calls)

W912DQ22Q1060 25-Aug-2022

b. TELEPHONE NUMBER

(816) 389-2041

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 15 Sep 2022

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912DQ9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

RICK MATHENA

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

USACE, KANSAS CITY +

CONTRACTING DIVISION FEDERAL BLDG CT 601 E 12

KANSAS CITY MO 64106-2896

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 966475 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

USACE, KANSAS CITY +

RACHEL DONATTI

HARRY S TRUMAN PROJECT OFFICE 15968 TRUMAN R

WARSAW MO 65355

TEL: 816-389-3606 FAX: 660-438-7815

816-389-3029FAX:

TEL: 816-389-3812 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$30,000,000

NAICS:

541512

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF64

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section A - Solicitation/Contract Form

COMBINED SYNOPSIS SOLICITATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in subpart 12.6 as supplemented with additional information included in this notice. This announcement constitutes the only solicitation, proposals are being requested and a written solicitation will not be issued.

The solicitation number for this acquisition is W912DQ22Q1060 and it is being issued as a Request for Quotes (RFQ).

The solicitation documents and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2005-84.

This RFQ shall be set aside for small businesses and the associated North American Industry Classification system (NAICS) code is 541512, “Computer Systems Design Services” and the business size standard is $30,000,000.00.

Far 52.212-1, Instructions to Offerors- Commercial does apply to this acquisition with no addenda to the provision and is located in Section L of this combined synopsis/solicitation.

Far 52.212-2, Evaluation - Commercial Edited does apply to this acquisition with no addenda to the provision and is located in Section M of this combined synopsis/solicitation.

FAR 52.212-3, Offeror Representations and Certifications -- Commercial Items, does apply to this acquisition with no addenda to the provision, and is located in Section K of this combined synopsis/solicitation.

FAR 52.212-4, Contract Terms and Conditions - Commercial Items, does apply to this acquisition with no addenda to the provision. These specific clauses required are located in Section I of this combined synopsis/solicitation.

FAR 52.212-5, Contract Terms and Conditions - Required to Implement Statutes or Executive Orders- Commercial Items, applies to this acquisition. These specific clauses required are located in Section I of this combined synopsis/solicitation.

System for Award

Management

In accordance with FAR 52.212-1(k): By submission of an offer, the offeror acknowledges the requirement that a prospective awardee shall be registered in the SAM database prior to award, during performance and through final payment of any contract resulting from this solicitation. If the Offeror does not become registered in the SAM database in the time prescribed by the Contracting Officer, the Contracting Officer will proceed to award to the next otherwise successful registered Offeror. Offerors may obtain information on registration and annual confirmation requirements via the SAM database accessed through https://sam.gov/portal/SAM/#1 . It is highly encouraged that all prospective Offeror’s start the SAM’s registration process as soon as possible.

OFFEROR MUST BE REGISTERED IN THE SYSTEM FOR AWARD

MANAGEMENT WITHIN 7 DAYS OF THE CLOSE OF THE SOLICITATION OR

THE CONTRACT OFFICER MAY PROCEED WITH AWARD TO THE NEXT

SUCCESSFUL CONTRACTOR.

If you were not previously registered, please go to https://www.sam.gov. Instructions for new registration are also located at the following link https://www.sam.gov/sam/transcript/Quick_Guide_for_Contract_Registrations_v1.7.pdf to register.

If you have questions about Government procurements in general or need assistance in the preparation of your proposal, a local Procurement Technical Assistance Center (PTAC) may be able to help. The Procurement Technical Assistance Program was authorized by Congress in 1985 in an effort to expand the number of businesses capable of participating in the Government marketplace. To locate a PTAC near you, go to http://www.aptac-us.org/sam-registration/ THIS A FREE SERVICE BY A NON PROFIT PAID FOR BY THE US

GOVERNMENT

W912DQ22Q1060

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Job FY23 Hydropower control system tech sup

FFP

Provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Hydropower Control Systems Technical Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

FOB: Destination

PSC CD: DA10

NET AMT

0002 1 Job OPTION Rockwell Software and Licence

FFP

Provide one instance of Rockwell Studio 5000 Professional Software Version

34.00.00 or later and the perpetual license for installation on a Government maintenance laptop. Submit software and license within 30 days of NTP if the option is exersied.

0003 1 Job OPTION FY24 Hydropower control system tech sup

FFP

Provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Hydropower Control Systems Technical Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

0004 1 Job OPTION FY25 Hydropower control system tech sup

FFP

Provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Hydropower Control Systems Technical Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

Section C - Descriptions and Specifications

PWS

PERFORMANCE WORK STATEMENT

Hydropower Control Systems Technical Support Harry S. Truman Power Plant, Warsaw, MO, and Stockton Power Plant Stockton, MO

Part 1: General Information

1. GENERAL. This is a non-personnel services contract to provide Hydropower Control Systems Technical Support.

The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 DESCRIPTION OF SERVICES. Provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Hydropower Control Systems Technical Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 BACKGROUND. The Harry S. Truman Power Plant (HST) is located in Warsaw, MO on the Harry S. Truman Reservoir, and the Lake of the Ozarks. It has six slant-axis generators/motors with Kaplan turbines. The Stockton Power Plant (STK) is located in Stockton, MO on the Stockton Reservoir, and the Sac River. It has a single vertical axis generator with a Kaplan turbine. The hydropower control systems are real-time operational technology (OT) systems used to control and/or monitor various functions such as power generation, auxiliaries, and switchyards.

They use a combination of IT and OT type hardware and software. The primary hydropower control system at HST and STK is the supervisory control and data acquisition (SCADA) system. STK is remote operated from HST. The SCADA system is a closed restricted system that’s maintained at an interim secure state (ISS).

1.3 OBJECTIVE. Provide technical support to the Government in support of the operations and maintenance of the hydropower control systems at HST and STK.

1.4 PERIOD OF PERFORMANCE. The period of performance shall be for one (1) base year of 12 months and two (2) 12-month option years. The period of performance reads as follows: Base Year, Option Year I, Option Year II.

1.5 CONTRACTOR PERSONNEL. The Contractor must have a minimum of 5 years of experience with design, implementation, and maintenance OT systems used to control power generation and switching. The Contractor must also have a minimum of 5 years of experience of the implementation of the Risk Management Framework to such OT systems to protect them from cybersecurity vulnerabilities, threats, concerns, and etc. The Contractor must ensure that personnel accessing OT systems have the proper and current cybersecurity certification to perform cybersecurity functions: DOD Directive 8140.01, DOD 8570.01-M, and DA PAM 25-2-6.

1.6 QUALITY ASSURANCE. The Government will evaluate the Contractor’s performance in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.7 HOURS OF OPERATION. Normal hours of operation at HST and STK are 06:00 and 16:30 Monday thru Friday excluding Federal holidays or when the Government facilities are closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.8 PLACE OF PERFORMANCE. Onsite technical support will be performed at HST and/or STK. Offsite technical support will be performed at the Contractor’s place of business or other location(s) with minimal disturbances.

1.9 SAFETY. All onsite technical support must be performed in compliance with the current version of the EM 385- 1-1, “U.S. Army Corps of Engineer’s Safety and Health Requirements Manual,” and local policies/procedures including arc flash and the hazardous energy control program.

http://www.publications.usace.army.mil/Portals/76/Publications/EngineerManuals/EM_3 85-1-1.pdf

1.9.1. Furnish a site-specific Accident Prevention Plan (APP) within 30 days of contract award. Prepare the APP in accordance with the format and requirements of USACE EM 385-1-1. Cover all paragraph and subparagraph elements in USACE EM 385-1-1, Appendix A, "Minimum Basic Outline for Accident Prevention Plan". The APP shall be job-specific and address any unusual or unique aspects of the project or activity for which it is written.

1.9.2. Furnish an Activity Hazard Analysis within 30 days of contract award. The Activity Hazard Analysis must address all foreseeable safety concerns such as electrical safety, safety zone protection, fall protection, fire safety, personal protective equipment, signage/protective fencing, and hazardous material handling.

1.10 ANTITERRORISM/OPERATIONS SECURITY REQUIREMENT.

1.10.1 The security requirements described below apply to all contract personnel (including employees of the prime Contractor (“Contractor”) and all subcontractor employees) supporting the performance requirements of this contract. The Contractor is responsible for compliance with these security requirements. Questions regarding security matters shall be addressed to the designated Government representative (e.g., Contracting Officer Representative (COR), Requiring Activity (RA) representative, or Contracting Officer (if a COR or other RA representative is not appointed)). Contract personnel are critical to the overall security and safety of US Army Corps of Engineers (USACE) installations, facilities and activities, and security awareness training contributes to those efforts. The Department of Defense (DoD) and Army security training requirements specified below, if applicable, are performance requirements; all applicable contract personnel shall complete initial training within 30 days of contract award or the date new contract personnel begin performance on the contract. Within five business days from the completion of training, the Contractor shall provide written documentation (e.g., email or memorandum) to the Government representative. The documentation shall include the names of contract personnel trained and which training they completed; the Contractor shall maintain training records as part of their contract files and be prepared to provide copies of training certificates to the Government representative. Contractor personnel and vehicles are subject to search when entering federal installations. Additionally, all contract personnel shall comply with Force Protection Condition (FPCON) measures, Random Antiterrorism Measures (commonly referred to as “RAMs”), and Health Protection Condition (HPCON) measures. The Contractor is responsible for meeting performance requirements during elevated FPCON and/or HPCON levels in accordance with applicable RA plans and procedures --this includes identifying mission essential and non-mission essential personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the FPCON or HPCON levels at any individual facility or installation change, the Government may implement security changes that affect contract personnel. The Contractor shall ensure all contract personnel are aware of their security responsibilities, including any site-specific requirements identified in local policies or procedures

1.10.2 All contract personnel requiring physical access to a federal installation or facility shall comply with the access control procedures of that location. Contract personnel requiring unescorted access to meet contract performance requirements on a DoD installation in the US shall be vetted by the installation/facility Provost Marshal/Directorate of Emergency Services/Security Office using the National Crime Information Center-Interstate Identification Index (commonly referred to as “NCIC-III”) and Terrorist Screening Database (commonly referred to as “TSDB”). Contract personnel shall comply with all personal identity verification requirements specified in installation/facility policies and procedures. Contract personnel who do not meet requirements for unescorted access to USACE facilities shall coordinate escorted access with the Government representative, as needed. Contract personnel who receive keys, access cards, or lock combinations that provide access to government-owned property shall comply with key and lock control procedures of the

RA

1.10.3 All contract personnel shall receive initial and annual refresher training from the RA representative on the local suspicious activity reporting program. This locally developed training provides contract personnel with general information on suspicious behavior, and guidance on reporting suspicious activity to the project manager, security representative or law enforcement entity.

1.10.4 All contract personnel with access to critical information (as identified in the RA's OPSEC Program) shall complete initial and annual refresher OPSEC Level I Awareness training, which is available at the following websites: https://www.iad.gov/ioss/, or http://www.cdse.edu/catalog/operations-security.html (websites subject to change). All contract personnel with access to Controlled Unclassified Information (CUI) shall complete initial and annual refresher CUI training in accordance with applicable Army policy

1.10.5 In accordance with applicable regulations, all contract personnel who do not possess the appropriate security clearance or access privileges will be escorted in areas where they may be exposed to classified information or operations, sensitive information or activities, or restricted areas.

1.10.6 Contractors shall comply with the requirements set forth in FAR clause 52.222-54 Employment Eligibility Verification and FAR Subpart 22.18 in using the E-Verify Program at (https://www.e-verify.gov/) (website subject to change) to meet the contract employment eligibility requirements. Contractors are encouraged to cooperate with Federal and State agencies responsible for enforcing labor requirements to include eligibility for employment under United States immigration laws in accordance with FAR 22.102-1(i).

An initial list of verified/eligible candidates shall be provided to the COR no later than three business days after the initial contract award. When contracts are with individuals, the individuals will be required to complete a Form I-9, Employment Eligibility Verification, and submit it to the Contracting Officer to become part of the official contract file.

1.11 PHYSICAL SECURITY. Safeguard all government equipment, information and property provided. At the close of each work period, equipment, and materials shall be secured.

1.12 CYBER SECURITY TRIANIG. All Contractor employees, including subcontractor employees must complete the DOD Cyber Awareness Challenge Training before access the OT systems, and annually thereafter. DOD 8570.01 and AR 25-2, all contractor personnel supporting cybersecurity functions shall complete appropriate training with specified timelines and attain and maintain the required IT and cybersecurity training certifications.

1.13 CONTRACTORS THAT DO NOT REQUIRE CAC BUT REQUIRE ACCESS TO A DOD FACILITY. The contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Insterstate Identification Index (NCIC-III) and

1.14 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED). All Contractor personnel and equipment that will connect to USACE-owned systems are subject to the requirements of this paragraph. This includes all Contractor equipment, including laptops and other portable devices.

1.14.1 All Contractor PEDs shall be approved by the Contracting Officer (KO) or Contracting Officer's Representative (COR) for connection to USACE-owned systems prior to connection. For compliance, security, and network maintenance purposes, authorized individuals within USACE may monitor equipment, systems, and network traffic at any time, per the existing acceptable use and audit policies. USACE reserves the right to audit networks and systems on a periodic basis to ensure compliance with Army policy. Users connecting to USACE-owned equipment with approved PEDs consent to monitoring and inspection of their equipment.

1.14.2 PEDs approved for connection to USACE-owned systems equipment shall meet the following requirements:

a) Be subject to scanning or checking by designated USACE personnel before being connected to any USACE-owned equipment.

b) This process will be repeated before connection each time the PED goes off-site (crosses the facility boundary).

c) Undergo regular maintenance ensuring the PED is patched and up to date and a current full antivirus scan has been completed within the previous 10 days.

d) Ensure the PED firewall is enabled and set to "Public".

e) Demonstrate that all required patching and software/firmware updates are applied, and compliance with any applicable STIGS (Security Technical Implementation Guides) version and release is achieved.

f) Employ data-at-rest encryption to protect information stored on the device. The types of information that must be protected include the following: site specific drawings; configuration files; project files; vulnerability data; and any specific information that could potentially lead to a compromise.

1.14.3 If limited connectivity to the Internet is required to update software patches and retrieve updated virus definitions, the following requirements shall be met:

a) The host-based firewall on the computer shall be enabled and the network identifier for the Internet connection must be set to "Public".

b) After the software patches are applied and the virus definitions updated, the computer shall be isolated from the Internet connection, and a full scan with the Antivirus Software completed, resulting with no detections, prior to connection to the USACE-owned equipment.

c) Prior to connecting to the equipment, network, or system, antivirus definition files shall be verified to be less than seven days old and a full scan has been completed.

1.14.4 In the event that an authorized or approved non-USACE-owned PED is lost or stolen, user shall immediately notify the Contracting Officer or Contracting Officer's Representative.

1.14.5 Under no circumstances are users authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing authorized or approved USACE-owned or non-USACE-owned resources related to work on this contract. The following activities are strictly prohibited with regards to connecting authorized or approved USACE-owned or non-USACE-owned PEDs to USACE-owned equipment, with no exceptions:

a) Using SCADA or other related monitoring and/or control systems for any personal use.

b) Connecting unauthorized or unapproved non-USACE PEDs to USACE equipment, systems, or networks.

c) Intentional introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.).

d) Port scanning or security scanning without prior notification to the KO, in coordination with designated site IT personnel.

e) Executing any form of network monitoring which will intercept data not intended for the user's host, unless this activity is a part of the user's normal job/duty.

f) Hotspot-capable PEDs are not permitted to broadcast Wi-Fi signals as an access point (i.e. function as a router for a wireless network) within and/or around certain areas of the USACE facility premises (e.g., control room and computer server room, unit control equipment enclosures such as RTU cabinets, digital governor or exciter cabinets, etc.) and shall not be connected to USACE equipment, systems, or networks.

g) PEDs shall not be loaned or otherwise given to any person other than whom the device is assigned to.

h) Exporting software, technical information, encryption software or technology, which is in violation of international or regional export control laws. Notify the KO or COR of any material that is in question. Material in question shall only be exported with KO or COR approval.

1.14.6 Any use of email on SCADA and any related monitoring/control of USACE systems or networks is prohibited.

1.15 DATA RIGHTS. The Government has unlimited rights to all documents/material produced under this contract.

All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.16 CONTRACTING OFFICER REPRESENTATIVE (COR). The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: coordinate and schedule all activities to be performed by the Contractor: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.17 POST AWARD CONFERENCE/PERIODIC PROGRESS MEETINGS. The Contractor agrees to attend any post award conference convened by the contracting activity in accordance with Federal Acquisition Regulation Subpart 42.5.

The Contracting Officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.18 SCHEDULING. The Contracting Officer’s Representative shall schedule all services performed by the Contractor under this contract. Primary communications will be via phone and/or email. The Contractor must have normal business hours Monday through Friday excluding Federal Holidays. A reasonable response time of no more than 4 business days is expected for all inquiries and requests made by the Government.

Part 2: Definitions & Acronyms

2. DEFINITIONS AND ACRONYMS.

2.1 ARCHITECTURE TYPE. The level of interconnectivity of an Operational Technology (OT) is a foundational criterion used when determining the priority of a system. The more connectivity capability, the higher the likelihood that the system can be compromised through a cyber-attack. There are three main types of interconnections: no interconnection (OT Product, OT Subsystem), closed restricted network connection (OT Closed Restricted System), and interconnected (OT Restricted Interconnected System and OT Connected System).

2.2 BOUNDARY DEFENSE. When Operational Technology (OT) information travels outside the physical boundary, the information flow must be protected against outside threats. Firewalls should be used to isolate networks and protect data flow by restricting unnecessary traffic, both inbound and outbound. Traffic flows should also be encrypted using a VPN. Intrusion Detection should be used to alert on malicious or unauthorized traffic. For Operational Technology (OT) that requires information flow between the control network to an external boundary, e.g. Hydrology Reports, the connection will be protected using a data diode or unidirectional gateway instead of a firewall for additional protection.

2.3 BIOS. Basic Input/Output System. Fundamental system firmware used to boot and initialize system.

2.4 CCI. Control Correlation Identifier. The Control Correlation Identifier (CCI) provides a standard identifier and description for each of the singular, actionable statements that comprise an IA control or IA best practice. CCI bridges the gap between high-level policy expressions and low-level technical implementations. CCI allows a security requirement that is expressed in a high-level policy framework to be decomposed and explicitly associated with the low-level security setting(s) that must be assessed to determine compliance with the objectives of that specific security control. This ability to trace security requirements from their origin (e.g., regulations, Information Assurance frameworks) to their low-level implementation allows organizations to readily demonstrate compliance to multiple Information Assurance compliance frameworks. CCI also provides a means to objectively rollup and compare related compliance assessment results across disparate technologies.

2.5 CI. Critical Infrastructure. CI is defined as, "Systems & assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters (Critical Infrastructures Protection Act of 2001)."

2.6 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.7 CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.8 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have authority to change the terms and conditions of the contract.

2.9 CYBERSECURITY FUNCTION. A cybersecurity function is further defined as a user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform.

Examples of these activities include, but not limited to, creating/modifying user accounts, configuring auditing levels, configuring functionality of a device that is restricted from general users, network architecture design, and applying secure configuration to an Operating System or device.

2.10 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.11 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.12 IAVAs. Information Assurance Vulnerability Alerts. The Department of Defense (DoD) information system vulnerabilities are alerted with messages called Information Assurance Vulnerability Alerts (IAVA). Vulnerabilities are evaluated to see what impact (if any) they might have and sent out by to all branches and units within the organization.

2.13 INTERCONNECTIN CAPABILITY. Architecture's Interconnection capability is determined via the communications that exist between Operational Technology line items, whether they share an information type or not. Interconnection capability also includes any type of connection between line items and an external network.

Interconnection capability is considered a primary risk factor that affects all aspects of the cybersecurity program.

Reviewing network device information from the inventory provides an understanding of the basic networking structure and communication capabilities between the various listed line items and builds a clearer picture of the scope of the potential system. The UCIC developed five OT architecture types based on regularly occurring interconnection capability: the OT product, OT subsystem, OT closed restricted system, OT restricted interconnected system, and OT connected system.

2.14 ISO. Information System Owner. Official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system, such as the District Chief of Operations.

2.15 ISS. Interim Secure State. Interim Secure State is achieved when a USACE control system's risk is known and the system has been verified as being technically and physically secured to an acceptable risk tolerance, but it does not have all documentation and/or administrative requirements met for obtaining an Authority To Operate (ATO).

ISS is used to verify that a new control system installation, or a system going through a major upgrade, is implementing critical security controls during the installation phase and meets a specific cybersecurity standard (defined in this document) prior to the government taking ownership. ISS is also used to verify that an existing control system is operating at an acceptable state of cybersecurity.

2.16 IT. Information Technology. Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency.

2.17 KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.18 NETWORK SEGMENTATION: The control network must be segmented or segregated either by logical or physical methods. Examples of logical methods include firewall zones, VLANs, or VPNs. Physical separation is done by deploying additional hardware. Network segmentation is used for isolation of discrete functions or processes.

Each network segment will have its own IP address space or subnet.

2.19 OT. Operational Technology. The hardware and software dedicated to detecting and/or causing changes in physical processes through direct monitoring and control of physical devices to accomplish a specific mission in real time.

2.20 OT PRODUCT. An OT Product (either individual or aggregate) is a PLC with a non-routable IP or serial connection to a touch panel with an embedded operating system, no connection to a computer or server, no communications using a routable protocol, and no connection to any component outside the physical boundary of the project. This is the foundational building block for the more complex OT systems. It is important to note that the connection between the touch panel and the PLC must be a one-to-one physical connection. Any connection with routable communications will elevate the OT Product to an OT Subsystem. There are circumstances, particularly in hydropower facilities, when there are multiple OT Products all accomplishing similar missions but are not interconnected in any way. The UCIC determines if aggregating those OT Products into one administrative grouping is beneficial for RMF reporting. If so, this becomes the OT Product aggregate. It is important to note that the aggregate does not indicate any type of routable communications being used, and therefore does not raise this to the “system” level; it is purely an administrative designation.

2.21 OT SUBSYSTEM. An OT Subsystem (either individual or aggregate) adds workstations or servers to the PLCs for operation from a control room utilizing a routable protocol (Ethernet). It is important to note that there is no connection to any component that resides outside the logical or physical boundary of the project. The UCIC, in coordination with the ISO, determines how far a project’s physical boundary extends for the OT to remain a subsystem. That distance may be different from project to project. It is possible to group multiple OT Subsystems together when they operate under a single ISO, have the same information type, and have similar system configurations. This is called an OT Subsystem aggregate.

2.22 OT CLOSED RESTRICTED. An OT Closed Restricted System is a subsystem that is networked to another government-owned and government-operated subsystem for remote control or monitoring capabilities over encrypted communication channels. The communication over encrypted channels is controlled and maintained on both ends by the same ISO. This system is not connected to any external network, nor does it have an external network connection capability.

2.23 OT RESTRICTED INTERCONNECTED SYSTEM. An OT Restricted Interconnected System is an OT subsystem or an OT system that has the capability to connect to an external system only through a single-directional push of data (e.g., alarms, trends, and alerts) via a data diode or equivalent technology.

2.24 OT CONNECTED SYSTEM. An OT Connected System is an OT Subsystem or OT System that has a bi-directional path between the OT and an external network.

2.25 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.26 QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.27 QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.28 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.29 RMF. Risk Management Framework. A structured approach used to oversee and manage risk for an enterprise. See DOD 8510.01, and NIST SP 800-37 for information and requirements.

2.30 SHB. Secure Host Baseline, or Army Gold Master. An image for certain Windows-based operating systems is available from the Government, upon request.

2.31 STIGs. Security Technical Implementation Guides, as released by the Defense Information Security Agency (DISA). Seehttps://public.cyber.mil/STIGS for information.

2.32 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.33VLAN.: Virtual LAN (Local Area Network). A subnetwork which can group together collections of devices on separate physical local area networks (LANs). A LAN is a group of computers and devices that share a communications line or wireless link to a server within the same geographical area.

2.34 VM. Virtual Machine. A virtual machine is a computer file, typically called an image, that behaves like an actual computer. In other words, creating a computer within a computer. It runs in a window, much like any other program, giving the end user the same experience on a virtual machine as they would have on the host operating system itself.

2.35 WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

Part 3: Government Furnished Property, Equipment, and Services

3. GOVERNMENT FURNISHED ITEMS AND SERVICES. The Government will provide the Contractor:

3.1 Physical and administrative access to the hydropower control systems at HST and STK. Remote administrative access to the hydropower control systems is strictly prohibited.

3.2 Physical access to applicable Controlled Unclassified Information / Critical Electrical Infrastructure Information such as network diagrams, source code, program files, configurations, USACE Civil Works RMF polices, and etc.

3.3 Army Golden Master (AGM) Microsoft Operating System builds.

3.4 Security Technical Implementation Guides (STIGS).

3.5 Security Content Automation Protocol (SCAP) scanner tool(s).

3.6 Information Assurance Vulnerability Alerts (IAVA’S).

3.7 Any IT and OT hardware that may be necessary.

Part 4: Contractor Furnished Items and Services

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES.

4.1 GENERAL. Furnish all supplies, equipment including personal protective equipment, and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 BASELINE CERTIFICATION. Possess and maintain current DOD approved baseline IAT Level II certification. See https://public.cyber.mil/cwmp/dod-apporved-8570-baseline-certifications/ for the approved baseline certifications. Submit certification(s) of all Contractor personnel who will be accessing and working with the OT systems within 14 days after award. If certification(s) lapses any time during the life of the contract, submit a written corrective action plan within 14 days of the day of lapse. The corrective action plan must detail the step-by-step actions to be taken including milestone dates to become compliant with this requirement again. Failure to possess and maintain current IAT Level II certification(s) could result in contract termination.

4.3 ACCEPTABLE USE POLICY. Sign and return the USACE OT/Control Systems Acceptable Use Policy (AUP).

Submit acceptable use policy(s) within 14 days after award.

4.5 AVEVA SERVICE AGREEMENT. Provide the annual service agreement for AVEVA In-touch software. An instance of the 2020 version of AVEVA In-Touch development is deployed at HST, and instances of the 2020 version of AVEVA In-Touch runtimes are deployed at HST and STK. Submit service agreement within 30 days after award.

4.6 AVEA DEVELOPMENT LICENSING.

4.6.1 ANNUAL SUBSCRIPTION. In the Base Year, provide the annual subscription renewal for the instance of AVEVA In-Touch development software deployed at HST. Submit license within 30 days after award.

4.6.2 PERPETUAL. In OPTION Year I, provide a perpetual license for the instance of the AVEVE In-Touch development software deployed at HST. Submit license within 30 days of the exercise of OPTION Year I.

4.7 ROCKWELL SOFTWARE AND LICENSING (OPTION) Provide one instance of Rockwell Studio 5000 Professional Software Version 34.00.00 or later and the perpetual license for installation on a Government maintenance laptop. Submit software and license within 30 days of the exercise of the OPTION.

Part 5: Specific Tasks

5 SERVICES. Provide the following services:

5.1 Provide expertise and consulting on cybersecurity and its application to OT systems and/or environments. Expertise and consulting include but not limited to industry best practices and application;

interpretation, and application of Federal cybersecurity publications (see Section 6); vulnerability assessments; remediation and/or mitigation; and etc.

5.2 Provide expertise and consulting on design, implementation/installation, and maintenance of IT and OT systems and/or environments. Those specifically used for power generation and transmission, auxiliaries, and sequence of events recording.

5.3 Apply a well-developed and broad working knowledge to the current and future OT systems at HST and STK. Be knowledgeable of and adhere the USACE Civil Works RMF Policies (CUI). Assist with the implementation of said policies.

5.4 Assist the Government in maintaining an ISS (see Section 2) of the SCADA system at HST and STK. Work includes but not limited to performing taking backup images and restoration; vulnerability scanning;

remediation and/or mitigation; applying firmware updates, patches, and service packs; testing changes in a test environment (virtual and/or simulated real); and etc.

5.5 Utilize the cybersecurity tools provided. Update official documentation as requested. Provide vendor patches, service packs, updates, and firmware that have no monetary costs as requested.

5.6 Develop professional work products as requested such as assessment reports, recommendation reports, mitigation plans, trip reports, hardware and/or software lists, and etc.

5.7 Troubleshoot various issues with the computer hardware, networking hardware, controllers, operating systems, applications, databases, communications, and interconnections to other OT systems.

5.8 Perform installation and/or configuration hardware and software.

5. 9 Create/develop and/or modify HMI screens, programming, scripts, configurations/settings, databases, and etc.

as necessary. Track version control with appropriate methods. Ensure correct and proper functionality of hardware and/or software after implementation of changes.

5.10 When onsite at HST and/or STK coordinate daily activities with plant management, system administrators, and the COR (if available). Otherwise, periodically coordinate scheduled activities/tasks with the COR by phone and/or email. Participate in technical meetings as requested.

5.11 SERVICES FOR OFFSITE AND ONSTIE TECHNICAL SUPPORT.

5.11.1 OFFSITE TECHNICAL SUPPORT. Provide services for offsite technical support as requested; the schedule to be determined on the basis of need by the Government. Offsite technical support is a flat hourly rate for a NOT TO EXCEED number or hours. See Section 7, Exhibit 3 for the number of hours. The amount of time spent on activities/tasks will be accounted for in half-hour (30 minutes) increments. Keep and maintain an electronic log documenting the activities/tasks performed, who performed the activity/task, the dates performed, and the amount of time spent on each activity/task each day. Any personal and/or contract administration time shall not be borne by the Government. Submit the log when submitting an invoice requesting payment for offsite technical support. The invoice will be returned for correction for any discrepancies, errors, and/or mistakes found in the log.

5.11.2 ONSITE TECHNICAL SUPPORT. Provide services for onsite technical support as requested; the schedule to be determined on the basis of need by the Government. The contractor will make site visits to HST and/or STK to provide the technical support. A site visit is 24 man-hours onsite at HST and/or STK by one Contractor personnel. The cost for a site visit shall include all labor, travel expenses, and incidentals.

See Section 7, Exhibit 3 for the number of site visits. Provide a trip report to the COR and the system administrators via email within 2 business day of the completion of each site visit. The trip report will document all activities/tasks that were performed. Trip reports must be submitted prior to the submission of an invoice requesting payment for site visit(s).

Part 6: Applicable Publications –

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS). The publications listed below form a part of this contract.

U.S. ARMY CORPS OF ENGINEERS (USACE)

ER 25-1-113 USACE Critical Infrastructure Cybersecurity Mandatory Center of Expertise

U.S. DEPARTMENT OF DEFENSE (DOD)

DOD Directive 8100.02

Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)

DOD Directive 8140.01

Cyberspace Workforce Management

DOD 8500.01 Cybersecurity

DOD 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

DOD 8570.01-M Information Assurance Workforce Improvement Program

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 Security Requirements for Cryptographic Modules

NIST SP 800-37 Risk Management Framework for Information Systems and Organizations

NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security

U.S. ARMY (DA)

DA AR 25-2 Army Cybersecurity

DA PAM 25-2-6 Cybersecurity Training and Certification Program

DA PAM 25-2-9 Wireless Security Standards

DA PAM 25-2-13 Army Identity, Credential, and Access Management and Public Key Infrastructure Implementing Instruction

DA PAM 25-2-14 Risk…