Request for Proposal_SOW_Amendment 1_3.22.pdf

B. CONTRACT ADMINISTRATION INFORMATION

B.1 TYPE OF CONTRACT

This is a Hybrid: Firm-Fixed- Price and Time and Materials Blanket Purchase Agreement (BPA) for Comprehensive Worldwide Security Services

B.2 PLACE OF PERFORMANCE

The primary place of performance will be at USAGM 330 Independence Ave SW

Washington DC 20237

If the USAGM headquarters relocates to another location within the Washington, DC metro area within the period of performance of this BPA , the new location will become the primary site for the Contractor’s onsite physical security specialist.

Physical security services shall be performed at the following locations, on a reoccurring, temporary duty basis within the Continental U.S., U.S. Territories and Overseas locations. See Attachment A- Locations

B.3 PERIOD OF PERFORMANCE

a. The period of performance of this BPA consists of a one (1) five (5) year ordering period of performance.

The ordering period of performance for this BPA t is from April 2024 through April 2029.

Period Start Date End Date

Ordering Period April 2024 April 2029

B.4 CLIN DESCRIPTION

The following schedule lists the Contract Line Items (CLINs) that are applicable throughout the performance of this BPA.

See Attachment B -Pricing Schedule

B.5 PAYMENT

In consideration of the Contractor’s full and satisfactory delivery of services specified in each call order issued under this BPA, the U.S. Agency for Global Media will pay the Contractor, upon the receipt of proper undisputed invoices, the firm fixed price for firm fixed price CLINS and the appropriate amount for the time and materials CLINS in Attachment B, if the Contractor provides the services per this BPA’s terms. The Government will pay the Contractor for services that the Contractor provides per the BPA’s terms.

The BPA’s firm fixed price for its FFP CLINS that appear on Attachment B does not depend in any way on the costs the Contractor incurs or does not incur. It includes, for example, all costs and expenses, direct and indirect, as well as any profit, fee, including markups of any nature required or incurred by the Contractor in the performance of services per the terms of this BPA. The Government will only pay the contract’s firm-fixed-price and only if the Contractor provides the services per the contract’s terms. The contractor shall not provide services whose value exceed the amount of funds allotted to the contract, except at its own financial risk

[End of Section B]

SECTION C STATEMENT OF WORK

US Agency for Global Media Office of Security

Physical Security Division Comprehensive Physical Security Support Contract Statement of Work

March 5, 2024

C. BACKGROUND/SCOPE/OBJECTIVE/CONTRACT REQUIREMENTS

C.1 BACKGROUND

C.1.1 U.S. Agency for Global Media

The U.S. Agency for Global Media (USAGM) is the independent federal government agency that oversees all U.S. civilian international media. Its mission is to inform, engage and connect people around the world in support of freedom and democracy. It accomplishes this core mission through the journalistic efforts of its worldwide networks, consisting of five distinct entities, including:

Federal Networks

- Voice of America (VOA)

- Office of Cuba Broadcasting (OCB)

Non-profit Grantees

- Radio Free Europe/Radio Liberty (RFE/RL)

- Radio Free Asia (RFA)

- Middle East Broadcasting Networks, Inc. (MBN)

The USAGM Office of Security is responsible for providing a safe and secure environment for USAGM personnel, facilities, and information. Facilities are located within the U.S. and around the world.

Security standards, requirements, and procedures applicable to the USAGM include , but are not limited to, those established under the USAGM Broadcasting Administrative Manual (BAM), the USAGM Office of Security, U.S Public Federal Laws Executive orders, Federal Policies and directives set forth and administered by the following Federal Agencies:

Department of Commerce/National Institutes of Standards and Technology;

Department of Defense - Defense Counterintelligence Security Agency (DCSA);

Department of Homeland Security (DHS) -Federal Protective Service and the Interagency Security Committee (ISC);

Department of State (DOS) including via the Overseas Security Policy Board (OSPB).

Office of Management and Budget; and

Office of Personnel Management.

Physical and technical security standards (hereafter, “physical standards”) and procedures applicable to USAGM facilities located in the continental United States and its territories are established by DHS/Federal Protective Service (FPS) and detailed in the Interagency Security Committee (ISC) Risk Management Process (RMP) and RMP Countermeasures Handbook; Federal Information Security Management Act of 2002 (FISMA); Federal Information Processing Standards publication (FIPS) 201-2;

and OMB Memorandum M-11. M-11 requires that existing physical access control systems (PACS) and logical access control systems (LACS) be upgraded to use PIV credentials and support the Federal Identity, Credential, and Access Management (FICAM) implementation.

Physical standards applicable to overseas facilities are established by the OSPB and the DOS/Bureau of Diplomatic Security (DS) and detailed in the DOS Foreign Affairs Manual (FAM) and the Foreign Affairs Handbook (FAH). These include 12 FAH 5 (Physical Security Standards), 12 FAH 6 (OSPB Security Standards), and 12 FAH 11 (Technical Security Standards).

C.2 OBJECTIVE

The objective of this contract is to provide the USAGM Office of Security with dedicated physical security expertise and personnel necessary to identify, document, design, plan, install, and maintain the operational readiness of the security infrastructure deployed by the USAGM at its facilities. This includes services to: perform preventative maintenance, emergency repair, and emergency and life-cycle replacement of existing and new security equipment; obtain and maintain certification for the Authorization to Operate (ATO) for the USAGM automated access control system, migrate the associated database to a Cloud-based solution, and perform and document NIST-mandated vulnerability assessments of the system; perform supply chain management duties including identification of equipment, ordering, shipping/receiving, warehousing/shopkeeping, and inventory management and accounting of installed and stock security equipment and supplies; and, identify, document, design, plan, manage and execute security projects to install new security equipment, systems, and technologies complying with applicable federal security standards. It includes the provision of a dedicated Physical Security Specialist at the USAGM headquarters facility and the requirement to maintain availability of two additional Physical Security Specialists to perform security services as outlined in this Statement of Work (SOW) at the USAGM headquarters facility and other USAGM facilities located around the world on both a planned and unplanned basis.

C.3 SCOPE

The scope of this effort requires the Contractor to provide: regular security equipment and systems to perform operational testing and preventative maintenance; emergency repair and replacement; onsite security equipment and systems installations, expansions, and relocations; life-cycle security equipment and system replacements. It also requires the Contractor to survey, document, design, prepare, and submit detailed and actionable recommendations and physical security project plans and, when approved by the Government, implement them. The Contractor must also perform supply chain management activities including procurement, shipping/receiving, warehousing/shopkeeping, inventory management, and accounting of stock and installed security equipment and systems. The Contractor must also provide and maintain a full-time, onsite Physical Security Specialist within USAGM’s Office of Security headquarters office who will be responsible for installation, preventative maintenance, emergency repair, and life-cycle replacement of security equipment and systems in USAGM’s headquarters facility. The Contractor must also provide two additional Physical Security Specialists as needed to support the USAGM headquarters facility and to perform temporary duty travel to USAGM facilities to perform and document security equipment and system installations, preventative maintenance, emergency repair, and emergency and life-cycle replacements on an as-requested, planned, and unplanned, basis. The Contractor must also provide Physical Security Specialists that possess knowledge of the applicable security requirements, standards and systems that support USAGM facilities, including ISC RMP and the RMP Countermeasures Handbook, OSPB, DOS FAM and FAH, and DS-standard equipment, systems, and installations as well as the skills and expertise necessary to design, install, maintain, and replace applicable security equipment and systems. Contractor personnel must be proficient in the use of the Microsoft suite of Office tools.

The Contractor must also present and maintain security designs in AutoCAD.

USAGM has deployed security equipment and systems at its facilities located throughout the world.

Much of it is legacy security equipment and systems that must be replaced with security equipment, systems, and technologies that conform to current federal security standards and requirements. Equipment and systems include: active and passive anti-vehicle ram barriers; anti-personnel barriers, fencing, and gates; automated access control (Softwarehouse/CCure 9000), including PIV card reader activated locking hardware, including electromechanical, electromagnetic, and turnstiles; automated and manual key control; emergency and imminent danger notification; explosives detection; duress, fence protection, and intrusion detection alarms; GSA-approved security containers; DOS rated forced entry and forced entry/ballistic-resistant doors and windows; USG standard daytime and after-hours locking hardware including manual, mechanical, electromechanical, locally and remotely controllable such as cipher, deadbolt, drop bolt, and electromagnetic; metal detection including hand-held and walk-through metal detection; NSA-approved document shredders; security communications including hardwired audio/video devices; security lighting; security management systems; shatter-resistant window film; technical security protected distribution systems; technical security power; and video surveillance (VSS) including data recording, management and distribution.

In the United States and its territories, security equipment, systems and designs must meet BAM, Office of Security, and ISC RMP and RMP Countermeasures Handbook standards and specifications. Overseas facilities operating under the authority of a Chief of Mission (COM) with security responsibility must comply with security equipment, systems and designs that meet BAM, USAGM’s Office of Security, OSPB, DOS and DS security standards and specifications. Overseas facilities that do not operate under the authority of a COM with security responsibility must comply with BAM and USAGM Office of Security standards and requirements.

The Contractor must execute the objectives of this contract with minimal Government oversight and on a turnkey basis. To advance planned security projects to the execution phase, the Contractor must collaborate and coordinate with USAGM’s Office of Security. It is understood that successful execution of the project-level objectives of this contract may require support from other federal entities, such as for the installation of physical and electrical infrastructure, access to federal information technology and networks, subcontracting, processing of country clearance, etc.

The Contractor must produce and submit to the Contracting Officer Representative (COR) reports necessary to effectively manage and communicate the progress of work included within this SOW. These include annual, monthly, and weekly reports, trip reports, security designs and security project plans, and completed project reports.

The Contractor must possess and maintain knowledge and expertise in the application of ISC RMP and RMP Countermeasures Handbook, OSPB, and DOS/DS security standards, in particular 12 FAH 5 (Physical Security Standards), 12 FAH 6 (OSPB Security Standards and Policy) and 12 FAH 11 (DS Technical Security Systems Handbook), as well as technical knowledge and proficiency necessary to effectively design, plan install, maintain, and repair the security equipment, systems, and technologies previously identified.

C.4 TASKS

C.4.1 Project Management

The Contractor must perform project management support necessary to ensure that the terms, conditions, requirements, and expectations of this contract are met.

The Contractor must manage the execution of this contract to ensure that communications between the Contractor and COR are effective, expectations understood, contract requirements are met, and all deliverables are provided on schedule.

The Contractor must create and manage records to monitor, document, complete, distribute, and archive contract artifacts and deliverables including travel, reporting, projects, surveys, planned and executed actions, inventory, and other data using standard Microsoft Office, program management and other information processing tools. Management of all U.S. Government and other information associated with the execution and management of this contract must conform to established federal and USAGM information security standards and requirements.

The Contractor must document, propose and maintain up-to-date travel plans and associated requirements necessary for Contractor personnel to travel to USAGM facilities in the U.S. and overseas to provide security support services outlined in this SOW. Planning should include the expectation that trips will be made to USAGM facilities to perform annual security equipment and systems testing and preventative maintenance; as-needed to perform emergency repair and replacement; and life-cycle replacement of security equipment based upon published and best-practice estimates and as approved by the COR. Trips made for the purpose of performing security surveys to assess standards compliance and requirements, devising comprehensive security designs, and proposing actionable recommendations are expected to occur for each USAGM facility/site over the period of performance of this contract (base + four option years). Approved and executed projects based upon these surveys are expected to occur at USAGM sites over the period of performance of this contract (base + four option years).

C.4.2 Onsite Physical Security Specialist

The Contractor must provide and maintain a full-time, onsite Physical Security Specialist in the USAGM headquarters facility, within the Office of Security. This position will be responsible for the installation, preventative maintenance, emergency repair, and emergency life-cycle replacement of security equipment and systems in the USAGM headquarters facility.

C.4.3 Preventative Maintenance and Technical Support – All Security Systems

The Contractor will recommend, plan, document, and perform preventative maintenance to ensure full operability and functionality of security equipment, systems (including the automated access control system), and technologies installed at the USAGM headquarters and offsite USAGM facilities. The Contractor will include support for security equipment and systems, including hardware and software, application, and configuration management. The Contractor will include specific expendable supplies, such as for explosives detection, etc. and an extended warranty plan for service coverage and for software/firmware updates/upgrades. The Contractor must complete and submit to the COR reports for preventative maintenance within ten (10) business days of completion of this work, or completion of the trip made to perform this work at USAGM facilities other than the USAGM headquarter facility.

C.4.4 - Achieve and Maintain Authority to Operate (ATO) – Automated Access Control System

The Contractor must provide, install, and maintain all necessary automated access control software packages and compatible companion software; design, integrate, and maintain an ATO-compliant system package enabling the continued integration of the C-CURE system with the main USAGM domain, multi-factor authentication (MFA) frameworks, and provide updates to the system pursuant to FICAM, FISMA, FIPS 201 and USAGM-specific Plan of Action and Milestone (POA&M) requirements. This includes Windows OS, automated access control hardware and software, network and active directory protocols, and all system updates and patches needed to maintain ATO compliance and authorization.

C4.5 - Migration to Cloud Server – Automated Access Control System

The Contractor must advise, design, and when approved implement a cloud-based automated access control system server (or software equivalent) backup and database archiving architecture compliant with FISMA, FIPS, and NIST solutions. The Contractor submit its plan to COR and when approved migrate the current automated access control system(s) to a cloud-based architecture for system backup and data archiving that is compliant with FICAM, FISMA, FIPS, and NIST standards and requirements.

C4.6 - Automated Access Control System Vulnerability Assessments

The Contractor must provide monthly vulnerability assessment reports of the automated access control system in accordance with National Institute of Standards and Technology (NIST) RA-5.

C.4.7 - Life Cycle Replacement - All Security Systems

The Contractor must recommend, plan, conduct, document, and perform life-cycle replacement of security equipment, systems, and technologies. These include hardware and software, annual service licenses (such as Softwarehouse Service Level Agreements for C-CURE 9000 and/or other automated access control systems in use), patch management and version updates, Windows OS updates (client and server) hosting, server moves, network configurations and/or changes, webservices, system performance reviews, preplanning and predeployment checks, recommendations, upgrades, anti-virus and vulnerability software, implementation of additional software, merging or integration of active directory solutions, PIV card hardware software solutions, and secure communication with offsite network access control panels via data encrypters, PIV encoders, switches and/or routers and configuration and change management, applications, and configuration management necessary to maintain and sustain full operational readiness and functionality of deployed security equipment, system, and technologies.

The Contractor must complete and submit to the COR reports for life-cycle replacement of security equipment within ten (10) business days of completion of this work, or completion of the trip made to perform this work at USAGM facilities other than the USAGM headquarters facility.

C.4.8 - Emergency Repair and Replacement – All Security Systems

The Contractor must recommend, plan, document, and perform emergency repair and replacement activities of security equipment, systems, and technologies presently installed or to be installed at the USAGM headquarters facility and offsite USAGM facilities. Emergency responses must be acknowledged within one hour following notification by the COR via telephone call or email and provide a resolution within four hours or by a date agreed to by the COR. Normal business hours at the USAGM’s headquarters facility are from 8:00 am to 4:30 pm Monday through Friday Local time in each Time zone except federal holidays.

Emergency response must be established within one (1) hour of a telephone call or email from the COR, and resolved or scheduled to be resolved within four (4) hours of a telephone call or email or by a date agreed to by the COR. A technical response to an emergency repair and/or replacement requiring onsite technical support must be established within four (4) hours of notification by the COR and resolved within 24 hours by a date agreed to by the COR . It is understood that an onsite response to an emergency repair or replacement service at a USAGM off-site facility will require time to implement.

The Contractor must complete and submit to the COR reports for emergency repair and replacement within ten (10) business days of completion of this work, or completion of the trip made to perform this work at USAGM facilities other than the USAGM headquarters facility.

C4.9 - Supply Chain Management and Inventory Management

The Contractor must perform and document supply chain management activities regarding security equipment, systems, and technologies including ordering, shipping/receiving, warehousing/shopkeeping, and inventory management and accounting of stock and installed security equipment and supplies. The Government will stock and house in Government facilities minimum amounts of security equipment and supplies necessary to support currently deployed security equipment, systems, and technologies. The Contractor must perform supply chain management functions including ordering, receiving/shipping, warehousing/shopkeeping and inventory control and accounting for Contractor-planned and executed projects, and to support existing, deployed security equipment and systems in coordination with the COR.

Security equipment, systems and technologies procured, shipped, and installed by the Contractor will be considered to be Contractor Furnished Equipment (CFE) until accepted by the COR or its designee. Once accepted by the COR, the CFE will convert to Government Furnished Property (GFP) and be included in the Office of Security physical security equipment inventory database.

The Contractor must create and maintain an annual inventory of stock and installed security equipment at each USAGM facility. That annual inventory shall include a: description, model, serial number or other unique identifier, date of installation (if known), location installed within a facility, and the name of the facility where installed.

C.4.10 - Report and Data Generation, Control, Analysis and Management

The Contractor must produce and submit to the COR written reports including weekly activity reports for the onsite Physical Security Specialist, monthly activity reports by the Project Manager detailing work performed by the Contractor, and annual reports detailing, for the preceding year, security equipment and system testing, preventative maintenance and emergency repair and replacement services performed, and security projects planned, undertaken, and completed. The annual report must include a discussion of the Contractor’s planned actions for the upcoming contract year, including travel plans, dates and goals of each trip, and additional information of operational relevance as proposed by the Contractor to the COR or by the COR to the Contractor.

The Contractor will review and analyze USAGM and other sources of information including reporting and data concerning the security posture of USAGM facilities vis-à-vis applicable federal security standards to determine security infrastructure, equipment, system and technologies standards requirements, operational readiness, and to propose physical security solutions. Written results, including reports, will be submitted to the COR.

C.4.11 - Contractor Travel

The terms and conditions of the Federal Travel Regulations (FTR) apply to all travel and travel-related matters associated with this contract, including pre-authorization and reimbursement of substantiated invoices. All travel must be pre-approved by the COR. The Contractor will be expected to travel to USAGM facilities in the continental U.S., its territories and overseas when requested and to comply with all associated federal regulations and requirements. Travel to meet the requirements of this contract is expected to occur throughout the period of performance..

Reimbursement must be documented with itineraries and will be based upon airfare, vehicle rental, taxies, hotel accommodations, and Meals & Incidental Expenses (M&IE) expenses as well as passports, visas, and medical costs associated with travel to foreign countries.

C.4.12 - Security Projects – All Security Systems (Optional CLINs)

Turnkey security projects that are envisioned to be executed under this contract include physical security infrastructure, equipment, systems, and countermeasures at domestic and overseas facilities. Each USAGM facility is subject to applicable federal physical and technical security standards and requirements. Turnkey projects performed by the Contractor must include survey of the site; evaluation of the site’s vulnerabilities; application of the relevant federal security standards vis-a-vis security equipment, systems, and technologies to be applied; security system design; project planning; supply chain management including procurement and shipping, installation; and report generation. Security projects undertaken will be subject to management approval and availability of funds.

For smaller scale projects in the USAGM headquarters facility, such as installation or relocation of a security camera, the Contractor must survey, make recommendations, and provide a project plan within ten (10) business days of a request by the Government. Additionally, the Contractor must begin execution of the project within fifteen (15) business days of the notice to proceed by the COR.

For larger, comprehensive security engineering project surveys to assess security standards compliance of a site, make recommendations, devise security designs and develop security project plans, the Contractor must provide a trip report to the COR within 15 business days of completion of the trip; a 30% security design within 45 business days of completion of a trip; a 60% security design within 75 business days of completion of a trip; a 90% security design within 100 business days of completion of a trip; and a 100% security design and completed project plan within 120 business days of completion of a trip. The Contractor must be prepared and proceed with on-site installation activities within 180 business days following the notice to proceed by the COR. The Contractor must submit a final project report to the COR for approval within 90 business days of completion of an installation project, which must include the security design, security project plan, details of the installation, Bill of Materials, identification of design and installation team members, and marked-up architectural and floor plans showing the location of each piece of equipment installed, including the routing of conduit, power, and signal/control cables.

In the United States and its territories, all security equipment, systems, technologies, and designs will meet BAM, Office of Security, ISC RMP and RMP Countermeasures Handbook standards and specifications. Overseas, all security equipment, systems, technologies, and designs will meet BAM, Office of Security, OSPB and DS security standards and specifications for facilities operating under the authority of a COM with security responsibility. For overseas facilities that do not operate under the authority of a COM with security responsibility, all security equipment, systems, technology designs will meet BAM and Office of Security standards and specifications. Security equipment, system and technology installations will be operationally seamless and minimize delay or downtime of any security system component that is operational at the site. While new security equipment or systems are being installed, existing security equipment and systems must remain fully functional unless an acceptable workaround has been approved by the COR and the cognizant DS Regional Security Officer (RSO) as applicable. At the conclusion of a security equipment and system installation project and prior to demobilizing and departing the site, the Contractor will remove and dispose of the replaced security equipment and systems, including cabling, in accordance with applicable federal standards and requirements, unless otherwise approved by the COR.

The Contractor must identify, document, design, manage and execute security projects on a turnkey basis and with minimal Government oversight. It is understood that successful execution of the project-level security objectives of this contract may require support from USAGM entities to install electrical infrastructure, obtain access to USAGM information technology and networks, etc.

At the conclusion of a security installation project, the Contractor must deliver clear and concise operational manuals, and provide end-user training for any equipment or systems installed by the Contractor.

C.5 DELIVERABLES

Description

Timeline Dates

Program Management

Activity Reports

Annual report of security equipment and systems operability including recommended life-cycle equipment and system replacements; hardware, software, and licenses; results of security equipment and systems testing, preventative maintenance, and emergency repair and replacement services performed over the preceding year; security projects planned, undertaken and completed over the preceding year; and, other items of operational relevance as proposed by the Contractor or the COR.

Travel Planning Report: Continuously updated during each POP.

Onsite Physical Security Specialist

Weekly activity reports and log reports of security equipment and system operational status.

Security Equipment and Systems Operational Readiness Testing and Preventative Maintenance

The Contractor must provide written reports concerning performance of security equipment and systems operational testing and preventative

Due Monthly to the COR by COB of the last business day of the month.

Annual: due to the COR on the last business day of each POP

Due to the COR on the last business day of each month.

Weekly Activity Report due to the COR by the onsite Physical Security Specialist by COB on the last business day of each week.

Ongoing: Due to the COR within ten business days of completed maintenance.

FISMA Compliance of the USAGM Automated Access Control System and Authorization to Operate (ATO)

The Contractor must provide a complete timeline/Plan of Action and Milestones (POA&M) regarding FISMA compliance of the USAGM automated access control system in a detailed report to support the annual

ATO.

Migration to Cloud Server

The Contractor must advise, design, document and when approved implement a cloud-based automated access control system server backup and database archiving architecture compliant with FISMA, FIPS, and NIST solutions.

Automated Access Control System Vulnerability Assessment Reports

The Contractor must provide monthly vulnerability assessment reports of the automated access control system in accordance with National Institute of Standards and Technology (NIST) RA-5.

Security Equipment, Systems and Technology Life Cycle Replacement

The Contractor must provide written reports regarding the performance of life-cycle replacements made to legacy security equipment and systems specific to each USAGM facility.

activity, or of the trip made to complete the activity.

Semi-annual: due to the COR by last business day of October and April.

Design and report due to the COR by the last business day of the third month following award of the contract.

Monthly: Due to the COR by the last business day of each month.

days of completed activity, or of the trip

Security Equipment and Systems Emergency Repair and Replacement

The Contractor must provide an emergency repair and replacement response for security equipment and systems installed at the USAGM headquarters and other USAGM facilities. Emergency responses must be acknowledged within one hour of a telephone call or email from the COR and provide a resolution within four hours or by a reasonable date and timeframe agreed to by the COR. Response to an emergency repair requiring onsite technical support must be scheduled within four hours of notification by the COR and resolved by a date agreed to by the COR.

The Contractor must provide written reports regarding the performance of emergency repair and replacement.

Supply Chain Management and Inventory Management

Annual security equipment inventory report of stock and installed security equipment at USAGM facilities including item description; model no;

serial number or other unique identifier; location within the facility where it is installed; and identification of the facility at which it is located.

Report and Data Generation, Control, Analysis and Management

The Contractor must produce and submit to the COR written reports including monthly activity reports detailing work performed by the Contractor, and annual reports detailing, for the preceding year, security equipment and system operational testing, preventative maintenance and emergency repair and replacement services performed, and security projects planned, undertaken, and completed. The annual report must include a discussion of the Contractor’s planned actions for the upcoming contract year, including travel plans, dates and goals of each trip, and additional information of operational relevance as proposed by the Contractor to the COR or by the COR to the Contractor.

Contractor Travel

Contractor travel must be pre-approved by the COR and, will be reimbursed per FTR regulations. The Contractor will be expected to travel to USAGM facilities in the continental U.S., its territories, and overseas facilities. Reimbursement must be documented with itineraries

Ongoing: Response times due to the COR as indicated.

days of completed activity, or of the trip

Ongoing: Annual report due to the COR by the last business day of the contract year.

Ongoing: Reports are due to the COR as indicated.

Travel reimbursement requests are due to the COR within ten business days following completion of the trip.

C.6 CONTRACT REQUIREMENTS

The Contractor must provide the USGM, Office of Security with the security support and services detailed in this SOW. The Contractor must provide all necessary tools required to perform the work under this BPA.

and will be based upon airfare, vehicle rental, taxies, hotel accommodations, and Meals & Incidental Expenses (M&IE) expenses as well as passports, visas, and medical costs associated with travel to foreign countries.

Security Project Planning and Execution (Optional CLIN)

Security project reports must include a comprehensive physical security survey and recommended security equipment and systems necessary to comply with applicable federal security standards; a comprehensive security design for all security equipment and systems to be installed; a comprehensive project plan to address activities and actions including initiation, planning, execution, control & monitoring, and closing;

estimated project activity and time to complete displayed via Gant chart; a comprehensive, estimated cost breakout per labor category, materials, shipping, storage/warehousing, end user training and report generation.

For each security project survey made to assess the status of existing security infrastructure, comparison to required federal security standards, and development of security designs and recommendations, the Contractor will provide a trip report within 15 business days of completion of the trip; a 30% security design within 45 business days of completion of a trip; a 60% security design within 75 business days of completion of a trip; a 90% security design within 100 days of completion of a trip; and a 100% security design and completed project plan within 120 days of completion of a trip. The Contractor will be prepared to proceed with security equipment and system installations within 180 business days following the notice to proceed by the COR. Within 90 business days of acceptance by the Government of installation project completion, the Contractor will produce and submit to the COR a written final report, including the security design, security project plan, details of the installation, Bill of Materials, identification of design and installation team members, and architectural and floor plans, including mark-ups showing the location of each piece of equipment installed, including the routing of conduit, power, and signal/control cables,.

COR as indicated.

The Contractor must maintain in proper operating condition existing security equipment and systems as well as those that it furnishes, and repairing or replacing equipment and systems it provides and installs as CFE under warranty for a period of not less than one year from its installation by the Contractor and acceptance by the COR or its designee.

In the event the Contractor proposes changes in the method and/or time of delivery of services under this contract, the Contractor must notify the COR sixty (60) days in advance of the proposed change, provide the COR complete details of the proposed changes to allow for determining the full impact of the change, and afford the COR the opportunity to coordinate the impact of the proposed changes with stakeholders, if the proposed changes are acceptable to the Contracting Officer.

Should the Contractor fail to provide the COR with the required notification to allow for COR concurrence and coordination with stakeholders, and as a result the USAGM experiences disruption in security support and services, the USAGM shall be entitled to a credit of, at least, the portion of the project firm-fixed-price attributable to the disrupted service. The USGAM shall also be entitled to a credit of the portion of the firm-fixed-price attributable to the cost of alternate security measures implemented for the duration of the disruption.

C.6.1 Delivery

The Contractor must deliver the security support and services detailed in this SOW. Delivery must be at the specified times and locations, and must be as described in the Contractor’s schedule of services that will be incorporated into a forthcoming contract by reference. However, if anything in the call order’s terms and conditions conflicts with the terms and conditions in the Contractor’s schedule of services, the Contractor must bring the conflict to the Government’s attention and resolve the conflict by reaching agreement with the Government before proceeding.

C.6.2 Acceptance/Inspection

Testing criteria will be established by the Office of Security to ensure compliance with performance and outcome expectations as well as rules and regulations regarding the protection of information and personnel. Other USAGM and Other Government Agency offices may assist the Office of Security in the performance of inspection and acceptance testing.

The COR has the delegated authority to inspect and accept all services, reports, and deliverables.

Acceptance of services, reports, and other required deliverables at the USAGM headquarters facility shall take place at the Office of Security in Washington, D.C. Inspection and acceptance of deliverables at facilities other than the USAGM headquarters facility in Washington, DC will normally be performed by Office of Security Physical Security Specialists, VOA bureau chiefs, RMO office chiefs, TSI Station Managers and/or by designated Other Government Agency security personnel such as cognizant Department of State Regional Security Officers.

C.6.3 Security Requirements and Data Rights

Key personnel under this contract must be U.S. citizens and eligible to obtain and maintain a favorable background determination and national security eligibility at the non-critical sensitive level (Tier 3) throughout the period of performance. This will include undergoing personnel security vetting and continuous evaluation for the duration of their engagement on this contract.

Contractor, in good faith, shall exercise due diligence using generally accepted commercial business practices for information technology (IT) security, to ensure that Contractor systems are operated and maintained in a secure manner, and that management, operational, and technical controls are employed to ensure security of systems and data. Recognizing the changing nature of technology, Contractor will continuously work with USAGM to ensure that Contractor meet USAGM's requirements for the security of systems and data. Contractor agrees to discuss implementing additional security controls as deemed necessary by USAGM to conform to the Federal Information Security Management Act (FISMA), 44 U.S.C. 3541 et seq., and other applicable laws and regulations.

USAGM acknowledges that use of Contractor services may require management of Federal records. USAGM and Contractor generated content may meet the definition of Federal records as determined by USAGM. If the Company holds Federal records, the USAGM and the Contractor must manage Federal records in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), and regulations of the National Archives and Records Administration (NARA) at 36 CFR Chapter XII Subchapter B). Managing the records includes, but is not limited to, secure storage, retrievability, and proper disposition of all Federal records including transfer of permanently valuable records to NARA in a format and manner acceptable to NARA at the time of transfer.

USAGM shall have Unlimited Rights in all Data produced, furnished or acquired under this Contract. Unlimited Rights means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so. Data means recorded information, regardless of form or the media on which it may be recorded.

C.6.4 Call Order Level Pricing

Any discounts givenfrom any source flow down to the call orders. The prices for the call orders (firm-fixed-prices for the firm-fixed-price tasks, ceiling prices for the Time & Materials tasks, and the maximum costs for the travel task) will be negotiated by the Government and the Contractor before the work on the call order begins.

Firm Fixed Price

After the Government and the Contractor agree on the firm fixed price, upon performing the Contractor will provide in specific line-item billing for Project Management; Onsite Physical Security Specialist;

Preventative Maintenance; Authority to Operate; Migration to Cloud Server; Automated Access Control System Vulnerability Assessments; Life-Cycle Replacement; Emergency Repair and Replacement;

Supply Chaon Management; Report Generation; Contractor Travel; and Security Projects.

Time & Materials

After the Government establishes the ceiling price for the call order and the estimated hours, upon performing, the Contractor will provide in specific line-item billing fixed hourly rate professional services with variable hours necessary to complete tasks or changes using the agreed upon fixed rates. Actual Material costs incurred will be for effort as provided in the proposal and, for overseas facilities subject to

Chief of Mission authority with security responsibility, comply with approved DS-standards.

C.6.5 Government Furnished Property (GFP)

New security equipment, systems, and technologies, including hardware, software, applications, and licenses procured by the Contractor and associated with the installation, operation and management of the security equipment, systems and technologies described in and supported by this contract will be Contractor Furnished Equipment (CFE) until accepted by the COR or designate, and thereafter will become GFP.

USAGM will provide the workspace, telephones, computer workstations and other materials needed by the Contractor to provide security support services under this contract. The Office of Security will keep an accounting of GFP the USAGM provides to the Contractor.

C.6.6 Key Personnel and Contractor Qualifications

The Contractor will identify personnel who are key to the work to be performed under this contract, including any subcontractors. No substitutions of Key Personnel may be made by the Contractor without the written consent of the Contracting Officer (CO). Key Personnel shall include the Project Manager and Physical Security Specialists.

Required Knowledge, Skills, and Abilities of Project Manager:

Must have relevant project management certification (PMP or equivalent industry certification).

3-5 years project management experience supporting Federal contracts.

Required Knowledge, Skills, and Abilities of Physical Security Specialists:

Must demonstrate extensive knowledge of standard federal security equipment, systems, and technologies. Must demonstrate experience in the application, installation, maintenance, repair and replacement of DS-standard technical and physical security equipment, systems and technologies mandated by the Department of State in overseas facilities operating under the authority of a Chief of Mission with security responsibility, and ISC RMP Countermeasures Handbook requirements for federal facilities located in the continental U.S. and territories.

Must demonstrate experience deploying security equipment, systems, technologies, and personnel overseas on temporary duty to support DS-standard installation, maintenance, repair and replacement projects and activities.

Must have experience performing and documenting physical and technical security assessment surveys identifying and addressing security standards compliance; proposing actionable and achievable recommendations and solutions; and producing comprehensive and detailed security designs and project plans; and executing security projects at federal facilities in the U.S. and its territories as well as overseas.

Must be capable of effectively articulating thoughts, ideas, and recommendations through all forms of communications.

D. CONTRACT MANAGEMENT

The administration of the services performed pursuant to this BPA will require maximum coordination between the Government and the Contractor during the BPA’s period of performance.

D.1 CONTRACTING OFFICER'S AUTHORITY

The Contracting Officer (CO) will administer this BPA. The CO is the only person with the authority to act as an agent of the U.S. Government and is the only person authorized to make or approve any changes in any of this BPA’s requirements.. Notwithstanding any provisions contained elsewhere in this BPA,, the said authority remains solely in the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. Only the CO has the authority to: (1) direct or negotiate any changes to the SOW; (2) modify or extend the period of performance; (3) change the delivery schedule, (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

D.2 CONTRACTING OFFICER'S REPRESENTATIVE (COR)

XXXXXXXX is hereby designated as the Contracting Officer's Representative (COR). The Government may change the COR at any time without prior notice to the Contractor by a unilateral modification to the contract.

The responsibilities and limitations of the COR are as follows:

(1) The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports, and such other responsibilities as may be specified in the contract.

(2) The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes, which affect the Contract price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COR. No such changes shall be made without the expressed prior authorization of the Contracting Officer.

The COR may designate assistant COR(s) to act for the COR by naming such assistant(s) in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

D.3 PROCEDURES FOR INVOICING

(a) The Contractor shall submit invoices in accordance with the payment schedule in Attachment B- pricing schedule.

(b) The Contractor's invoice shall list: (1) name and address of Contractor, (2) invoice date and invoice number, (3) USAGM contract number (e.g., 951700-C-17-0000) and (4) the deliverable according to the payment schedule set forth in pricing schedule(Attachment B).

(c) Pursuant to the Prompt Payment Act, the USAGM will pay the invoice within 30 days of either: (1) receipt of the invoice or (2) acceptance of deliverables; whichever is later.

The USAGM invoicing procedures are listed below under 1952.232-91. Any costs associated with complying with these procedures will be at the Contractor's own expense.

Provision or Clause Effective Date

52.202-1 Definitions. Jun-20 52.203-3 Gratuities. Apr 84

52.203-5 Covenant Against Contingent Fees. May-14 52.203-7 Anti-Kickback Procedures. Jun-20 52.203-10 Price or Fee Adjustment for Illegal or Improper Activity

May 14 52.203-15 Whistleblower Protections Under the American Recovery and Reinvestment Act of 2009

June-10 52.203-16 Preventing Personal Conflicts of Interest

June 20 52.203-17 Contractor Employee Whistleblower Rights. Nov-23 52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements. Jan 17 52.204-2 Security Requirements. Mar 21 52.204-6 Unique Entity Identifier. Oct 16 52.204-7 System for Award Management. Oct 18 52.204-9 Personal Identity Verification of Contractor Personnel. Jan 11 52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards Jun 20 52.204-19 Incorporation by Reference of Representations and Certifications.