B08 Solicitation.pdf

SEE ADDENDUM

(No Collect Calls)

W25G1V20Q0187 08-Sep-2020

b. TELEPHONE NUMBER

570-615-7579

8. OFFER DUE DATE/LOCAL TIME

04:00 PM 21 Sep 2020

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W25G1V9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

RAYMOND J. MOLITORIS

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

W25G1V0136014H

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

ACC-APG, TOBYHANNA DIVISION

11 HAP ARNOLD BLVD

TOBYHANNA PA 18466-5100

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W25G1V 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

SEE BELOW FOR SEPARATE SHIPPING INSTRUCT

XXX

XXX PA 00000

TEL: FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

NAICS:

333517

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section SF 1449 - CONTINUATION SHEET

BASIS OF AWARD

AWARD WILL BE BASED ON LOW PRICE TECHNICALY ACCEPTABLE

SEE STATEMENT OF WORK FOR COMPLETE LIST OF SPECIFICATIONS

An organized site visit has been scheduled for, 9:00AM, on September 14, 2020 and proceeding on foot to Bldg 1C Bay 2 for the site visit. All intererested contractors are strongly advised to attend the site visit for the purpose of viewing the site and conditions. (See FAR clause 52.237-1)

PARTICIPANTS WILL MEET AT--

ALL VISITORS ARE REQUIRED TO SIGN IN AT THE VISITOR CONTROL

CENTER PRIOR TO THE SITE VISIT. AFTER OBTAINING A VISITOR'S PASS,

VISITORS WILL THEN PROCEED TO BUILDING 20, SECURITY , ON THE DATE

AND TIME SPECIFIED ABOVE. PLEASE ARRIVE EARLY ENOUGH TO ALLOW

FOR SECURITY PROCESSING. THE SITE VISIT TOUR WILL PROMPTLY

COMMENCE AT 9:00 AM FROM BUILDING 20.

Be advised Tobyhanna Army Depot has a mandatory mask requirement in place. All individuals must wear masks and temperatures will be checked at the Visitor Center or Main Gate.

All interested parties shall fill in provisions 52.204-24 and 52.204-26 along with their submission.

Proposal submisson Offeror’s technical proposal should clearly reflect how the offeror proposes to comply with the statement of work, specification requirements and technical implementation plan with training.

Offeror’s technical proposal including any supporting documentation shall be clear and concise. Technical proposals should not just be a parroting of the requirement. Contractor shall address all SOW requirements with a narrative on how the contractor intends to fulfill the contract SOW requirements and clearly demonstrate how the proposed equipment meets the minimum specifications. Contractors shall use descriptive and explanatory elements in addressing all elements. A single statement of Contractor compliance will not be accepted in lieu of an explanatory description and may disqualify the Contractor from contract award consideration. Proposals that do not address all elements in the noted Sections individually may not be reviewed and may not be given contract award consideration.

Offeror’s technical proposal shall address the following:

Capability of Meeting Equipment Specification Requirements:

Offeror shall provide detailed information of proposed vertical machine. Specifically address make, model of proposed vertical machines and the capability of the proposed vertical machines meeting the required specifications point by point as specified in the Statement of Work (SOW). Include equipment data sheets describing specifications of the proposed CNC VMCs.

Capability of Meeting and Providing a Turnkey Solution to Include Design, Assembly, Site Preparation, and Installation:

Offeror shall specifically address capability and method of providing turnkey solution to include supply, delivery, assembly, installation training and site preparation.

Offeror shall specifically address method to supply all labor, materials, supervision, tools and equipment to deliver, off-load, locate and place into position, and anchor all component pieces, materials and supplies necessary for the turn-key assembly and installation of the vertical machine.

Capability of the proposed equipment meeting the connections to the TYAD Systems and Utilities in accordance with the SOW requirements.

Contractor shall address the capability of the proposed equipment connecting to the TYAD on Systems and Utilities as required in the SOW. The submitted proposals shall indicate power requirement including the full load amperes the machines require for operation.

Capability of Meeting SOW Delivery Requirements:

Offeror shall provide a timeline of site preparation, delivery, installation, testing and training.

Discuss method to supply all labor, materials, supervision, tools and equipment to deliver, offload, locate and place into position, and anchor all component pieces, materials and supplies necessary for the turn-key assembly and installation of the vertical machine. Provide a timeline of site preparation, delivery, installation, testing and training.

Capability of Providing Training Requirements:

Offeror shall address the capability to be provide training for the vertical machines maintenance and operator training per Statement of Work.

Capability of Meeting SOW Warranty Requirements:

Offeror shall specifically address methods and capabilities of meeting the warranty requirements specified in the SOW. Include typical turnaround time for a breakdown. Include information on suppling repair and replacement parts.

Capability of Providing Required Manuals and Documentation Required in the SOW: Offeror shall address capability of meeting the manual requirements and documentation to be submitted as specified in the SOW.

EMAIL PROPOSAL ALONG WITH SPECIFICATIONS TO raymond.j.molitoris.civ@mail.mil.

PEASE REFERENCE THE SOLICITATION NUMBER “W25G1V20Q0187” IN EMAIL.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each

CNC VERTICAL MACHINING CENTER

FFP

CNC VERTICAL MACHINING CENTER

SUPPLY AND INSTALL PER SOW

Inclusive of rigging, tech support, training and tear down as stated in 1.1 and 4.2.

FOB: Destination

NSN: AA1565:49696

MILSTRIP: W25G1V0136014H

PURCHASE REQUEST NUMBER: W25G1V0136014H

PSC CD: 3417

NET AMT

mailto:raymond.j.molitoris.civ@mail.mil

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0002 1 Each

OPTION OPTION

FFP

Vacuum Table plus accessories in accordance with SOW at page 36.

FOB: Destination

MILSTRIP: W25G1V0136014H

PURCHASE REQUEST NUMBER: W25G1V0136014H

PSC CD: 3417

NET AMT

STATEMENT OF WORK

`Statement of Work for Computer Numerical Controlled (CNC) Vertical Machining Center (VMC) for Tobyhanna Army Depot

1.0 General Scope

1.1 This Statement of Work (SOW) is for the turn-key design, supply, delivery, off-loading, transporting, locating, installation, cleaning, assembly, set-up and training for 1 ea. (each) Computer Numerical Controlled (CNC) Vertical Machining Center (VMC) at Tobyhanna Army Depot (TYAD) in Tobyhanna, PA 18466. The Contractor shall supply all materials, supplies, freight, delivery, tools, equipment, consumables, labor, and supervision for the turn-key design, supply, delivery, off-loading, transporting, locating, installation, cleaning, assembly, set-up and training for the machine. The Contractor shall also disconnect an existing VMC HAAS VF-7 and transport it to another Building on site. The Contractor will also be responsible for disconnecting all equipment associated with the central coolant filtration system on the existing VMC and reconnecting it to the new VMC and assure it is operating as specified. The Contractor shall supply only new machines and new associated equipment.

Used and refurbished machines and used and refurbished equipment are unacceptable and will not be considered. All repair and replacement parts for the machine and associated equipment shall be new. All repair and replacement parts shall be available for purchase and supplied from within the continental United States.

1.2 The Contractor shall provide machine operation and machine maintenance training for Government personnel. Training shall be conducted by the Contractor’s qualified training representative and shall be conducted on-site at the machine location in Bldg. 1C Bay 2 at TYAD. This training shall focus on basic operations, programming, preventive maintenance, general maintenance, cleaning and housekeeping, and features familiarization. Instruction shall also include the maintenance that needs to be done by machine operators on a daily basis. All materials used during training shall become the property of TYAD.

1.3 The Bldg. 1C Bay 4 cargo door is the closest and most easily accessible door to the project installation worksite in Bldg. 1C Bay 2. The Contractor shall verify cargo door access dimensions. The Contractor shall be responsible to ensure that all material fits through this opening. All material handling equipment that is used by the Contractor, likewise, shall fit through this clearance while moving and handling all material that is being delivered.

1.4 Power available for the machine is 480V/3 Phase/60 Hz. For machines that are not designed and constructed to use 480V/3 Phase/60 Hz the Contractor shall supply, install and connect the necessary transformers that permit the use of 480V/3 Phase/60 Hz by the machine.

1.5 It shall be the responsibility of the Contractor to verify all machine and worksite dimensions and ensure the machine and ancillary pieces fit within the available floor space at the project installation worksite in Bldg. 1C Bay 2. The Contractor shall be responsible to verify overhead clearance dimensions for the machine and ancillary pieces at the project installation worksite in Bldg. 1C Bay 2.

1.6 TYAD currently uses CNC Software’s Master CAM Computer-Aided Manufacturing (CAM) software for the programming of all on-site VMCs. The Contractor shall ensure the Contractor-proposed and the Contractor-installed VMC shall be CNC programmable using Master CAM Computer- Aided Manufacturing (CAM) software. It shall be the responsibility of the Contractor to develop and supply the appropriate post-processor to achieve the necessary CNC programming compatibility. The Contractor’s post-processor shall be given to Automation Support Branch personnel by the Contractor in accordance with sections 3.3.4, 3.4, and 3.6 for loading onto the Government network.

1.7 A site visit will be scheduled and it is advised that interested Contractors attend. The site visit is for the purpose of interested Contractors to consider the layout and floor space of the project area and to enable the viewing of the delivery, utility and installation sites. The site visit shall be used by the Contractors to identify structures or conditions that may impede, obstruct or prevent completion of the work. It shall be the responsibility of the Contractor to identify obstructions and impediments to the project and to make appropriate accommodations for correction and modification to mitigate the problem. If a corrective measure conflicts with other requirements listed in the SOW or is outside the work area the Contractor shall identify these issues in the proposal submittal to the Government. Answers not contained in the SOW to all questions that are raised during the site visit shall be submitted in writing. Should the Contractor fail to identify an obstruction and hindrance to the project that is identifiable from a site visit the Contractor shall provide a solution to the problem that is to the satisfaction of the Government and at no additional cost to the Government. It shall be the responsibility of the Contractor for all dimensioning of the system including all auxiliary pieces and materials. It shall be the responsibility of the Contractor to supply his personal protective equipment (PPE) for the site visit. At a minimum, the PPE needed is protective eyewear and protective footwear. A Contractor in non-compliance with the PPE requirement will not be permitted on the site visit.

Be advised Tobyhanna Army Depot has a mandatory mask requirement in place. All individuals must wear masks and temperatures will be checked at the Visitor Center or Main Gate. Anyone without a mask will not be allowed entrance. Visitors may be denied access based on temperature and COIVD-19 related questions. Site Visit Bldg 1C Bay 2.

1.8 Following installation completion and prior to Final Acceptance the Contractor shall supply to the Point of Contact (POC) a computer-aided design and drafting (CADD) as-built drawing of the installed machine in Bldg. 1C Bay 2. The drawing shall be furnished in PDF and .dwg to the CPOC and shall be provided in hardcopy, ANSI D paper sized 22”x34”, in triplicate.

1.9 The Contractor shall agree that the system being purchased is considered an Information Technology (IT) asset to be operated at a Government facility and as such must adhere to all local and Government regulations outlined in this document under section 3.0 Cyber Requirements.

1.10 TYAD currently uses TYAD Distributed Numerical Control (DNC) software for machine code programming file transfer of all on-site VMCs. The Contractor shall ensure the Contractor-proposed and the Contractor-installed VMC shall be compatible with TYAD DNC. It shall be the responsibility of the Contractor to develop and supply any necessary hardware and/or software to support this.

1.11 The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

2.0 Minimum Specifications, Characteristics and Features for the Machine

1. X-axis travel shall be 59 inches, minimum.

2. Y-axis travel shall be 25 inches, minimum.

3. Z-axis travel shall be 23 inches, minimum.

4. Spindle nose-to-table maximum distance shall be between 25 inches and 30 inches.

5. Spindle nose-to-table distance shall be 4 inches, minimum.

6. Table length shall be 65 inches, minimum.

7. Table width shall be 25 inches, minimum.

8. Table shall be furnished with 5 ea. (each) T-Slots, minimum, evenly spaced across the table.

9. Table shall have a weight capacity of 3,300 pounds, minimum.

10. Spindle taper shall be CAT40.

11. The spindle shall be designed to permit a continuous spindle speed range from 0 to

12,000 rpm, minimum.

12. The spindle shall be 20 horsepower, minimum.

13. The spindle shall be direct drive.

14. The spindle shall have a bearing lubrication system.

15. The automatic tool changer (ATC) shall be CT40 with 30+1capacity, minimum.

16. The tool changer shall be capable of holding individual tooling of up to 12 pounds ea., minimum.

17. The machine shall be equipped with an 8 inch, minimum, color LCD monitor.

18. The machine shall be equipped with a flood coolant delivery system and coolant sump with a capacity of 55 gallons, minimum. The Contractor shall furnish and shall install all filters and pumps for the flood coolant delivery system.

19. The machine shall be equipped with a through-spindle coolant delivery system that provides up to 1,000 psi, minimum, coolant to the cutting tool. The Contractor shall furnish and shall install all filters and pumps for the through-spindle coolant delivery system.

20. The machine shall be equipped with a 2 Mbyte, minimum, on-board solid state memory that permits the storing, running and editing of large programs.

21. The machine shall be equipped with an integrated control cabinet air conditioning system.

22. The machine shall be equipped with door and window interlocks. The machine spindle shall automatically cease operation while the machine doors and windows remain in an open position. The spindle shall resume operation only upon closing of all doors and windows.

23. The machine shall be equipped with an integrated coolant mist collection system that clears the coolant mist generated during the machining process from the enclosed machining area.

24. The coolant mist collection system shall be activated and powered by the machine.

25. The machine shall be equipped with high-intensity lighting that can be adjusted by the machine operator to illuminate the entire machining area.

26. The high-intensity lights shall be integrated to turn ON when the machine doors open and turn OFF when the machine doors close.

27. The high-intensity lights shall permit manual turning ON and turning OFF by the machine operator.

28. The machine shall provide a system capable of granular access permissions. Granular access permissions are used to grant system privileges, allowing you to construct site-specific roles with privileges to match your requirements. Required system privileges capable of this should include but are not limited to: running machine code programs, editing machine code programs, editing machine parameters, and administrative machine functions. The system must accommodate the following roles at a minimum: Operator, Setup Technician, and Administrator.

29. The machine shall be equipped with an air blast system to permit the removal of chips during dry machining operations.

30. The machine shall be equipped with an automatic chip auger system for removal of chips from the machining area.

31. The machine shall be designed to permit rigid tapping.

32. The machine shall come equipped with probes that can measure material location relative to the table and that can make determination of tool length.

33. Machine shall come equipped with an Oil Skimmer System.

34. The primary method of sending and receiving files shall be over serial RS-232 communication. Other methods can exist but cannot be used in place of RS-232.

35. The machine shall at minimum be proven to receive files from Tobyhanna’s DNC system. The system sends files over serial RS-232 from a Tobyhanna provided workstation using a method commonly known as drip-feeding.

36. To be priced as an option: Machine shall be supplied with a Multi-Station, Rectangular

Vacuum Table fitted for the maximum machine table dimensions. The vacuum table shall come equipped with all the necessary accessories (i.e. Hold Down Bolt Holes, Gasket Material, Vacuum Hose, Vacuum Hose Barb, Pump Oil, etc.) for complete installation and operation. The Vacuum Table shall include a Vacuum Safety System, Heavy Duty Automatic Coolant Return System, and Heavy Duty Stationary Vacuum System. Vacuum Table with all accessories shall be completely installed by the contractor.

3.0 Cyber Requirements

3.1 Applicable Publications

The Vendor, and all sub-contractors, must abide by all applicable regulations, publications, manuals, and local policies and procedures. This includes, but is not limited to; AR 25-1 as well as STIGs and SRGs as published on https://public.cyber.mil.

3.2 Acronyms

AO Approving Official AR Army Regulation APMS Army Portfolio Management System ARCYBER United States Army Cyber Command ASB Automation Support Branch ATO Authority to Operate CCB Configuration Control Board CD Compact Disc CMVP Cryptographic Module Validation Program COOP Continuity of Operations COTR Contracting Officer’s Technical Representative CPLD Complex Programmable Logic Device CSR Certificate Signing Request DISA Defense Information Systems Agency DOD United States Depart of Defense ELTY Electronic Tobyhanna Army Depot Form eMASS Enterprise Mission Assurance Support Service EULA End User License Agreement FIPS Federal Information Processing Standard FPGA Field Programmable Gate Array GIG Government Information Grid HBSS Host Based Security System IAVA Information Assurance Vulnerability Alert IAVB Information Assurance Vulnerability Bulletin ICAN Internal Campus Area Network IMD Information Management Division IRB Industrial Review Board IS Information System IT Information Technology NETCOM United States Army Network Enterprise Technology Command NIST National Institute of Standards and Technology OEM Original Equipment Manufacturer PKI Public Key Infrastructure PLC Programmable Logic Controller RMF Risk Management Framework SD Secure Digital

SME Subject Matter Expert https://public.cyber.mil/

SOW Statement of Work SRG Security Requirements Guide STIG Security Technical Implementation Guide TRC Technical Review Cell USB Universal Serial Bus USCYBERCOM United States Cyber Command

3.3 Definitions

This section contains explanations of terms used in this document. They are taken from, and not to supersede, those definitions given in Army Regulation (AR) 25-1. All terms used in this document are in accordance with AR 25-1. This section shall be considered the authoritative source for definitions of terms not contained within AR 25-1 and/or its supporting documents.

3.3.1 Automation Support Branch

The Automation Support Branch (ASB), under the Mission Support Division, under the Directorate of Production Engineering, is the single point of contact for all mission-related IT equipment at TYAD. The ASB develops, protects, and maintains specialty IT equipment, both networked and standalone, in support of unique workloads across TYAD.

3.3.2 Configuration Control Board

The Configuration Control Board (CCB) is the local approving authority, composed of Supervisory personnel, for all actions regarding IT equipment at TYAD. Receiving an ATO for an IT equipment, from NETCOM, does not automatically guarantee that the system can be utilized at TYAD. The IT equipment must also obtain approval from the TYAD CCB, before it may be used with Army ISs at TYAD. The CCB is the local entity responsible for approving the STIGs and SRGs deemed applicable by the TRC, before the ATO accreditation package is submitted to NETCOM for approval.

3.3.3 Government

Any federal civilian, or military personnel employed by the United States Department of Defense (DOD), United States Army (Army), and/or Tobyhanna Army Depot (TYAD).

3.3.4 Industrial Review Board

The Industrial Review Board (IRB) is the local governing body that oversees all industrial mission assets to ensure compliance with TYAD production requirements. Composed of SMEs from the Directorates of Production Engineering (D/PE) and Systems Integration and Support (D/SIS), the IRB collects requirements, reviews contracting documents, plans industrial capabilities, and oversees contract implementation in alignment with current and future production needs. The three voting members of the IRB are the Division Chiefs for the Mission Support Division, Design, Development and Fabrication Division, and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) Finishing Division.

3.3.5 Information Management Division

Part of the Directorate of Installation Services, the Information Management Division (IMD) is responsible for the development, protection, and maintenance of the TYAD SBU LAN. The IMD operates all critical infrastructure upon which TYAD’s IT equipment operate.

3.3.6 Information System

Information System (IS) is defined as the organized collection, processing, transmission, and dissemination of information in accordance with defined procedures, whether automated or manual. For the purposes of Army Portfolio Management System (APMS), the terms "application" and "information system" are both IT investments describing a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (see JP 1–02).The application of IT to solve a business or operational (tactical) problem creates an information system.

3.3.7 Information Technology

Information technology (IT) is any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used directly or is used by a contractor under a contract with the executive agency, which 1) requires the use of such equipment; or 2) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term "information technology" also includes computers, ancillary equipment, software, firmware, and similar procedures, services (including support services), and related resources. The term "information technology" does not include any equipment that is acquired by a Federal contractor incidental to a Federal contract. (Reference 40 USC Subtitle III (Clinger-Cohen Act of 1996).)

3.3.8 Technical Review Cell

Composed of technical experts from both the ASB, and IMD, the Technical Review Cell (TRC) conducts the preliminary review of all actions, related to IT equipment at TYAD, prior to either ATO submission, or CCB approval. The TRC is responsible for determining which security technical implementation guides (STIGs), and security requirements guides (SRGs) are applicable to a given system, based on the direction given by NETCOM, and higher headquarters.

3.3.9 Tobyhanna Army Depot

Tobyhanna Army Depot (TYAD) is responsible for the development, and protection of the TYAD Internal Campus Area Network (TYAD-ICAN). To obtain an ATO, all IT equipment Vendors will provide the resources necessary to obtain an ATO to TYAD, so that the TYAD entities, named in this sub-section, can assemble, and submit, the information to NETCOM for consideration. In addition to approval from NETCOM, local approvals must be obtained, from the entities named in this sub-section, for an IT equipment to operate both on the TYAD-ICAN, and standalone.

3.3.10 United States Army Network Enterprise Technology Command

The 9th Army Signal Command, otherwise known as United States Army Network Enterprise Technology Command (NETCOM), is responsible for all Army network development, and protection. In accordance with AR 25-1, all ISs must obtain an Authority to Operate (ATO) from NETCOM, before being permitted to communicate with any Army system. It is the responsibility of the Vendor, of any IT equipment, to provide all requested documentation, software, hardware, and licenses to the Tobyhanna Army Depot (TYAD) for ATO submission.

3.3.11 Vendor

Any non-Government personnel, whether the original equipment manufacturer (OEM), reseller, or third-party personnel involved in the procurement, installation, and/or maintenance of the IT equipment.

3.4 Hardware Requirements

Without exception, all IT equipment shall comply with any, and all, applicable security technical implementation guides (STIGs) and security requirement guides (SRGs) as published by the Defense Information Systems Agency (DISA). This includes STIGs and SRGs regarding physical security. In addition, all IT equipment will comply with relevant Department of Defense (DOD) guidance, and mandates regarding hardware lifecycle upgrades. Without exception, all hardware must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.4.1 Communication Interfaces

All IT equipment must utilize at least RS-232 serial, or Universal Serial Bus (USB) communication methods. USB connections are to function as a peripheral device only, such as a printer. USB Mass Storage Devices are strictly prohibited. Additional communication interfaces, such as Ethernet, or RS-485, are acceptable, but cannot be in lieu of an RS-232, or USB interface. Full system functionality must be provided via all communication methods present in the IT equipment. All communication interfaces must be enabled, and available for use by the Government, upon delivery of the IT equipment to the Government. This is to ensure continuity of operations (COOP) should a communication interface become either inoperable, or prohibited for security, or technical reasons.

3.4.2 Cryptographic Devices

Any, and all, hardware implementing cryptographic functionality must utilize a Federal Information Processing Standard (FIPS) 140-2 Level 1, or better, compliant device, certified by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).

3.4.3 Workstations and Servers

Only standardized, Government owned, managed, and maintained computing hardware shall be utilized.

3.4.4 Removable Storage Media

The use of removable storage media, including, but not limited to, Universal Serial Bus (USB) flash drives, CompactFlash cards, and Secure Digital (SD) cards is prohibited, except by authorized Government personnel. Neither the Vendor, nor their sub-contractors, shall utilize such devices, and will provide data via optical media, such as a compact disc (CD) or the DOD SAFE available at https://safe.apps.mil/.

3.4.5 Memory Contents

In the event of main, and backup power failure, it is preferred that the IT equipment shall not utilize volatile memory to store information including, but not limited to, parameters, configurations, or passwords. Upon restoration of power, the IT equipment must return to a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. The Vendor must state which form of memory (volatile or non-volatile) they will be using for which system functionalities. Further demonstration of memory is required in section 3.8.2.

3.4.6 Smart Card Readers

DOD personnel utilize a smartcard, called a Common Access Card (CAC) to access IT equipment. All user identification, and authentication, is to be accomplished with a FIPS 201 compliant smartcard reader.

3.4.7 Testing Hardware

The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

3.4.8 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.5 Software Requirements

Without exception, all IT equipment shall comply with any, and all, applicable STIGs, and SRGs developed by DISA, as well as relevant Army guidance, and mandates. Any, and all software, https://safe.apps.mil/ firmware, or operating systems intended to be used on, with, or in support of any IT equipment is required to have a current, and valid, ATO, approval from the TYAD CCB, a unique name to identify the product, and employ a version numbering system to enable tracking of outdated software. All data delivered to TYAD will be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data. Without exception, all software, firmware, and data must come from sources approved by the DOD, and abide by all current restrictions. Without exception, all software, firmware, data, and/or operating systems must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.5.1 Operating Systems

All IT equipment shall utilize only operating systems, approved by the Army, and configured according to applicable STIGs, SRGs, Army, and local TYAD guidance, and mandates. All operating system installations must be protected by the DOD’s Host Based Security System (HBSS) software suite.

3.5.2 Install Location

Unless authorized by the TYAD CCB, all software, firmware, and data provided the Vendor, and all sub-contractors, must be installed within, and provide full system functionality while running from, standard locations appropriate for the particular operating system on which it is installed (e.g., Program Files, Program Files (x86), etc.)

3.5.3 Account Credentials

The IT equipment must integrate with TYAD’s Active Directory infrastructure in order to utilize the existing public key infrastructure (PKI), operated by the Army, for user, service, and machine accounts. In addition, the Government must have the ability to change and/or disable, any, and all, built-in administrative, user, and service accounts in the system, including those in embedded sub-systems (e.g., microcontrollers, FPGAs, PLCs, CPLDs, etc.).

3.5.4 Cryptographic Functionality

All cryptographic functions must be FIPS 140-2 Level 1 compliant, or better, and utilize an implementation certified by the NIST CMVP.

3.5.5 Encryption Certificates

For cryptographic functionality, requiring use of a certificate, the system must be able to generate a certificate signing request (CSR) for submission to a DOD Certificate Authority. The CSR must be in a FIPS 140-2 Public Key Cryptography Standards (PKCS) #10 format of at least 2048 bits.

3.5.6 Connections to Outside Systems

All data shall remain within the bounds of the DOD Global Information Grid (GIG).

Connections to outside entities for purposes including, but not limited to, performance metric reporting, or remote support are prohibited.

3.5.7 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.6 Support Requirements

All IT equipment are required to have a valid support contract for at least the software, and firmware. While a support contract is in effect, the following requirements, and all those listed in applicable STIGs, and SRGs from DISA, as well as relevant DOD guidance, and mandates shall apply in order for the system to maintain the ATO. The information contained within the Acceptance section 3.8 of this document shall also apply for the duration of the support contract.

In addition an upgrade path for the system for its planned life cycle must be outlined by the vendor. The upgrade path must be able to address all potential issues discussed under heading

3.6 and its subheadings.

3.6.1 Response Time

The Government will receive a response from either the Vendor, or one of their sub-contractors, no later than 24 hours after the Government initiated a service request with either the Vendor, or one of their sub-contractors.

3.6.2 Replacement Hardware

Any, and all, replacement hardware shall be new, or functionally, and aesthetically, equivalent to new, in performance, and appearance.

3.6.3 Software Updates

Software support will include software updates and enhancements on covered software products.

Covered software products is defined as any software, or firmware provided, by the Vendor and/or any subcontractors, to the Government.

3.6.4 Operating System Compatibility

The IT equipment must remain compatible with future updated operating systems in accordance with DOD migration schedules during the entirety of the system’s planned lifecycle. Delivery, to the Government, of all materials required to perform upgrades for compatibility must be completed within the timelines set by DISA, NETCOM, U.S. Army Cyber Command (ARCYBER), U.S. Cyber Command (USCYBERCOM), and any additional DOD organizations tasked with the security of the GIG.

3.6.5 Security Updates

The Vendor, and all of their sub-contractors, shall address all security-related issues for the duration of the support contract. Delivery, to the Government, of all materials required to perform mitigation, and/or remediation of Information Assurance Vulnerability Alerts and Bulletins (IAVAs and IAVBs) must be completed within the timelines set by DISA, NETCOM, ARCYBER, USCYBERCOM, and any additional DOD organizations tasked with the security of the GIG.

3.6.6 Safety Issues

The Vendor, and all of their sub-contractors, shall address all safety-related issues, as identified by the TYAD Safety Office, for the duration of the support contract. Delivery of all materials required to perform mitigation and/or remediation of safety hazards must be completed within the timelines set by the TYAD Safety Office.

3.7 Cyber Documentation

The Vendor, and all sub-contractors, shall provide at least a digital copy of the following information, in a file format to be approved by the TYAD CCB. All the following information must be delivered with a valid cryptographic hash using an approved method. The cryptographic hashes of any products built using the information provided by the Vendor, and all sub-contractors, must match the cryptographic hashes of the compiled data provided to the Government.

3.7.1 Manuals

The Vendor, and all sub-contractors, shall provide a complete set of instruction manuals containing all information necessary to operate, maintain, administer, and reinstall software and hardware contained within the system.

3.7.2 Disaster Recovery

The vendor shall also provide step-by-step instructions to facilitate a complete restoration of the system, to the state in which it was initially accepted by TYAD, in the event of a fatal system error.

3.7.3 System Backups

The Vendor, and all sub-contractors, shall also provide a backup copy of all configuration settings in effect at the time of successful demonstration of system functionality.

3.7.4 Source Code

If any software, firmware, or data has been customized for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government. If any software, firmware, or data, governed by an open source license has been provided for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government.

3.7.5 Calibrations and Certifications

The vendor and all sub-contractors must provide a digital copy of any documentation related to certifications received by the system or information of calibrations performed on the system.

3.7.6 Implementation Plan

The Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. All IT IT equipment, components, software, and firmware must have an associated version number.

3.7.7 Digital Copies of Paper Deliverables

In addition all documentation requested in section 7.0 Documentation must be provided digitally.

3.8 Acceptance

The following criteria must be met before any IT equipment can be accepted, and put into use, by TYAD. Upon acceptance, all assets provided to TYAD by the Vendor, and all sub-contractors, shall become the sole property of the Government. All data delivered to TYAD shall be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data, and must not be initially provided after receipt of the data by TYAD. Data received by TYAD which does not match the associated cryptographic hashes shall not be considered valid, and will not be accepted.

3.8.1 Proof of Implementation

Upon solicitation, the Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. This plan, and the associated list of components will be verified by TYAD personnel to ensure the promised assets have not been tampered with prior to system delivery at TYAD. The same component list will be used to verify that no assets are tampered with during the install phase, after delivery, but prior to acceptance by TYAD. The component list will continue to be used to verify system integrity, and track changes made, after acceptance by TYAD.

3.8.2 Proof of COOP

A successful demonstration of disaster recovery is required. The demonstration must include removing any power or backup power, battery or otherwise, from the system followed by the return of a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. Any files and/or passwords used in the disaster recovery demonstration must be provided to TYAD by the vendor. This demonstration must be carried out in accordance with demonstration guidelines defined in section 3.6.3.

3.8.3 Proof of Functionality

The IS must obtain written confirmation, from the Tech Person Ron Scarnulis, of successful demonstration of full system functionality, a demonstration of COOP (section 3.8.2), and any demonstrations agreed to by the vendor during the solicitation or performance periods. The demonstration must occur at TYAD, in the presence of either the Tech Person, or the Contracting Office Technical Representative (COTR) and at least one TYAD subject matter expert (SME). The COTR cannot serve as the only SME, at least one SME shall be from the Cost Center where the asset is to be utilized. Full system functionality demonstrations shall only be performed on the fully installed IT equipment. The written confirmation, from the Tech Person, will contain an itemized list of checks performed during the demonstration. Each check will detail the steps taken, inputs/commands given, and results received. The TYAD Tech Person/COTR and TYAD SMEs shall sign and date the verified component list, previously provided as Proof of Implementation, as well as the completed system functionality demonstration checklist. End-user license agreements (EULA) and similar documents will be signed by the TYAD Tech Person/COTR and TYAD SMEs, after signing both the verified component list, and completed system functionality demonstration checklist. If the COTR is present for the full system functionality demonstration test, and signs on behalf of the Tech person, then the Tech Persopn must sign and date the same documents, upon receipt from the

COTR.

3.8.4 Proof of Documentation

The COR will provide a signed and dated memo once all documentation outlined in Section 3.7 has been delivered to and verified by TYAD.

3.8.5 Proof of Authority to Operate

IT products, such as software to be installed on Army computing resources, must undergo the Risk Management Framework (RMF) Assess Only process. Systems fitting the description of an IS, such as those provided by a Vendor with software, firmware, or operating system not controlled by the Army, are required to undergo the RMF Assess and Authorize process. Both an IT product, and an IS must be registered in the Enterprise Mission Assurance Support Service (e MASS). Proof of an Authority to Operate (ATO) is only valid once the relevant entry in e MASS receives a signature from the Approving Official (AO). Without an AO signature, no ATO exists, and the IT/IS cannot be accepted.

3.8.6 Proof of TYAD TRC Approval

The IS must obtain an ELTY 1642 Requirement Document form, digitally signed by all approving authorities listed on the form. The TYAD TRC approval process typically occurs in parallel with the ATO approval process.

3.8.7 Proof of TYAD CCB Approval

The IS must obtain an ELTY 6353 Change Request form, digitally signed by all approving authorities listed on the form. TYAD TRC approval is required before consideration by the

TYAD CCB.

4.0 Site Preparation

4.1 Within 10 working days after receipt of order (ARO) the Contractor shall coordinate with the POC for a post-award pre-installation meeting to be scheduled at TYAD between the Contractor and POC. No video conferencing and no teleconferencing with the Contractor is acceptable; the Contractor shall be personally present at the meeting. It is at this meeting the Contractor shall furnish a project timeline. It is suggested the Contractor’s sub-contractor personnel attend the post-award pre-installation meeting.

4.2 Contractor personnel will remove an existing VMC machine from the project installation worksite and transport it to another building on site.

4.3 The floor at the project installation worksite in Bldg. 1C Bay 2 is, on average, 6 inch non-reinforced concrete. If the existing on-site floor does not meet the manufacturer’s floor specifications to accommodate the installation of the machine, the Contractor shall be responsible for the turn-key installation of the manufacturer’s specified foundations for the machine.

4.4 For the turn-key installation of the manufacturer’s specified machine foundations the Contractor shall be responsible for supplying all equipment, tools, materials, supervision and labor. The Contractor shall saw-cut the existing concrete floor at the required locations in Bldg.

1C Bay 2. The Contractor shall remove the saw-cut concrete pieces and excavate to the required depths. The Contractor shall supply and install the manufacturer’s specified steel reinforcements; pour and level the concrete. The Contractor shall clean the work site prior to the Contractor departing for evenings, weekends, and holidays. The Contractor shall perform the saw-cutting and excavation work between the hours of 5:00 PM Friday and 6:00 PM Sunday.

The Contractor may perform concrete installation and finishing during normal 1st-shift duty hours, Monday—Thursday from 7:30 AM to 4:00 PM.

4.5 The Contractor shall supply and have delivered to TYAD a refuse receptacle for rubbish and debris collection and for rubbish and debris removal from TYAD. Location for placement of the Contractor’s refuse receptacle will be provided by the Government to the Contractor in advance of Contractor work initiation. The Contractor shall remove the refuse receptacle within 5 working days following completion of all contractual work.

4.6 It shall be the responsibility of the Contractor to contact the TYAD Fire Department to obtain a Hot Work Permit prior to the Contractor performing welding, torch cutting, metal cutting and grinding,…