CS Public Works DRAFT PWS.docx

PERFORMANCE WORK STATEMENT

FOR

PUBLIC WORKS DIVISION RISK REDUCTION INITIATIVE SUPPORT SERVICES

1.0 OBJECTIVE

Provide Marine Corps Base (MCB) Camp Lejeune with non-personal support services to provide knowledge, training, and support to assist Marine Corps Installations East (MCIEAST) in the areas of Regional FRCS Monitoring, Cybersecurity, Assessment and Authorization (A&A), Authority To Operate/Authority to Connect (ATO/ATC) package upkeep and maintenance, and data center support/administration for the monitoring platform, virtualized environment, servers, and associated applications. The Contractor shall provide this service capability directly for the G-F Department, Public Works Division (PWD), Camp Lejeune, NC.

2.0 BACKGROUND

G-F Department, Public Works Division (PWD), Camp Lejeune, NC requires support to monitor cybersecurity threats aboard MCIEAST, as well as provide knowledge and training.

The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 August 2004 has established criteria for contractors who require a Common Access Card (CAC) for either physical access to a U.S. Government controlled installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and/or are eligible for a public trust position.

3.0 SERVICES TO BE PERFORMED

3.1 The Contractor shall architect, implement, manage, and maintain the Regional FRCS Monitoring Platform (Dragos). The Contractor shall manage the total work effort associated with Regional FRCS Monitoring support services and all other functions required for satisfactory and timely completion of these services.

3.2 The Contractor shall conduct inspections/surveys of MCIEAST installation FRCS networks for connection to and integration with the MCIEAST Regional FRCS Monitoring Platform (Dragos).

3.3 The Contractor shall configure, install, maintain, and update various Encrypt/Decrypt devices to connect to the firewall over the MCEN via inter Base transport with an approved IPSec VPN, establishing connection between installation FRCS networks and the MCIEAST Regional FRCS Monitoring Platform.

3.4 The Contractor shall install, maintain, and manage Dragos Sitestore and Monitoring Platform Sensors for each MCIEAST installation FRCS network, to include providing for the continual testing and updating of sitestores and sensors for threat detection and vulnerability management purposes.

3.5 The Contractor shall install, maintain, and manage a Dragos Central Store for Regional Visibility/Reporting.

3.6 The Contractor shall enrich MCIEAST installation sitestore environments and data to correctly establish, reflect, and monitor their FRCS devices and networks.

3.7 The Contractor shall provide training, support, and guidance for installation end users and changes to password/access rights.

3.8 The Contractor shall assist with configuration management as future adjustments are made to the system.

3.9 The Contractor shall assist in trouble shooting and investigation of FRCS related events, equipment issues, or system performance issues.

3.10 The Contractor shall develop and update policies required for the Regional Monitoring portion of the PWD ICS/OT accreditation package.

3.11 The Contractor shall develop and maintain all required procedures for the cybersecurity of the Regional FRCS Monitoring Platform.

3.12 The Contractor shall provide for the continuous monitoring of MCIEAST Regional FRCS networks, inventories, and tracking of both events and incidents as they occur throughout the MCIEAST Region.

3.13 The Contractor shall assist in the Regionalization of FRCS Incident Response between the installations, MCIEAST, and MCCOG.

3.14 The Contractor shall, where feasible, and when required, host and support MCIEAST installation FRCS servers, leveraging existing approved IPSec VPN tunnels established via the Regional FRCS Monitoring Solution to connect those servers to their corresponding FRCS networks and devices. These systems include but are not limited to BAS, W&WW, HVSCADA, Metering, Lighting, and other ICS/OT systems.

3.15 The Contractor shall, as needed, conduct inspections/surveys of new and existing sites (buildings and other physical locations for ICS/OT Supervisory controllers) and provide the information to CLNC FRCS Cyber Operations Group to add new ICS/OT systems to the existing solution.

3.16 The Contractor shall architect, administer, and maintain the Nutanix Hyperconverged Virtual environments required to support MCIEAST installation FRCS servers, as required.

3.17 The Contractor shall support and assist MCIEAST Installation Systems Administrators with access and privileges for the administering of their hosted FRCS servers.

3.18 The Contractor shall ensure MCIEAST installation servers hosted by Camp Lejeune are being properly managed and maintained by MCIEAST installation Systems Administrators, reporting any deficiencies to the Regional FRCS Program Manager, Director FRCS Cyber Operations Group, and ISSM for correction or, ultimately, isolation and disconnect if corrective action is not taken in a timely manner.

3.19 The Contractor shall ensure continued compliance with all applicable Cybersecurity requirements, including applying STIGs, patches, updates, and maintaining compliance with Camp Lejeune’s RMF ATO/ATC.

3.20 The Contractor shall provide RMF support to and coordination with MCIEAST installation ISSMs, ISSOs, and ISSEs required for MCIEAST installation FRCS servers to be hosted by Camp Lejeune. Though RMF/Cyber work will not be conducted for the MCIEAST installations hosted by Camp Lejeune, support and coordination will be required in order for them to adopt and adhere to the required RMF policies in accordance with Camp Lejeune’s RMF ATO/ATC.

3.21 The Contractor shall provide network/firewall engineering support to and coordination with MCIEAST installation network/firewall personnel for the routing and connection of their FRCS devices and equipment to their installation’s respective FRCS servers hosted by Camp Lejeune.

3.22 The Contractor shall maintain the “Standard Operating Procedure” or checklist to document suggested duties for routine operation of the Regional FRCS Monitoring Solution. Examples include: access/use of the system, typical screens, report setup, event investigations, continuous monitoring of regional FRCS networks, incident response procedures, integration with CSSP activities.

3.23 The Contractor shall provide all vehicles and travel needed for the technicians to complete assigned tasks.

3.24 The Contractor shall provide daily reports of events/incidents generated through the Regional FRCS Monitoring system and monthly reports of identified issues/corrections for systemic problems.

3.25 The Contractor shall steward and provide their expertise/ assistance with FRCS network integration during the design process, prior to Beneficial Occupancy Date (BOD), and during the BOD process.

3.26 The Contractor shall attend and prepare necessary materials for Daily, Monthly, and Quarterly reporting to the

CSSP.

4.0 PLACE OF PERFORMANCE, HOURS OF OPERATION, AND PERIOD OF PERFORMANCE

4.2 Hours of Operation

Work Schedule: The normal work week is typically from Monday through Friday, 0730-1600. The standard 40-hour week is defined as five (5) days a week, eight (8) hours a day. The contractor is advised that deviation from this standard work-week may affect access to buildings, materials and/or Government employees. The contractor employees’ hours of performance shall be determined by the contractor.

Normal work hours for MCB Camp Lejeune Public Works Department are 7:30 am to 4:30 pm Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

Work Schedule Adjustments Due to Emergency Installation Closures. Contractor personnel shall be expected to provide limited designated services in event of a closure due to emergency situations or inclement weather emergencies; applicable notifications shall be provided by television/radio announcements, telephone, text, email, verbal means, or MCB information systems. MCB Camp Lejeune Information Systems telephone number for reporting instructions is 910-451-1717. Once the Installation has returned to normal operations, Contractor personnel shall resume full services under normal work hours.

Under emergencies in which the Installation remains open under reduced but required services, Contractor personnel shall maximize staffing levels of essential personnel based on Government notification, telework may be authorized for non-classified work and communication regarding assessment of safety and practicality of situation. Considerations shall include employee/family member injuries, extensive home damages (to include transportation assets), mass power outages, inaccessible travel routes, school/daycare closures, pandemics etc.

All services provided under this contract are considered essential

Holidays: For purposes of scheduling work the Contractor is advised that access to the Government installation may be restricted on Federal holidays:

The following are observed federal holidays:

* Note: If the holiday falls on a Saturday, it will be observed on the preceding Friday. If the holiday falls on a Sunday, it will be observed on the following Monday.

4.3 Period of Performance

The resultant contract will include a Base Period of 12 months and four (3 ) 12-month option periods to be exercised at the Government's discretion.

UNAUTHORIZED WORK PERFORMANCE: The Contractor shall not perform work that deviates from contract requirements and specifications. If the Contract deviated from contract requirements and specifications without approval from the CONTRACTING OFFICER, such deviation shall be at the risk and expense of the Contractor and any cost related thereto shall be borne by the Contractor.

5.0 DELIVERABLES

The Contractor shall provide an adequate staff of employees with the necessary management expertise, training, and certifications to ensure the performance of the work in accordance with sound and efficient management practices. The Government estimated effort is projected to be supported by the equivalent of five (5) full time personnel.

More or less than this number may be proposed as long as the requirements of the PWS are met. Upon contract award there will be a transition period of 10 days. The key personnel and one contractor employee will start the day after award. The day after the end of the transition period, the awardee shall have 100% of proposed personnel on hand.

5.1 Security Requirements

The Contractor FSO at the Contractor level and required Contractor personnel performing work under this contract must have a Secret Clearance based on a Tier 3 personnel security investigation. The Contractor shall possess the required clearance prior to the Contractor and Contractor personnel start date and maintain the level of security required for the life of the contract.

The Contractor is responsible for fully supporting the process. Contractor who already maintain the appropriate clearance and already meet all onboarding training requirements ought to receive more favorable consideration for this service. Contractor employees must complete online training within 30 days and in-person training withing 180 days of the employment start date. The Government reserves the right to negotiate a lower labor rate for a Contractor employee when the Contractor employee is not fully onboarded, unless reasonable delays are adequately justified in writing, and performance is unaffected by delays.

The Contractor will access information systems such as the Marine Corps Enterprise Network and data accessed through portals via user accounts and Common Access Cards provided by the government.

5.1.1 The Government will conduct the Security Management onboarding process. This includes the following online training (specific course requirements, titles, and URLS may change):

a. Introduction to Industrial Security (IS011.16)

b. Introduction to Personnel Security (PS113.16)

c. Introduction to Information Security (IF011.16)

d. Introduction to Physical Security (PY011.16)

e. Derivative Classification (IF103.16)

f. Unauthorized Disclosure (UD) of Classified Information & CUI (IF130.16)

g. Insider Threat Awareness Course (INT101.16)

5.1.2 Other Required Courses are as follows:

a. DOD Mandatory Controlled Unclassified Information (CUI) Training (DoD Mandatory Controlled Unclassified Information (CUI) Training (usalearning.gov))

b. Marine NET Cyber Awareness (CYBERM0000) and PII (DONPII010A) training

c. HQMC Security Management Course (in-person, offered quarterly)

5.1.3 Contractors must also provide the following:

a. DISS visit request

b. SF312 (Classified Information Nondisclosure Agreement)

c. DD 2875 (System Authorization Access Request)

5.2 Performance Requirements

5.2.1 Contractor personnel shall be capable of communicating (oral and written) fluently in English.

5.2.2 Contractor personnel that operate motor vehicles shall maintain a valid state driver’s license with all class and commodity endorsements required by Public Law 99-570 and state law for the type of vehicle operated.

5.2.3 Some performance requirements will require that selected Contractor personnel have and maintain Secret Security eligibility. Both the Contractor FSO at the company level and required Contractor personnel must be able to have a favorable adjudicated T3 background investigation. The government will initiate the T3 investigation with finger print reading. The individual contractor will need to complete the necessary documentation after T3 investigation has been initiated. The final DD254 will be included separately via email.

5.2.4 The following minimum education/experience/ credentials/qualifications are required:

a. Collectively, Contractor personnel shall meet the following requirements:

1. Experience in the use and administration of Nutanix Hyperconverged virtualized environments in support of Regional FRCS Monitoring servers and applications.

2. Experienced in the deployment and use of the Dragos OT Monitoring Platform in both a test and operational OT environment; this includes Central Store, Site Store, and Sensors.

3. Experience in the use of SQL and Microsoft Sever software (current versions).

4. Experience in Marine Corps Certification and Accreditation Support Tool (MCCAST V2).

5. Networking experience in a DoD environment.

6. Knowledgeable of high voltage, water/wastewater and mechanical trades and requirements.

7. Knowledge of TCP/IP, information security/authorization profiles, or security administration of Unix or Windows network/systems.

8. Experience with HBSS.

9. Experience with Automated Metering systems.

10. Knowledge of the USMC DEVSECOPS policy and its applicability to support ICS/OT systems/operations.

11. Experience in ICS control systems -Metasys, Niagara AX platform, Alerton, Honeywell, Trend, KMC, and American Automatrix, Loytec, Rockwell, OSI.

12. Experience in BACnet/MSTP, BACnet/IP, N2, LON, High Voltage SCADA, Water/Wastewater SCADA.

13. Experience in preforming software security updates, system patches, software patches, and version upgrades on Metasys, Niagara, Itron, Honeywell, Rockwell, and OSI software products.

14. Expertise in the USMC A&A process to include MCCAST 2.0, RMF, DFIA, and CNSSI 1253.

15. Experience creating/managing POAMs.

16. Experience with DISA STIGs.

17. Experience interpreting/implementing standards and policies in accordance with NIST 800-53/DoDI 8510.01.

18. Experience with vulnerability/risk analysis.

b. Professional Certifications Required:

1. Dragos Platform Certified User Certification

2. ITILv4 Foundations

3. ICS-VLP Certificate 210W-01 – 10

4. RMF Training (USMC specific)

5. CCENT or CCNA

6. Sec+

7. CISSP

8. Microsoft Certs

5.2.5 The contractor shall act and dress professionally at all times. Professional dress is defined as clothing that is neat, clean, and in good repair. Clothing that exposes cleavage, midriff or undergarments is not professional dress.

5.2.6 Contract services regularly require travel throughout Camp Lejeune and Marine Corps Air Station (MCAS), New River, NC and their satellite activities located within 50 miles of the Camp Lejeune main gate. Contract services will also require some travel to Marine Corps Base (MCB) Quantico, MCAS Quantico, Marine Barracks Washington, MCAS Cherry Point, MCAS Beaufort, Marine Corps Logistics Base (MCLB) Albany, Marine Corps Support Facility (MCSF) Blount Island, and Marine Corps Recruit Depot (MCRD) Parris Island in order to establish connections from installation FRCS networks to the Regional FRCS Monitoring Platform residing at MCB Camp Lejeune. Travel between the different locations is considered inherent to the support services detailed in the PWS and will not be reimbursed.

5.2.7 The Contractor shall be responsible for obtaining all necessary licenses and certifications and for complying with all applicable Federal, State, and local laws. The Contractor shall maintain updated copies of any applicable licenses and certifications for all employees and make them available to the Government upon request.

5.3 Additional Performance Requirements Information

5.3.1 Definition of Terms.

a. Contractor Personnel- Includes all agents, employees, and subcontractors of the prime contractor.

b. Crisis Situation- Per DoD Instruction 3020.37, crisis situation means any emergency so declared by the National Command Authority or the overseas combatant commander, whether or not U.S. Armed Forces are involved, minimally encompassing civil unrest or insurrection, civil war, civil disorder, terrorism, hostilities build-up, wartime conditions, disasters, or international conflict presenting a serious threat to DoD interests.

5.3.2 Unclassified Work. During emergency situations like a pandemic, all contractor personnel may be required provide support on unclassified systems via telework. These systems include SharePoint, Chat programs, and Web conferencing solutions. Contractor personnel may also be required to work on unclassified IM/KM Policy, Process and Automation, Collaboration, and C2 documents. Government computer assets will be provided if unclassified telework is authorized. Contractor personnel will sign for government approved telework laptops and cell phones (if available). Contractor personnel will return government assets after the emergency is over.

5.3.3 Classified Work. All work on classified systems and documents shall be performed only in government facilities by essential personnel.

5.3.4 Contract Performance in a Crisis Situation. All services to be performed under the contract have been determined to be essential for performance during crisis.

a. The contractor shall provide contract support in a crisis situation as directed by the Contracting Officer (KO). This support shall be in accordance with the applicable DoD and USMC policies and procedures established for contractor support during the crises in effect at the time of the occurrence.

b. The Government will facilitate the establishment of required lines of communication to allow the contractor to communicate with locations necessary to perform the requirements of the PWS.

c. Per the CETS MAN, DoD Instruction 3020.37, Continuation of Essential DoD Contractor Services During Crises, and DoD Instruction 1000.1, Identity Cards Required by the Geneva Conventions, the Government will supply the contractor with the appropriate and necessary credentials and status for performance of the contract in a crisis situation, to include consideration of applicable matters of international law and treaties. Contractor personnel in a crisis situation theater shall comply with the conduct requirements of the CETS MAN and the cognizant Commander’s regulations and orders pertaining to non-combatant personnel. The contractor personnel shall report to the COR.

d. Contractor personnel will provide technical input and analysis for Government contingency plans when directed by the COR or the KO.

e. Contractor personnel deployed to a theater of operations are subject to the Uniform Code of Military Justice (UCMJ) when serving with or accompanying an armed force only “in time of war” as declared by Congress. Retired members of the military may be subjected to action under the UCMJ without a congressionally declared war. Contractor personnel may have administrative privileges suspended for disciplinary infractions or improper conduct.

f. Contractors shall request guidance from a Government media operations center if and when reporters seeking interviews or information on their participation in the mission/operation approach them.

g. The contractor shall take all necessary administrative actions required to prepare its personnel for a crisis situation deployment. Some examples of these actions are:

1. Inform its employees of their responsibility to adhere to all guidance and orders issued by the theater commander, or his representative, regarding possession, use, safety, and accountability of weapons.

2. Assist its employees to obtain the required civilian licenses to operate the equipment necessary to perform the contract in the theater of operation.

3. Obtain all passports, visas, or other documents necessary to enter or exit any areas identified by the KO.

4. Assist its employees in obtaining security clearances applicable to the level required for performance in the theater of operations.

5. Assist its employees in obtaining a complete physical evaluation equal to that which similarly assigned Government personnel must pass. Medical requirements shall be completed prior to arrival at the point of debarkation or prior to direct deployment with the unit.

h. To the extent the contractor is unable to obtain or retain the services of qualified personnel to perform in a crisis situation, the contract shall not be terminated for default. Every reasonable effort shall be made by the contractor to provide uninterrupted services of qualified personnel.

5.4 Government Responsibilities

The Government will provide the contractor with all the information needed for performance including desired formats and samples.

If coordination of support services is required the Government point of contact will be with the Contracting Officer’s Representative or the Deputy, Maintenance Operations Officer.

5.5 Organizational Conflicts of Interest

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR.

If performance of any PWS requires the contractor (to include subcontractors) to supply technical support related to systems or projects with which the contractor is already directly concerned, either by prime or subcontract, the contractor shall so immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found.

The Contractor shall not undertake performance of any PWS that requires it to supply technical support regarding such systems until the notice is given, and written consent to proceed is issued by the Contracting Officer.

6.0 PERFORMANCE REQUIREMENTS SUMMARY

PERFORMANCE OBJECTIVE

PERFORMANCE REQUIREMENTS

METHOD / FREQUENCY

INSPECTOR

INCENTIVE

Architect, implement, manage, and maintain the Regional FRCS Monitoring Platform (Dragos).

In accordance with PWS Section 3.1 90%

- Timeliness -Quality -Accuracy

Observation Random /Monthly

COR

Exercise Option

Configure, install, maintain, and update various Encrypt/Decrypt devices to connect to the firewall over the MCEN via inter Base transport with an approved IPSec VPN, establishing connection between installation FRCS networks and the MCIEAST Regional FRCS Monitoring Platform.

In accordance with PWS Section 3.3

90%

- Timeliness

Install, maintain, and manage Dragos Sitestore and Monitoring Platform Sensors for each MCIEAST installation FRCS network, to include providing for the continual testing and updating of sitestores and sensors for threat detection and vulnerability management purposes.

In accordance with PWS Section 3.4

Install, maintain, and manage a Dragos Central Store for Regional Visibility/Reporting.

In accordance with PWS Section 3.5 90%

- Timeliness

Enrich MCIEAST installation sitestore environments and data to correctly establish, reflect, and monitor their FRCS devices and networks.

In accordance with PWS Section 3.6 90%

- Timeliness

Provide training, support, and guidance for installation end users and changes to password/access rights.

In accordance with PWS Section 3.7 90%

- Timeliness

Assist with configuration management as future adjustments are made to the system.

In accordance with PWS Section 3.8 90%

- Timeliness

Assist in trouble shooting and investigation of FRCS related events, equipment issues, or system performance issues.

In accordance with PWS Section 3.9 90%

- Timeliness

Develop and update policies required for the Regional Monitoring portion of the PWD ICS/OT accreditation package.

In accordance with PWS Section 3.10 90%

- Timeliness

Develop and maintain all required procedures for the cybersecurity of the Regional FRCS Monitoring Platform.

In accordance with PWS Section 3.11 90%

- Timeliness

Provide for the continuous monitoring of MCIEAST Regional FRCS networks, inventories, and tracking of both events and incidents as they occur throughout the MCIEAST Region.

In accordance with PWS Section 3.12

- Timeliness

Assist in the Regionalization of FRCS Incident Response between the installations, MCIEAST, and MCCOG.

In accordance with PWS Section 3.13 90%

- Timeliness

Where feasible, and when required, host and support MCIEAST installation FRCS servers, leveraging existing approved IPSec VPN tunnels established via the Regional FRCS Monitoring Solution to connect those servers to their corresponding FRCS networks and devices.

In accordance with PWS Section 3.14

Conduct inspections/surveys of new and existing sites (buildings and other physical locations for ICS/OT Supervisory controllers) and provide the information to CLNC FRCS Cyber Operations Group to add new ICS/OT systems to the existing solution, as needed.

In accordance with PWS Section 3.15

Architect, administer, and maintain the Nutanix Hyperconverged Virtual environments required to support MCIEAST installation FRCS servers, as required.

In accordance with PWS Section 3.16 90%

- Timeliness

Support and assist MCIEAST Installation Systems Administrators with access and privileges for the administering of their hosted FRCS servers.

In accordance with PWS Section 3.17 90%

- Timeliness

Ensure MCIEAST installation servers hosted by Camp Lejeune are being properly managed and maintained by MCIEAST installation Systems Administrators, reporting any deficiencies to the Regional FRCS Program Manager, Director FRCS Cyber Operations Group, and ISSM for correction or, ultimately, isolation and disconnect if corrective action is not taken in a timely manner.

In accordance with PWS Section 3.18

Submittal of Reports of Identified Issues/Corrections

In accordance with PWS Section 3.19 90%

- Timeliness

Ensure continued compliance with all applicable Cybersecurity requirements, including applying STIGs, patches, updates, and maintaining compliance with Camp Lejeune’s RMF ATO/ATC.

In accordance with PWS Section 3.20

90%

- Timeliness

Provide network/firewall engineering support to and coordination with MCIEAST installation network/firewall personnel for the routing and connection of their FRCS devices and equipment to their installation’s respective FRCS servers hosted by Camp Lejeune.

In accordance with PWS Section 3.21

Maintain the “Standard Operating Procedure” or checklist to document suggested duties for routine operation of the Regional FRCS Monitoring Solution. Examples include: access/use of the system, typical screens, report setup, event investigations, continuous monitoring of regional FRCS networks, incident response procedures, integration with CSSP activities.

In accordance with PWS Section 3.22

Provide all vehicles and travel needed for the technicians to complete assigned tasks.

In accordance with PWS Section 3.23 90%

- Timeliness

Provide daily reports of events/incidents generated through the Regional FRCS Monitoring system and monthly reports of identified issues/corrections for systemic problems.

In accordance with PWS Section 3.24

- Timeliness

Steward and provide their expertise/ assistance with FRCS network integration during the design process, prior to Beneficial Occupancy Date (BOD), and during the BOD process.

In accordance with PWS Section 3.25 90%

- Timeliness

Attend and prepare necessary materials for Daily, Monthly, and Quarterly reporting to the

CSSP

In accordance with PWS Section 3.26 90%

- Timeliness

Maintain required staffing with qualified personnel.

In accordance with PWS Section 8.4 90%

- Timeliness

Submittal of Reports of Identified Issues/Corrections In accordance with PWS Sections 3.2, 3.9, 3.10, 3.15, 3.18, 3.19, 3.22, 3.24, 3.25, & 3.26 90%

- Timeliness

7.0 GOVERNMENT-OWNED PROPERTY

7.1 Government-Owned Equipment

7.1.1 Office Equipment. The Government will provide desks and chairs within office space. Phone lines will be provided for local, long distance and Defense Switching Network (DSN) calls only. Additionally, computers, printers, and scanners will be provided. The Contractor is responsible for maintaining all Government-furnished office equipment.

7.1.2 Other Government-Owned Equipment. A list of other Government-owned equipment that will be provided to the Contractor for use while providing services under this contract will be available upon award

7.2 Contractor Workspace

The Government will provide adequate workspace, all equipment as required (e.g., desk, chair, computer, printer, copier, telephone, etc.), utilities, janitorial services, and expendable operating supplies for the duration of this contract. The contractor shall maintain the assigned office space and work areas in a neat and orderly manner. The Contractor shall not remove any government-furnished equipment or supplies from the Government compound without the express written permission.

7.3 Facilities OSHA Compliance

Government facilities have been inspected for compliance with the Occupational Safety and Health Act (OSHA). No hazards have been identified. Should a hazard be subsequently identified, the Government corrects OSHA hazards according to base-wide Government developed and approved plans of abatement taking into account safety and health priorities. A higher priority for correction will not be assigned to the facilities provided hereunder merely because of this contracting initiative. The fact that no such conditions have been identified does not warrant or guarantee that no possible hazard exists. The facilities as furnished will be adequate to meet the responsibilities of the Contractor. Compliance with OSHA and other applicable laws and regulations for the protection of employees is exclusively the obligation of the Contractor. Further, the Government will assume no liability or responsibility for the Contractor's compliance or noncompliance with such requirements, with the exception of the aforementioned requirement to make corrections according to approved plans of abatement subject to base-wide priorities.

7.4 Facilities Modifications

Before any modification of the facilities, performed by the Contractor at its own expense, the Contractor must furnish the Contracting Officer documentation describing, in detail, the modification requested. No alterations to the facilities shall be made without the specific written permission from the Contracting Officer. In the case of alterations necessary for compliance with OSHA, such permission shall not be unreasonably withheld. The Contractor shall return the facilities to the Government in the same condition as received, fair wear and tear and approved modifications excepted.

7.5 Facilities Restrictions

These facilities shall only be used in performance of this contract.

7.6 Facilities Maintenance

The Contractor is responsible for keeping the facilities occupied and surrounding areas in a clean and orderly condition.

7.7 Facilities Vacate

All Contractor's property, equipment, and supplies shall be removed within 48 hours of contract expiration or termination.

7.8 Contractor Formulated Safety and Health Plan

The Contractor shall formulate and maintain a written safety and health plan and make it available to the Government upon request. The written plan shall include the details of the Contractor’s responsibilities, method of program implementation, and how hazards and deficiencies shall be identified and corrected. It shall detail contractor personnel responsibilities for: protection of Government property and safety of others, personnel responsibilities for reporting all mishaps, and establish procedures for reporting to correcting unsafe conditions, hazards, or practices.

7.9 Accidents and Incidents

The Contractor shall notify the Contracting Officer Representative immediately after the occurrence of all accidents and incidents resulting in either personal injury, loss of life, impact to the environment or property damage to a government facility or equipment. The contractor shall submit a completed copy of and supplemental information within four (4) working days of the accident or incidents.

8.0 SPECIAL ADMINISTRATIVE INFORMATION AND SERVICES

8.1 Legal Compliance

8.1.1 The Contractor shall comply with all federal, state, and local environmental laws.

8.1.2 The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 August 2004 has established criteria for contractors who require a Common Access Card (CAC) for either physical access to a U.S. Government controlled installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and/or are eligible for a public trust position.

8.1.3 The Contractor shall participate in emergency and recall notification and personnel accountability exercises. The Contractor shall establish emergency notification and recall and personnel accountability procedures in accordance with DoDI 3001.02, Personnel Accountability in Conjunction with Natural or Manmade Disasters, and test those procedures twice a year when directed.

times by management personnel of the contractor. Contractor management will ensure that employees properly comply with the performance work standards outlined in the statement of work. Contractor employees will perform their duties independent of, and without the supervision of, any Government official or other Defense Contractor. The purchases, duties, and responsibilities set forth in the purchase order may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work.

If the personnel, for whatever reason, become unavailable for work under the contract for a continuous period exceeding 14 working days the Contractor shall propose a substitution of such personnel. All proposed substitutions shall be submitted, in writing, to the COR within 15 days of identification of the need for a substitute. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute and any other information required by the Contracting Officer to approve or disapprove the proposed substitution. All proposed substitutes shall have qualifications that are equal to or higher than the qualifications of the person being replaced.

The COR shall evaluate the requests for substitution and promptly notify the Contractor, in writing, of whether the request is approved or disapproved. If the COR determines that suitable and timely replacement of personnel who have been reassigned, terminated or have otherwise become unavailable to perform under this purchase order is not reasonably forthcoming or that the resultant reduction of productive effort would impair the successful completion of the contract, the contract may be terminated by the Contracting Officer for cause or for the convenience of the Government, as appropriate. Alternatively, at the Contracting Officer's discretion, if the Contracting Officer finds the Contractor to be at fault for the condition, he may equitably adjust (downward) the contract price to compensate the Government for any delay, loss or damage as a result of the Contractor's action.

MCIEAST REGIONAL CONTRACTING OFFICE

Bldg 316 “G” Street Camp Lejeune, NC 28542 ATTENTION: Red Team Contracting Officer

9.0 CONTRACTOR PROVIDED INFORMATION

10.0 QUALITY CONTROL PLAN

10.1 Internal Review

A description of the internal review process including who shall perform the review; the frequency; the method, and a listing of the service under review. The Contractor shall accomplish all work with adequate internal controls and review procedures, which shall be put in place by the Contractor to eliminate conflicts, errors and omissions, and ensure technical accuracy.

10.2 Compliance

The Contactor shall comply with all requirements of the statement of work and documents attached or referenced.

10.3 Approach and Procedures

To communicate with the Government, handling corrective action without dependence upon Government direction; and identifying and implementing potential improvements to the program service and capabilities.

10.4 Inspection

Quality control inspection system covering all contract services. It must specify areas to be inspected on both a scheduled or unscheduled basis and the frequency of the inspections. It must specify how inspections are to be conducted, e.g. random, visual, customer complaint, etc. The Contractor shall perform inspections, maintain quality control, and provide the COR with paper copies upon completion.

10.5 Personnel Qualification

The name(s) and qualification of the individual(s) tasked to perform quality control inspections and the extent of their authority.

10.6 Deficiencies

A method of identifying and reporting deficiencies in the quality of services performed and taking corrective action before the level of performance becomes unsatisfactory.

11.0 CONTRACTING OFFICER’S REPRESENTATIVE (COR)

In order to expedite the administration of this contract, the following delineation of duties is provided. The names, addresses, and phone numbers for these offices or individuals are included elsewhere in the contract award document. The office or individual designated as having responsibility should be contacted for any questions, clarifications or information regarding the administration of this function assigned.

The name of the COR for this contract will be provided at the time of contract award.

In the absence of the COR named above (due to reasons such as leave, illness, or official travel), all responsibilities and functions assigned to the COR shall be the responsibility of the COR’s supervisor, acting on behalf of the COR.

a. Technical Interface

1. The COR is responsible for all Government technical interface concerning the contractor and furnishing technical instructions to the contractor. These instructions may include: technical advice/recommendations/clarifications of specific details relating to the technical aspects of the contract requirements; milestones to be met within the general terms of the contract or specific subtasks of the contract; or, any other interface of a technical nature necessary for the contractor to perform the work specified in the contract or order. The COR is the point of contact through whom the contractor can relay questions or problems of a technical nature to the PCO.

2. The COR is prohibited from issuing any instruction which would constitute a contractual change. The COR shall not instruct the contractor how to perform. If there is any doubt whether technical instructions contemplated fall within the scope of work, contact the PCO for guidance before transmitting the instructions to the contractor.

3. When, in the opinion of the contractor; the COR request effort outside the existing scope of the contract, the contractor shall promptly notify the Contracting Officer in writing. No action shall be taken by the contractor under such direction until the Contractor Officer has issued a modification to the contract (or delivery order) or has otherwise resolved the issue.

b. Contract Surveillance

1. The COR shall monitor the contractor’s performance and progress under the contract. In performing contract surveillance duties, the COR should exercise extreme care to ensure that he/she does not cross the line of personal services. The COR must be able to distinguish between surveillance (which is proper and necessary) and supervision (which is not permitted). Surveillance becomes supervision when an individual goes beyond enforcing the terms of the contract. If the contractor is directed to perform the contract services in a specified manner, the line is being crossed. In such a situation, the COR’s actions would be equivalent to using the contractor’s personnel as if they were government employees and would constitute transforming the contract into one for personal services.

2. The COR shall monitor the contractor’s performance to see that inefficient or wasteful methods are not being used. If such practices are observed, the COR is responsible for taking reasonable and timely action to alert the contractor and the PCO to the situation.

3. The COR will take timely action to alert the PCO to any potential performance problems. If performance schedule slippage is detected, the COR should determine the factors causing the delay and report them to the PCO, along with the contractor’s proposed actions to eliminate or overcome these factors and recover the slippage. Once a recovery plan has been put in place, the COR is responsible for monitoring the recovery and keeping the PCO advised of progress.

4. If the Contractor Performance Assessment Reporting System (CPARS) is applicable to the contract, the COR is responsible for completing a Contractor Performance Assessment Report (CPAR) in the CPARS Automated Information System (AIS). The initial CPAR, under an eligible contract, must reflect evaluation of at least 180 days of contractor performance. The completed CPAR, including contractor comments, if any, (NOTE: contractors are allowed 30 days to input their comments) should be available in CPARS AIS for reviewing official (PCO) review no later than 270 days after the start of contractor performance. Subsequent CPARS covering any contract option periods should be ready at 1-year intervals thereafter.

c. Invoice Review and Approval/Inspection and Acceptance:

1. The COR is responsible for all quality assurance of services performed and acceptance of the services or deliverables. The COR shall expeditiously review copies of the contractor’s invoices or vouchers, certificate of performance and all other supporting documentation to determine the reasonableness of the billing. In making this determination, the COR must take into consideration all documentary information available, and any information developed from personal observations.

2. The COR must indicate either complete or partial concurrence with the contractor’s invoice/voucher by executing the applicable certificate of performance furnished by the contractor.

3. The COR will provide the RCO with copies of acceptance documents such as Certificates of Performance.

4. Upon completion of all services under the contract, the COR shall work with the Contractor to obtain and execute a final invoice no more than 60 days after completion of the contract performance. The COR shall ensure that the invoice is clearly marked as a “Final Invoice.”

d. Contract Modifications/Orders Under Indefinite Delivery Contracts

1. The COR is responsible (if necessary) for developing the statement of work for task orders, change orders, or modifications and for preparing an independent government cost estimate of the effort described in the proposed statement of work.

2. The COR shall provide available and relevant Past Performance information with each request for new Task Orders. The COR shall review and evaluate the contractor’s proposal and furnish comments and recommendations.

e. Administrative Duties

1. The COR is responsible for taking appropriate action on technical correspondence pertaining to the contract and for maintaining files on each contract. This includes all modifications, government cost estimates, contractor invoices/vouchers, certificates of performance, DD 250 forms and contractor’s status reports.

2. The COR shall maintain files on all correspondence relating to the contractor performance, whether satisfactory or unsatisfactory, and on trip reports for all government personnel visiting the contractor’s…