ANDSF_IDC_PWS_(26Jul16).docx

PERFORMANCE WORK STATEMENT (PWS)

For ANDSF Identification (ID) Card System

Afghan National Defense and Security Forces (ANDSF) Identification Card System (ID CARD) Performance Work Statement (PWS)

26 July 2016

TABLE OF CONTENTS

Contents

5.11. PERFORMANCE REQUIREMENTS SUMMARY…………………………………………………………………………..27

5.12. Deliverables Schedule: 28

This page intentionally left blank

Part 1 General Information

1. GENERAL

1.1. Contract: This is a non-personal services contract to list the requirements for the purchase, integration, deployment, maintenance, and sustainment of the Afghan National Security and Defense Forces (ANDSF) Identification (ID) Card System. The U.S. Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the U.S. Government.

1.2. Description of Services/Introduction: The current ID Card System is aged and has been facing obsolescence. This acquisition is to provide a common ID Card System to the Ministry of Defense (MoD) (Afghan National Army (ANA)) and at the Ministry of Interior (MoI) (Afghan National Police (ANP)) as one of the enabling capabilities that will allow automated payroll from authorization to the person being paid to. The top level requirements for this acquisition are as follows: 1) the ID Card System must be able to interoperate with the Afghanistan Automated Biometric Identification System (AABIS), the Afghan Human Resource Information Management System (AHRIMS) and the Afghan Automated Identity Management System (AAIMS), the Afghan Personnel and Pay System (APPS) and Electronic National Identification Card (e-NID) or e-Taskira; 2) the ID Card System must be capable of producing ID Cards which incorporate the latest anti-fraud features, and have Dari, Pashtu, and English on them, with the database capturing pertinent data in those three (3) languages; 3) deploy and train the users of various levels in MoD and MoI, so they can issue ID Cards; and 4) provide initial sustainment of the ID Card System and provide efficient transition of the ID Card System sustainment to ANDSF. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, other items, and non-personal services necessary to perform the following key functions in this PWS except in the event of GFE. The Contractor shall perform to the standards in this contract.

1.3. Objectives: The Contractor shall expeditiously integrate the ID Card System with AABIS/AAIMS, AHRIMS/APPS and e-NID, field and train ID Card System users to enable an initial issue of approximately 500K ID Cards to all biometrically validated ANDSF personnel and then transition the system to ANDSF for management and maintenance.

1.4. Scope: This PWS requires the Contractor to perform acquisition of an ID Card System, integrate with other systems as described in Para 1.3. (Objectives), and field and train users to print and issue ID Cards to all eligible ANDSF personnel across both MoI and MoD of Afghanistan. Initial effort requires the contractor to update and issue approximately 500K new ID Cards, which can facilitate validation of a person's identity, to the MoD and MoI Soldiers and Patrolmen. There are three categories of activities associated with the ID card identified in this PWS: 1) Initial ID card Replacement; 2) New ID card Creation; 3) Replacement ID Cards. These are further defined in section two of this PWS. This entire system goes to supporting that effort, and is the primary focus of this contract. Each job function listed herein is to be accompanied with a plan for the integration, deployment, sustainment, training, and transition of the following objectives to be performed during the period of performance (PoP). At the end of the contract, the ANDSF shall manage and maintain the ID Card System. The transition of functions from the Contractor to ANDSF personnel shall occur in a phased manner as described herein. Following transition, the Contractor shall maintain a support function until the expiration of the sustainment options.

1.5. Period of Performance: One (1) year basic contract with two (2) one (1) year options for sustainment only tasks.

1.6. Quality Assurance: The U.S. Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The QASP is primarily focused on what the U.S. Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards shall be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.1 Performance evaluation will be accomplished by monitoring compliance with the performance requirements as described in the contract and in the QASP.

1.6.2 The surveillance methods to assess and evaluate the contractor will be used by the US Government and described in the QASP. These methods are, but not limited to:

1.6.2.1. 100% Inspection - The US Government will evaluate 100% designated tasks.

1.6.2.2. Partial Inspection - The US Government will evaluate less than 100% of designated tasks and on a selective basis.

1.6.2.3. Random Sampling - The US Government will evaluate less than 100% of designated tasks on a random basis.

1.6.2.4. Independent Verification and validation (IV&V) - Verification and validation performed by an IV&V contractor engaged by APPS PMO may be used to determine that the work product delivered by the contractor matches the content requirement in the contract.

1.6.3 Operational Monitoring - The US Government will examine reports generated by automated tools and logs and websites.

1.6.4 Customer Feedback - The US Government will evaluate survey and random sampling, which will be used to evaluate customer satisfaction.

1.7. Recognized Holidays:

Parliamentary Elections

1.8. Hours of Operation: The Contractor personnel co-located at ANDSF facilities shall provide services during normal ANDSF working hours, matching the hours of the associated Ministries where they work at. Normally, these hours are Saturday through Thursday from 0800–1700 Kabul local time zone. Few exceptions exist, and these include but are not limited to Ramadan, and when a team is traveling. Generally, the contractor shall match the ministries unless deemed necessary to deviate by PMO and written notice will be given by the COR in these events.

1.9. Place of Performance: The work shall be performed at, but not limited to, the MoD/MoI and their associated units throughout Afghanistan, HQ Resolute Support, and the Contractor’s facility.

1.9.1 In addition, the Contractor shall perform site visits as deemed appropriate by PMO to provide training, oversight, and assistance as required. This shall include help desk assistance; inter-operability issues with the AABIS, AHRIMS, APPS and e-NID; trouble-shooting; and continuity for on-site personnel. The Contract employees shall work within the Force Protection umbrella of ANDSF when conducting tasks at MoD/ANA and MoI/ANP sites.

1.10. Type of Contract: The U.S. Government will make a single award using Firm Fixed Price contract.

1.11. Security Requirements:

1.11.1 Contractor Security

1.11.1.1. Physical Security: The Contractor shall be responsible for safeguarding all contractor acquired property and property provided for contractor use in this contract. At the close of each work period, facilities, equipment, and materials shall be secured.

1.11.1.2. Any contractual tasks in this PWS required to be performed within Afghanistan should be conducted, to the fullest extent possible, by an Afghanistan partner who has been selected and vetted by the prime contractor and is approved by PMO.

1.11.1.3. Transportation and security below the Corps HQ or Provincial HQ shall be provided by the ANDSF local commander in coordination with the Afghanistan Partner, the contractor and PM APPS.

1.11.1.4. The contractor shall ensure that their individuals requiring ID card program access will have the proper background investigations conducted by the MoI or MoD personnel office respectively and obtain necessary training. Additionally, the contractor will have at the supervisory level and above already vetted and approved personnel by the IBR so they can expedite handling PII and other sensitive information.

1.11.1.5. PMO retains the right to remove any contractor personnel, regardless of prior clearance or adjudication status, whose actions while assigned to this contract conflict with the interests of the US Government or that of the Government of Afghanistan. The reason for removal will be documented in writing by the COR and submitted to the KO for approval and action.

1.11.2 Protecting Personally Identifiable Information (PII)

1.11.2.1. PII is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.

1.11.2.2. All PII should be protected according to industry best practices, and by the Recommendations of the National Institute of Standards and Technology, “Guide to Protecting Confidential of Personally Identifiable Information (PII), NIST Special Publication 800-122.

1.11.2.3. System shall have the following safe guards to limit access to PII:

1.11.2.3.1. All access or reports generated with PII shall be captured in the system audit log to include, at a minimum:

1.11.2.3.1.1. User accessing the information/report

1.11.2.3.1.2. Date and time of access

1.11.2.3.1.3. Terminal used for access

1.11.2.3.1.4. Action generated by user: query, display, download, or print information

1.11.2.3.2. Repeated requests for an excessive amount of data (excessive is defined as > 500 records) or similar PII reports shall be flagged in the system upon the second request for such information within a seven (7) day period with a report generated to the appropriate MoI or MoD designated security officer and PM APPS.

1.11.3 Data at Rest (DAR) security and protection: Data at rest will be implemented on all computers; removable storage devices (thumb drives, data CD, portable hard drives, etc.) used on the network to access, store, or transport ID card personnel data. All encryption will comply with Advanced Encryption Standard (AES) 192 at a minimum.

1.11.3.1. Full Disk Encryption (FDE): The FDE solution will protect against unauthorized reading or copying of data off a protected hard drive or other components. Steps shall be taken to ensure that pre-boot authentication (PBA) is also implemented which will allow only registered users to boot workstations following token or other authentication methods.

1.11.3.2. Removable Storage Encryption (RSE): Mandatory encryption is required for data copied to removable storage devices, such as USB thumb drives, external hard drives, compact discs (CDs), digital versatile discs (DVDs), etc. This encryption must protect all data transferred off of a DAR protected work station. Where necessary, and for official use only, an inter-operability utility must be installed on removable storage devices that may be used to decrypt data.

1.11.4 Safeguarding Classified Information and Materials. The contract is unclassified but some of the information handled by the contractor will be Sensitive (FOUO).

1.11.4.1. The contractor will ensure requirements for safeguarding sensitive information and sensitive materials, for obtaining and verifying personnel / background check, for verifying security clearances and indoctrination of visitors, for controlling access to restricted areas, for the security of automated and non-automated management information systems and data are fulfilled.

1.11.4.2. The US Government (via PM APPS) shall be immediately notified of any security incident or any indication of a potential unauthorized disclosure or compromise of sensitive unclassified information.

1.12. Post Award Conference: The Contractor shall attend a post-award (“kick-off”) conference to be conducted within seven (7) days after contract award. The conference date, place and time shall be coordinated by the Contracting Officer upon contract award and obtaining Defense Base Act insurance.

1.13. Key Personnel: - Those people considered essential to successful contractor performance.

1.13.1 Program Manager (PM)

1.13.1.1. The contractor shall provide a PM who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the government contracting officer.

1.13.1.2. The PM shall be overseeing the team using best business practices and working as an integrated team and shall be responsible for all contractual responsibilities and delivery of all contract deliverables listed in the Deliverable Schedule.

1.13.1.3. The PM shall work side-by-side with Government personnel and shall ensure an efficient, effective and economical level of support is provided to the US Government.

1.13.1.4. The PM is responsible for translating high-level business requirements into detailed functional specifications and managing requests for changes to the design specifications, and assists the business in determining which business requirements can and should be automated and how they are then integrated with other business and technical processes.

1.13.1.5. PM shall provide oversight of staff and support activities, oversee contract costs and coordinate with the COR.

1.13.2 Technical Lead

1.13.2.1. The Technical Lead is responsible for developing, communicating, maintaining, and enforcing the overall architecture of ID Card System, to include:

1.13.2.2. Applications

1.13.2.3. Data

1.13.2.4. Third Party products

1.13.2.5. Technical Infrastructure

1.13.2.6. The Technical Lead is responsible for program activities related to analysis, design (including fit/gap analysis), documentation, development, testing of the ID Card System, including but not limited to:

1.13.2.6.1. Presenting proposed ID card design options to ANDSF leadership.

1.13.2.6.2. Generating detailed ID card design documentation.

1.13.2.6.3. Documenting requirements or changes within the scope of this PWS.

1.13.2.7. The Technical Lead will be expected to understand all solutions components and how they inter-operate to support business processes and management information needs.

1.13.2.8. The Technical Lead shall be responsible for interface and integration strategies with external systems processes, including determining, understanding and maintaining business requirement for those interactions.

1.13.2.9. The Technical Lead shall be responsible for ensuring compliance with external requirements.

1.13.2.10. Serves as direct liaison to function process owners in order to translate and prioritize requirements for assigned area project and maintenance work.

1.13.3 Life-Cycle and Configuration Manager

1.13.3.1. Responsible for configuration management (CM) tasks to include use of Software Configuration Management tools for identification, control, status accounting, verification, audits, product release, delivery, preparing / migrating builds and deployments.

1.13.3.2. Manages all ID Card System environments and enforces strict version control process to ensure all environments are consistently configured.

1.13.3.3. Is responsible for managing and directing the system test activities for ID Card System implementation.

1.13.3.4. Determine and execute the contingency requirements and solutions to ID Card System and interface partners.

1.13.3.5. Determine integrated logistic support activities, roles, responsibilities, sequences and timelines.

1.13.3.6. Participate in the creation of procedure and communication material that document logistic practices.

1.13.4 Training Lead.

1.13.4.1. The Training Lead is responsible for the analysis, design, development, testing and deployment/fielding of training artifacts, guides, classroom instruction and Computer Based Training (CBT) offering in Dari, Pashtu, and English.

1.13.4.2. The Training Lead shall ensure quality control checks are built into the successful implementation of training plans, deliverable and strategies.

1.13.4.3. The Training Lead must understand and translate business requirements and the system configuration/solution into training artifacts for the ID Card System implementation, and has demonstrated experience and strong knowledge of software training development, implementation, and maintenance.

1.13.5 Fielding Lead.

1.13.5.1. The Fielding Lead is responsible for ensuring the training the Users and fielding of the ID Card System at various MoI and MoD locations for operation.

1.13.5.2. The Fielding Lead shall ensure quality control checks are built into the successful roll out of ID Card System and training of the Users.

1.13.5.3. The Fielding Lead must have the technical knowledge and concept of operation of the ID card system, and has demonstrated experience and strong knowledge of program implementation, and maintenance, including Help-Desk implementation and operation.

1.14. Identification of Contractor Employees: All contract personnel attending meetings, answering U.S. Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are U.S. Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor shall be responsible for obtaining security / identification badges for all employees within the scope of this PWS.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. Definitions:

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the U.S. Government. The term used in this contract refers to the prime.

2.1.2 Contracting Officer: A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the U.S. Government.

2.1.3 Contracting Officer Representative (COR): An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

2.1.4 Deliverable: Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.5 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6 Physical Security: Actions that prevent the loss or damage of U.S. Government property.

2.1.7 Quality Assurance: The U.S. Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

2.1.9 Quality Control: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with the PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. A draft is due 5 (five) days after contract award. The Contractor’s quality control program is the means by which they assure themselves that their work complies with the requirement of the contract. As a minimum, the Contractor shall develop quality control procedures that address the areas identified in the Section 5 and submit to the Contracting Officer for approval prior to the start of work.

2.1.10 Work Day: The number of hours per day the Contractor provides services in accordance with the contract.

2.1.11 Work Week: Sunday through Thursday

2.1.12 ID Card System terminal(s) with enrollment ability: MoD / MoI ID CARD terminal(s) that have the biometric capability to enroll person(s).

2.1.13 ID Card System terminal(s) with verification ability: MoD / MoI terminal(s) that have the biometric system to verify a person(s) biometric data.

2.1.14 Portable ID Card System terminal(s): The portable ID Card System terminal(s) will have the same capability to the fixed ID Card System terminal(s) that have the enrollment ability, with one exception. The portable ID Card System must be easily deployable to austere locations.

2.1.15 Initial Identification Card Replacement: ID Cards printed with the ID Card System under this acquisition, and issued to persons to replace the existing ID cards.

2.1.16 New Identification Card Creation: The new ID card created for persons upon graduation and official placement of new Soldier(s) or Patrolmen.

2.1.17 Replacement Identification Cards: These ID Cards will be issued to cover all expired, destroyed, lost ID cards, or cards that will expire within 6 months, following the Initial ID Card Replacement.

2.1.18 Level 3 Language Definition: Can translate texts that contain not only facts but also abstract language, showing an emerging ability to capture their intended implications and many nuances. Such texts usually contain situations and events which are subject to value judgments of a personal or institutional kind, as in some newspaper editorials, propaganda tracts, and evaluations of projects. Linguistic knowledge of both the terminology and the means of expression specific to a subject field is strong enough to allow the translator to operate successfully within that field. Word choice and expression generally adhere to target language norms and rarely obscure meaning. The resulting product is a draft translation, subject to quality control.

2.2. Acronyms:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: No services shall be provided.

3.2. Facilities: No facilities shall be provided.

3.3. Utilities: No utilities shall be provided.

3.4. Equipment: No equipment shall be provided.

3.5. Materials: No materials shall be provided.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED FACILITIES, SUPPLIES, EQUIPMENT, AND SERVICES:

4.1. Equipment: The Contractor shall acquire, install, maintain and provide any equipment required to accomplish tasks in the PWS. At termination of completion of the contract or designated transition, all equipment, software, and processes shall become the property of the U.S. Government.

4.2. Software: The Contractor shall acquire, install, maintain, and provide any additional software products needed to accomplish the tasks related to the PWS. Contractor shall coordinate with the U.S. Government to transfer all items purchased to the Afghan Government at completion of the contract. The Contractor shall analyze and implement commercially available solutions as well as Open Source software and hardware solutions when applicable to meet user requirements as provided by the Government of Afghanistan.

4.3. Data Rights: The U.S. Government retains unlimited data rights to all efforts and products developed in direct support of the ANDSF ID Card System effort, including but not limited to all software, source code and documentation, without any restrictions whatsoever by the Contractor. Does not include commercial off the shelf software that was not modified or customized to meet the requirements of this PWS.

4.4. Contractor Responsibilities: The Contractor is responsible for providing its employees with base life support and travel in order to achieve the objectives outlined in this PWS.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1. Documents and reviews:

5.1.1 Review within seven (7) days after contract award, the contractor shall conduct Post-Award Conference, where the contractor will present technical scope of work in accordance with authorizing documents and current understanding of project risk.

5.1.2 Reviews within thirty (30) days after contract award: The Contractor shall execute reviews with the Program Management Office (PMO) with supporting documentation for the following at a minimum:

5.1.2.1. Initial Baseline Review (IBR) shall cover the following items:

5.1.2.1.1. Key schedule milestones are identified

5.1.2.1.2. Supporting schedules reflect a logical flow to accomplish the technical work scope

5.1.2.1.3. Resources (budgets, facilities, personnel, skills, etc.) are adequate and available for the assigned tasks

5.1.2.1.4. Tasks are planned and can be measured objectively, relative to technical progress

5.1.2.2. Work Breakdown Structure (WBS) should be down to level 3 which includes the major elements listed in level 2 and all hardware and software services

5.1.2.3. Integrated Master Schedule (IMS) - An integrated and networked multi-layered schedule of program tasks required to complete the work effort captured.

5.1.2.4. Requirements Traceability Matrix (RTM) - The purpose of the RTM is to show where requirements, including the interface requirements, are satisfied by the design and the design is satisfied by the code. The RTM is also used to assist in the analysis of proposed changes. The RTM also shows where requirements are verified (tested) prior to fielding Requirements traceability refers to the ability to follow the life of a requirement, in both forwards and backwards direction, i.e., from its origins, through its development and specification, to its subsequent deployment and use, and through periods of ongoing refinement and iteration. Requirements traceability is used to capture the relationships between requirements, design, test, and implementation of a system.

5.1.3. Reviews within forty-five (45) days after contract award: The contractor shall execute reviews with the PMO with the following documentations at a minimum:

5.1.3.1. System Fielding Plan (SFP). The contractor shall include how they are going to field ID Card Systems to MoI and MoD; and conduct the following ID Card issues: Initial ID Card Replacement, New ID Card Creation, and Replacement ID Cards (See Para 1.4. Scope for more details).

5.1.3.2. Configuration Management Plan. The contractor shall create and maintain a software and hardware configuration management plan. The plan will include management of interfaces required to interoperate with AABIS, APPS/AHRIMS, and e-NID.

5.1.3.3. Preliminary Design Review (PDR) - The Preliminary Design Review (PDR) ensures the preliminary design and basic system architecture are complete, and that there is technical confidence the capability need can be satisfied within cost and schedule goals. The PDR provides the acquisition community, end user, and other stakeholders with an opportunity to understand the trade studies conducted during the preliminary design, and thus confirm that design decisions are consistent with the user’s performance and schedule needs prior to formal validation of the Capability Development Document (CDD). The PDR also establishes the system’s allocated baseline.

5.1.3.4. Functional Configuration Audit (FCA) - An audit formally examines that each configuration item meets the functional characteristics stated in its item performance specification. For a system as a whole, the audit examines the system functional characteristics has achieved the requirements in the allocated baseline.

5.1.3.5. System Requirements Specification

5.1.4. Reviews within sixty (60) days after contract award: The contractor shall execute reviews with the PMO with the following documentations at a minimum:

5.1.5. Monthly and Weekly requirements: The contractor shall provide the following:

5.1.6. Reviews within ninety (90) days prior to Initial Operational Capability (IOC) Date: The contractor shall execute reviews with the PMO with the following documentations at a minimum:

5.1.7. Thirty (30) days before IOC deployment and training, the contractors shall execute the following at a minimum:

5.1.8. The contractor shall provide meeting support as directed by the PMO.

5.2. System Capability:

5.2.1. System Interoperability: The contractor shall integrate the ID Card System with the following 3rd party systems at a minimum: AABIS, AAIMS, APPS, AHRIMS and e-NID aka: Electronic Taskira (e-Taskira).

5.2.2. The ID card System shall have the capability to take fingerprints and facial photos.

5.2.3. The ID card System shall have the capability to print ID Cards with anti-fraud security features. The security features of ID card will be in accordance with the ISO for ID cards. The security features may include, but are not limited to:

5.2.3.1. All information stored on the magnetic strip and 2D bar code will be encrypted.

5.2.3.2. Level of Inspection should be Level 2 (checked by a trained inspector with simple tools)

5.2.3.3. Cross-Link elements for a multi-layered approach

5.2.3.4. Laser Engraved Photo

5.2.3.5. Optically Variable Ink

5.2.3.6. Ultraviolet Luminescent Ink in card body, variable personalization and security laminate

5.2.3.7. Built in visual and electronic verification

5.2.4 APPS is based on the Odoo open source ERP platform. It has extensive sets of APIs that can be used by third party systems to communicate and speak with various modules within APPS allowing them to pass information and obtain information from APPS.

5.3. Card Production and Distribution:

5.3.1 Basic description of the ID Card:

5.3.1.1. Size for the ID Card in accordance with codified International Organization for Standards (ISO) in the specification document ISO 7810 (Identification Cards–Physical Characteristics). Referring to the card type as ID-1, the dimensions were defined as 3.370 inches wide and 2.125 inches high.

5.3.1.2. High Resolution Color Photo (standard passport dimensions).

5.3.1.3. At a minimum one additional image on the front and back of the card as decided by the respective ministries.

5.3.1.4. Magnetic Strip and Barcode capable of storing pertinent data for electronic verification of the card owner’s identity. Data should include the following:

5.3.1.4.1. AHRIMS Number

5.3.1.4.2. ID card number

5.3.1.4.3. TCN – biometric registration

5.3.1.4.4. Full Name

5.3.1.4.5. Father’s Name

5.3.1.4.6. Grandfather’s Name

5.3.1.4.7. Date of Birth (DOB)

5.3.1.4.8. Blood Type

5.3.1.4.9. Photo

5.3.2 The contractor shall produce and distribute an initial issue of ID Cards (500K cards) to the ANDSF. This is the process of replacing all legacy ANDSF ID Cards with the new ID cards.

5.4. Database Migration: The contractor shall migrate data from the legacy (existing) ID Card System database in MoI and MoD.

5.5. System Fielding:

5.5.1 MoI: The contractor shall deploy eighty-eight (88) ID Card Systems to the following locations as a minimum. This includes two (2) at each PHQ (68 total) and 20 locations at the central department(s) (11 for the mobile teams, 3 spares, and 6 at MoI).

5.5.2 MoD: The contractor shall deploy thirty seven (37) ID Card Systems to the following locations as a minimum. This includes two (2) systems and one (1) spare at each of the six (6) Corps Regional Training Center(s) (RMTC); three (3) systems for ANATEC; three (3) systems for ANAREC; and three (3) systems for the Kabul Military Training Center. MoD HQ’s will receive an additional ten (10) systems to replace the six (6) terminals associated with the old system with four (4) as a back-up reserve or traveling terminals if needed.

5.6. Training:

5.6.1 The contractor shall develop training manuals for the ID Card System in digital form and provide hard copies upon request or as appropriate for training. The contractor shall develop the training including the following as a minimum:

5.6.1.1. ID Card transactional processes

5.6.1.2. Analytical tools capabilities

5.6.1.3. Reports generation

5.6.1.4. Information assurance (IA)

5.6.1.5. Role-Based Training shall be developed to support distinct classes of users, and at a minimum, the training shall provide each class of users with all essential training and user manuals to perform their duties as listed below:

5.6.1.5.1. Operators: Personnel assigned to input, update, and manage individual and unit activities and transactions.

5.6.1.5.2. Leaders: Personnel who require the ability to review and/or approve operator transactions and activities and generate reports for their organization.

5.6.1.5.3. Audit and Inspectors: Personnel required to conduct audits of ID card data to ensure compliance with applicable policy and law governing all aspect of human resource management. i.e., Inspector General Personnel, internal, and external auditors.

5.6.1.5.4. Help Desk Operators (Tier I, II and III level): Personnel assigned to the ministry to provide real time responses to operators, leaders, and auditors/inspectors providing them with assistance in performing their duties or ensuring the system is available and ready for use.

5.6.1.5.5. Network Administrators: Personnel assigned to the ministry network operations center responsible for the day-to-day operations of the network, the ID Card System hardware and software components, and the connectivity required for all users to access the application.

5.6.1.5.6. System Administrators: Personnel assigned to the ministry or contractor responsible for the routine maintenance, sustainment, and upgrade of the ID Card System at all locations. This shall the database to ensure security, policy compliance, and make changes required to keep the ID Card System application.

5.6.1.5.7. Train-the-Trainer: Personnel at the ministerial level, PHQ and Corps levels, who will train all types of users (Operators, Leaders, Audit/Inspectors, Help-Desk Operators, Network Administrators and System Administrators).

5.6.1.6. Training Materials:

5.6.1.6.1. Contractor shall prepare materials to support an average class size of twenty (20) students per location for user and leader classes, and an average class size of ten (10) students for Administrator class. The exact number of student sizes for each type of user group will be determined prior to start of the training.

5.6.1.6.2. Contractor shall prepare the training materials in three languages: Dari, Pashtu and English.

5.6.1.7. Refresher Training: The contractor shall provide quarterly refresher training for database administrators, system administrators, and help desk operators at each ministry. This shall be a separately priced and optioned capability to be utilized at the sole discretion of the U.S. Government.

5.6.1.8. Language Requirements: Supervisory personnel and help desk operators at a minimum shall speak at a level 3 in Pashtu and Dari. Additionally, as deemed appropriate by the contractor it is preferred that of these positions have a level 3 understanding in English.

5.7. System Sustainment: The contractor shall be responsible for the sustainment and support of all hardware, software, and peripherals associated with the ID Card System during the PoP of the contract.

5.7.1 The contractor shall resolve sustainment and support issues from the time of receipt of the problem within 24 hours for 90% of the reported issues.

5.7.2 The contractor shall stand up Help Desk (Tiers I - III) and be fully operational no later than first deployment.

5.7.3 The contractor shall develop and maintain the following documents and artifacts, and transfer them to PMO and ANDSF at two different time periods. First will be ninety (90) days prior to Initial Operational Capability (IOC). Second submission will include any updates and will be submitted to the PMO before meeting Full Operational Capability (FOC).

5.7.4 System Architecture: Update and maintain the detailed system architectures to include:

5.7.4.1. System schematics

5.7.4.2. System and subsystem performance-based descriptions

5.7.4.3. Key interfaces

5.7.4.4. Hardware and Software Specifications: Update and maintain hardware and software specifications to include:

5.7.4.4.1. Sizing and performance requirements

5.7.4.4.2. Systems and subsystems

5.7.4.4.3. Interface control documents

5.7.4.4.4. Systems control requirements

5.7.4.4.5. Source code for any software development

5.7.4.5. Database and File Structures Maintenance: Update and maintain database and file structures to include:

5.7.4.5.1. Definitions of file characteristics

5.7.4.5.2. File layouts

5.7.4.5.3. Data dictionary

5.7.5 Preventive Maintenance Service Plan: The contractor shall develop and deliver, for US Government approval, a preventive maintenance service plan based on the hardware and software components developed and delivered as part of the ID Card System. Plan shall at a minimum shall include detailed requirements for routine and non-routine maintenance requirements. Preventative maintenance inspections and work shall be conducted on a weekly basis with a monthly report to the ministry and U.S. Government.

5.8. Security Control Assessment: The contractor shall develop and submit a Security Control Assessment Plan that defines the security methodology employed prior to the deployment of the system or any workstation. This plan shall be presented for approval to the PMO prior to implementation and before any updates/changes are implemented.

5.9. Information Security: The Contractor shall provide adequate security for all unclassified information passing through non-government information system(s) including all subcontractor information systems utilized on contract. Unclassified information shall only be disseminated within the scope of assigned duties and with a clear expectation that confidentiality will be preserved. Examples of such information include the following: non-public information provided to contractors, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

5.9.1 Safeguards: The Contractor shall protect government information and shall provide compliance documentation validating the requirements are being met. The Contractor and all utilized subcontractors shall abide by the following safeguards:

5.9.1.1. Do not process information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

5.9.1.2. Protect information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

5.9.1.3. Sanitize media before external release or disposal.

5.9.1.4. Encrypt all information that has been identified as controlled unclassified information when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as portable hard drives and digital optical disks, using Authorized Data-at-Rest encryption technology.

5.9.1.5. Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

5.9.1.6. Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and TLS. Encrypt organizational wireless connections and use encrypted wireless connection where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

5.9.1.7. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

5.9.1.8. Do not post information to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Web site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Web site itself or the application it hosts).

5.9.1.9. Provide protection against computer network intrusions and data exfiltration, minimally including the following:

5.9.1.9.1. Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

5.9.1.9.2. Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

5.9.1.9.3. Prompt application of security-relevant software patches, service packs, and hot fixes.

5.9.1.10. As applicable, comply with other current best practices of information protection and reporting requirements for specified categories of information.

5.9.1.11. Report loss or unauthorized disclosure of information in accordance with contract or agreement requirements and mechanisms.

5.9.2 The Contractor shall ensure in their quality processes and procedures are compliant with standard best practices security requirements.

5.10. REPORTING:

5.10.1 Reports should be generated on a daily, weekly, monthly, and yearly basis with the exception of the audit reports which is on an as needed basis as per the deliverable schedule.

5.10.2 Reports shall be generated automatically via the ID card system, including but not limited to:

5.10.2.1. Initial ID Cards issued

5.10.2.2. Number of ID Cards destroyed

5.10.2.3. Number of ID Cards replaced due to expiration

5.10.2.4. Number of ID Cards replaced due to loss

5.10.2.5. Operational Audit Reports

5.11. PERFORMANCE REQUIREMENTS SUMMARY: The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Stakeholder Input

Inspection of Contractor file by the COR/KO

Stakeholder Input

Stakeholder Input

Stakeholder Input

Stakeholder Input

Inspection of Contractor file by the KO

Acceptable surveillance methods:

100%Inspection and File Review: Performance is inspected/evaluated at each occurrence. This method is necessary due to health, safety and other considerations.

Random Inspection: This method will be used as an efficient way to obtain an unbiased, comprehensive evaluation of performance. Some task/deliverables will be randomly selected to determine if the level of performance is acceptable.

Observation: This method will be used to document relatively few observations from which the quality the task can be consistently projected from one observation period and throughout the next.

Periodic Inspection: This method will be used to check the Contractor’s quality control to ensure the Contractor is capable of meeting the Government’s quality requirements. Inspection may vary based on the Contractor’s compliance to the PWS requirements; the frequency may increase or decrease based on inspection findings.

Stakeholder Input: Stakeholder input can be used when written or telephonic evidence is provided and substantiated by the COR/KO in certain situations when the quality of performance poses a risk to the contract.

5.12. Deliverables Schedule:

1.

2.

3.

4.

5.

5.1.

5.2.

5.3.

5.4.

5.5.

5.6.

Post-Award Conference 5.1.1

Initial Baseline Review (IBR) 5.1.2.1 Work Breakdown Structure (WBS) Integrated Master Schedule (IMS) Requirements…