DHS TSL ITSS Draft SOW 70RSAT25RFI000012 (20250616).pdf

DRAFT

PIID: 70RSAT25RFI000012

Draft Statement of Work

UNITED STATES DEPARTMENT OF HOMELAND SECURITY

SCIENCE AND TECHNOLOGY DIRECTORATE

OFFICE OF NATIONAL LABORATORIES

TRANSPORTATION SECURITY LABORATORY

INFORMATION TECHNOLOGY SUPPORT SERVICES

DRAFT STATEMENT OF WORK

1.0 GENERAL

Background

The mission of the United States Department of Homeland Security (DHS) Directorate of Science and Technology (S&T) Office of National Laboratories (ONL) Transportation Security Laboratory (TSL) is to apply our scientific and technical acumen to advance explosives and contraband detection technologies for the Homeland Security Enterprise (HSE). Established in 1992 at the William J. Hughes Technical Center, Atlantic City Airport in New Jersey, the TSL’s 20-acre secure campus includes specialized explosive storage and handling areas and a multi-scientific laboratory infrastructure designed for test and evaluation of technology for explosives and contraband detection and blast mitigation.

With its staff of federal employees and contractors including physicists, chemists, engineers, and mathematicians, the TSL is internationally recognized for its unique ability to advance detection technology from conception to deployment through applied research, test and evaluation, assessment, and certification testing.

1.1 Scope

The scope of work for this acquisition includes labor, supplies, equipment, and materials necessary to provide technical support services to the TSL and alternate locations such as the Detection Technology Center (DTC): Approximately 146 Contractor personnel and 60 Federal personnel at TSL with 18 other personnel at alternate locations. This includes enterprise information technology infrastructure and helpdesk support, Network Attached Storage (NAS) configuration and support, Microsoft and Linux Network systems administration, IOS, iPadOS, macOS administration, container-based development environments, management and storage of source code, Share Point development, and software and database development.

These functions provide support to all divisions and areas within the TSL domain. The technical support will be in accordance with the task requirements outlined in this Statement of Work (SOW). Generally, support for alternate locations such as DTC will be conducted remotely however occasional, ad-hoc travel may be necessary.

1.2 Objective

The objective of this project is to provide the TSL with essential support services that are not

Draft Statement of Work inherently governmental and may require a level of effort that is not sufficiently consistent to warrant additional staffing with federal employees. The intent is to maximize the efficient use of TSL assets in support of the Homeland Security mission by ensuring appropriate support resources are in place to effectively manage IT resources, to support known and future software and database development efforts, and to provide laboratory wide IT helpdesk support services including end user account administration and support, network administration of multiple independent and secure networks.

1.3 Applicable Documents

The contractor shall comply with requirements of the following documents, updated as required, to meet the requirements of this contract:

• National Industrial Security Procedures Operation Manual (NISPOM);

• 49 CFR 1520 Protection of Sensitive Security Information;

• DHS IT Security Program Publication DHS MD 4300.Pub;

• TSL Publication Guidelines;

• DHS/S&T/TSL Document Format Templates;

• DHS Instruction 121-01-011;

• HSAR Class Deviation 15-01 Safeguarding of Sensitive Information; and

• DHS S&T Explosives Research and Development Program Security Classification Guide, DHS SCG S&T-006, (current version).

These reference documents can be accessed through an Internet search engine except the DHS SCG S&T-006 and the DD-254. These two documents will be provided after award.

1.4 Reference Documents

The following documents will be reviewed by the contractor in performing the work described in the SOW and will be provided upon award or post-award:

• DD 254;

• TSL Management Directives; and

• TSL Management Instructions.

1.5 Performance Requirements Summary

This contract includes a Performance Requirements Summary (PRS) in section 10.0. The PRS plays an integral role in the administration of the contract. In addition to any applicable inspection clauses or other related terms and conditions contained in the contract, the PRS shall serve as a primary tool for inspection and acceptance of services as facilitated by the Contracting Officer’s Representative (COR) and alternate COR. Evaluation of the contractor’s overall performance shall be in accordance with the performance standards set forth in the PRS, and will be conducted by the COR/alternate COR. The PRS constitutes a material aspect of the contract and will not be changed or otherwise modified without prior written approval of the Contracting Officer.

Draft Statement of Work

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Information Technology and Helpdesk Support

As an active federal research laboratory, the TSL generates a significant quantity of data and reports. These are designated as Sensitive Security Information (SSI), For Official Use Only (FOUO), Classified, or For Public Release. The TSL is heavily dependent on the data that is developed during testing at on-site and at off-site locations and the subsequent reports which are generated during that testing in order to perform the mission and support the TSL customers.

Additionally, the federal and on-site support staff depend on connectivity to the internet and DHS intranet to conduct day-to-day business. To support this work, the contractor shall:

2.1.1 Provide end user helpdesk support for local IT issues to include:

2.1.1.1 In person and remote (e.g., telephone, MS Teams, or other approved access tools) support for government-owned and/or issued IT products including laptops, desktops, monitors, hard drives, mobile phones, etc. The contractor shall also assist and support government-owned laboratory instruments/computers, connections, data backup, and operations (e.g., software installs). Limited support shall also be provided for vendor owned equipment such as support interfacing, data transfers, etc.;

2.1.1.2 In person and remote support, including installation, configuration, troubleshooting, and working with S&T Headquarters (HQ) for all DHS-owned and/or approved issued software requests using manual or remote install/updates, Microsoft Endpoint Configuration Manager or other supported methods;

2.1.1.3 In person and remote support for network connectivity request;

2.1.1.4 Maintain all workstations in Microsoft Endpoint Configuration Management

System, install updates, vulnerability management and other associated function;

2.1.1.5 Image workstations for deployment on all networks and monitor images for completeness;

2.1.1.6 Supplement missing software and patches as required. This includes unclassified and classified standalone workstations for use in special case and secure rooms and areas;

2.1.1.7 Build and configure custom Linux and Windows workstations for data collection and analysis;

2.1.1.8 Install, maintain, and gain authorization for installation of Commercial Off The Shelf (COTS) and custom vendor software and update as needed to latest versions;

2.1.1.9 Work with OEM and third party vendors to provide support, updates, resolve issues and fixes to software including connection to networks as required;

2.1.1.10 Work with TSL Federal staff for IT hardware refreshments for End Of Life equipment as needed, generally every 3-4 years;

2.1.1.11 Support all cloud-based software systems and maintenance;

Draft Statement of Work

2.1.1.12 Design and provide end user support for automation of Microsoft Office applications to streamline TSL processes and increase efficiency and data management;

2.1.1.13 Recommend software and hardware upgrades for users’ existing programs and systems;

2.1.1.14 Suggest innovative solutions to resolve or enhance operations; and

2.1.1.15 Manage group Software Licenses as needed for common software.

2.1.2 Communications and Video Teleconferencing (VTC) equipment maintenance and support activities including:

2.1.2.1 Deploy, configure, maintain, and troubleshoot various communications equipment in use at the TSL. This includes:

a. Government issued cellular phones and devices (i.e. range extenders, wireless access points, etc.);

b. Wired and Wireless Connections, Encryption, Virtual Private Network

(VPN), and other hardware devices and software for on and off local network connections;

c. Maintain, update and troubleshoot VTC and presentation systems throughout TSL campus. Main Conference Room(s) and one Secure Conference room have VTC and presentation systems, and four additional conference rooms, which have presentation systems only;

d. Provide audio visual support (e.g., microphones, enable closed captioning, ensure IT-related accessibility needs are met, etc.) for presentations as required;

e. Move and/or setup up IT-related hardware (e.g., phones, PC, etc.) and software for new or existing laboratory staff; and

f. Support and repair land line analog and digital telephones and related equipment (e.g., cellular extenders).

2.1.1.16 Support wireless access zones throughout the TSL campus

2.1.3 Maintenance, utilization, and management of end user helpdesk ticket system

(currently in SharePoint) to ensure that all end user requests for assistance are accurately tracked, routed, and responded to or escalated as needed.

2.1.3.1 Optimize, redevelop, and/or improve current IT ticket system to better respond to customer needs and be more informative to the ticket submitter.

Include current status, delays, issues, escalation to S&T or other entity with details as needed or at the direction of the Technical Monitor (TM).

2.1.4 Support and administration for Property and Asset Management to include:

2.1.4.1 Assume the role of the IT Property Custodian (PC) under the TSL

Accountable Property Officer (APO);

Draft Statement of Work

2.1.4.2 Add new IT related assets to inventory and obtain all paperwork regarding acquisition;

2.1.4.3 Place into excess inventory all IT assets that have reached end of life;

2.1.4.4 Track, maintain, and notify users of property pass expirations for all TSL laboratory personnel;

2.1.4.5 Maintain and track inventory changes via TSL Inventory Database as well as the Sunflower Asset Management System (SAMS) database at S&T HQ for IT assets;

2.1.4.6 Maintain and support inventory scanners, hardware, and software products used in the collection of inventory information;

2.1.4.7 Research and assist with the purchase and budgeting of IT hardware and software; and

2.1.4.8 Maintain records for all software and IT related subscriptions and provide notifications well in advance of expiration dates in order to ensure that there is no lapse in service or support. Examples include OriginPro, MATLAB, LS- DYNA, COMSOL, Red Hat Enterprise Linux (RHEL), and others.

2.1.4.8.1 The contractor shall ensure software is kept up to date to address security issues.

2.1.4.8.2 The contractor shall recommend to the government adjustments to the quantity of software licenses to meet end user needs.

2.1.4.8.3 The contractor shall recommend software to enhance the efficiency of the TSL and will perform the necessary market research if requested by the TM.

2.1.4.8.4 Maintain/distribute licensing for vendor software, update software, submit for Software Exception Request (SER) as necessary to gain approval for network access and installation.

2.1.4.8.5 Research, test, and verify proper deployments, functioning of software patches and fixes and remediate as necessary.

2.1.5 Data Storage and Transfer activities including:

2.1.5.1 Configure and maintain Network Attached Storage (NAS) drives for lab data collection;

2.1.5.2 Configure and maintain TSL Network Attached Storage (TSLNAS) for archiving lab data to primary and duplicate Dell Power Scale Petabyte storage solutions;

2.1.5.3 Assist laboratory staff in uploading and organizing data on TSL storage devices, approved third party IT resources, and/ or Government-owned IT equipment/instruments to the TSLNAS or other location as required to meet laboratory needs;

2.1.5.4 Migrate data to and from various IT equipment and perform system backups, as required, to maintain data integrity;

2.1.5.5 Recover and restore files from backups as required;

2.1.5.6 Maintain archives of all user and laboratory data;

2.1.5.7 Configure and maintain closed loop networks to interconnect laboratory

Draft Statement of Work equipment for data storage and backup;

2.1.5.8 Perform data recovery from failed equipment, both encrypted and non-encrypted;

2.1.5.9 Deploy research and recommend refreshment desktops and laptop systems for

End Of Life, failed, and replacement systems; and

2.1.5.10 Perform and/or assist with data transfer of DHS data and work products to approved DHS partners via DHS-approved means such as the use of NAS drives, hard drives, cloud-based transfer, etc.

2.1.6 Security Updates and System Patching duties including:

2.1.6.1 Identify and update Government-owned or issued devices and/or workstations that have critical vulnerabilities and or security issues

2.1.6.2 Advise users on security procedures and verify conformity

2.1.6.3 Maintain and update hardware to meet security policy dictated by S&T HQ

2.1.7 Provide hardware life-cycle support/end of life replacement to include hardware installations and upgrades such as graphics cards, memory chips, external devices, and other small hardware items and peripherals.

2.1.8 Provide support for printers/multi-function printers such as changing toner, installing drivers for users, maintaining network connection, and maintaining printer supplies.

The TSL has ~ 20 network printers/multifunction printers located through the TSL campus and several small desktop printers in cubes for printing more restricted documents.

2.1.9 Provide maintenance of TSL local IT Systems & equipment and support connectivity and troubleshooting functions related to TSL Headquarters mandates.

2.1.10 Create/establish and update as needed both SciTech and Labnet user accounts at the

TSL for all TSL federal and contractor personnel.

2.1.11 Education of staff members through training and individual support for software and hardware applications.

2.2 Network and Hardware Support and Administration

2.2.1 Maintain Networks

2.2.1.1 Ensure, maintain, and optimize the health and availability of all networks that TSL is dependent on, including:

2.2.1.1.1 LAN A, LAN B, LAN C, SciTech, Labnet, Wireless, Closed Loop, Lab Equipment, Cloud Based, Building Management, Security (including access points and camera systems), PIV, Homeland Secure Data Network (HSDN), Homeland Security Information Network (HSIN), internal land

Draft Statement of Work line telephone network, cellular extenders, electronic mail, high performance clusters, and Printer and Print Servers

2.2.1.2 Promptly identify and resolve network issues as they occur

2.2.1.3 Work with S&T HQ to deploy fixes and rectify issues.

2.2.1.4 Work with external agents as needed in order to maintain infrastructure integrity

2.2.1.5 Escalate all identified issues as appropriate

2.2.1.6 Upgrade and maintain network infrastructure when required.

2.2.1.7 Configuration and management of networking technologies (OSI network layers, TCP/IP).

2.2.1.8 Administration, performance tuning, and system monitoring

2.2.1.9 Verify stability, interoperability, portability, security, or scalability of system architecture.

2.2.2 TSL Laboratory Asset support including:

2.2.2.1 Assist in the installation and maintenance of IT-related resources for laboratory equipment/instruments

2.2.2.2 Connect laboratory equipment/instruments to current IT infrastructure or other equipment as required

2.2.2.3 Install custom software and assist vendor with updates

2.2.2.4 Direct connections of Vendor Equipment, emulators, and test equipment to TSL

NAS, NAS and other devices for data storage. Backup NAS and other equipment, recover data, etc. as need to requested by the TM

2.2.2.5 Configure and interface TSLNAS with vendors test imaging and scanning systems

2.2.3 Secure Rooms

2.2.3.1 Copy and move data between secure workstations

2.2.3.2 Maintain logs

2.2.3.3 Oversee destruction of digital media and documents in accordance with

ISO/National Institute of Standards and Technology (NIST) regulations

2.2.3.4 Serve and act as the backup for ISSO (Information System Security Officer) duties as required.

2.2.3.5 Assist the government with investigation, cleanup, and remediation of data in the event of a classified spill or other unauthorized disclosure event.

2.2.4 User Account Management activities including:

2.2.4.1 Maintain and update users accounts in Active Directory (AD)

2.2.4.2 Grant users network access and assign permissions and network memberships

2.2.4.3 Update user, machine, mobile phone, and other certificates to allow network access

2.2.4.4 User PIV Card maintenance

2.2.4.5 Issue and track Property Passes for users to remove DHS owned equipment from the TSL

2.2.4.6 Maintain security paperwork for users’ property upon their exit and verify its return

2.2.4.7 User migration between networks and updates to email and servers as required or

Draft Statement of Work requested by the TM

2.2.5 Write, update and maintain standard operating procedures (SOP) that details the steps required to regain Local Area Network access in the event of network failure. The SOP should be sufficiently detailed so that if the individual mainly responsible for network administrator functions or their designee is not available, that any minimally qualified technician may restore network services. The SOP shall be treated as Security Sensitive Information and distribution shall be controlled and restricted. In addition, write update and maintain SOPs for installation, repair, troubleshooting and other aspects of normal operations for software and hardware.

2.2.6 Review current network configuration and implementation at TSL main location and satellite locations. Recommend upgrades and suggest improvements to enhance current IT infrastructure. Implement noted upgrades and improvements as directed by the government and in conjunction with S&T Engineering teams.

2.3 Software/Database Development and Administration; Special Projects

The contractor shall serve as TSL’s agent for cataloging, storing, retrieving and generating a variety of information, documentation, and briefings. The contractor shall be responsible for developing, administering, and maintaining a wide variety of custom software, request systems, and database products by gathering user requirements and then analyze, design, and develop software to meet those requirements. The contractor shall be able to design and develop solutions to complex applications problems, system administration issues, or network concerns and perform systems management and integration functions. Additionally, the contractor shall be responsible for the installation, configuration, and troubleshooting of Linux-based systems and high-performance computational clusters.

The contractor shall deploy and manage Sharepoint server on premise and/or Office 365 Enterprise, taking advantage of latest features and capabilities, modernize site pages, web parts and authorization.

The contractor shall analyze and design databases within an application area, working individually or coordinating database development as part of a team including systems analysts, engineers, and other programmers.

Additionally, the contractor shall ensure that all projects are properly planned, scoped, and that anticipated timeframes and/or milestone schedules are provided to the government and agreed upon prior to commencing work. Consideration shall be given to ensuring that proper resources are attributed to each project and that priorities are established and managed when multiple projects are being conducted.

Duties shall include:

2.3.1 Support, Troubleshoot and maintain System/software life-cycle to include development and maintenance of systems, applications and tools including software

Draft Statement of Work enhancements, databases, database maintenance, test and evaluation systems, Training systems maintenance, automation and backup, and keep and maintain information systems security.

2.3.2 Design strategies for enterprise database systems and set standards for operations, programming, and security. Design and construct large databases of various types.

Integrate new systems with existing warehouse structure and refine system performance and functionality. Examine and identify database structural necessities by evaluating operations, applications, and programming. Assess database implementation procedures to ensure they comply with internal and external regulations. Prepare accurate database design and architecture reports for management and stakeholders. Oversee the migration of data from legacy systems to new solutions.

2.3.3 Data management functions and the maintenance of software resources including the removal of outdated/duplicate/unnecessary files to ensure optimum performance and reliability. The contractor shall conduct the creation of models and diagrams showing programmers the software code needed for an application and ensure that programs continue to function normally through software maintenance and testing. Proper detailed documentation is required as a reference for future maintenance and upgrades.

2.3.4 Maintain software tools and utility development to include providing unique capability (i.e. VBA for macros) working with off the shelf applications such as Adobe, Excel, Access, PowerPoint, Teams and other Microsoft and DHS applications. Databases, briefings, spreadsheets and documents shall be developed from these applications to provide information and information management tools.

This includes the Local Area Network (LAN) and web administration, application training, electronic and paper file management, and Documentation of TSL IT department system and procedures.

2.3.5 Infrastructure support for Machine learning and Artificial Intelligence support for projects, including Docker, Kubernetes, RedHat, and associated technologies. Linux support with GPU and systems. Responsibilities include:

2.3.5.1 Linux administration and desktop support.

2.3.5.2 Ability to package and ship programs and code via a container platform

(e.g. Docker).

2.3.5.3 Configure and maintain infrastructure to ensure packaged containers can interface with current IT infrastructure (e.g. TSL NAS, GPUs).

2.3.5.4 Configure and maintain tools to deploy, scale, and manage containers.

2.3.5.5 Develop and maintain a repository for tracking and storing source code such as GitLab, GitHub and similar repositories.

2.3.5.6 Creation of scripts (e.g. using Perl, Ruby, Python) and setting up software for automation.

Draft Statement of Work

2.3.6 Infrastructure support for high performance computing projects. Responsibilities include:

2.3.6.1 Administration of the cluster(s) and desktop support.

2.3.6.2 Ensuring optimal system performance, reliability and scalability.

2.3.6.3 Creation of scripts and setting up software for automation, such as the automated scheduling of computational jobs.

2.3.6.4 Configure and maintain infrastructure to ensure computational packages can be utilized to their optimal capabilities by laboratory users.

2.3.6.5 Assist as needed to ensure TSL laboratory staff can access computational resources from other government agencies (e.g., DoD) or government approved cloud-based sources as required or directed by the TM.

2.3.7 Several special, short-term projects will be underway or will be launched by the TSL during the course of the contract that the contractor shall be responsible for advising, planning, implementing, maintaining, developing and/or refining Examples of these projects include the Project Deliverables Tracking System, the Procurement Request Database, the Contracts Database, and X-ray CT augmentation tool (XCAT). Other projects of this nature will be required as well.

2.3.7.1 Project Deliverables Tracking System. The contractor shall conduct a review of the current systems in place and make recommendations as to whether to optimize the existing framework to maintain and update, as needed, the current SharePoint system for managing the workflow and tracking of document-based deliverables or to develop a new system for the same purpose. The Project Deliverables Tracking System enables TSL federal or contractor staff to upload an item for review, enable the Business Operations support staff to assign or manage workflows, and enable the deliverable to be assigned for technical report processing. The Tracking System provides the ability to obtain reports on overall processing time for deliverables by POC, functional group, or document type to enable optimization of TSL processes.

2.3.7.2 Procurement Request database. The contractor shall conduct a review of the current systems in place and make recommendations as to whether to utilize the existing framework to maintain and update, as needed, the current system for managing the workflow and tracking of procurement requests or if a new system should be developed. The Procurement Request database is the system that has been developed for the purpose of tracking PR activity originating from the TSL. It also houses a document repository for all related acquisition documents. The government would look to replace the current system or expand upon the functionality of the existing system.

2.3.7.3 Contracts Database. The contractor shall perform an assessment of all contract related systems, repositories, and documents that are utilized by the TSL during the lifecycle of a contract. The results of the assessment shall be used to provide recommendations regarding the development of a

Draft Statement of Work customized contract management platform for use by TSL employees or the use of comparable COTS programs if appropriate. The intent of the platform is to provide a centralized, network agnostic system (accessible for SciTech and LANA users) for use by authorized TSL employees for managing contracts and related documentation. The platform shall be able to capture and display information related to all phases of the contract management lifecycle, including:

2.3.7.3.1 Contract inception information including funding

information, TSL PR number, STPR number, contract documentation (SOW, IGCE, etc.), contact information, description of effort, stakeholders, etc.

2.3.7.3.2 Contract management information including awarded

amount, CO contact information, invoicing information with amounts and copies of the documents, PRISM number(s), modification number(s) and descriptions with copies of the documents, deliverables, contract travel, contract personnel information, etc.

2.3.7.3.3 Contract closeout information including fields to

capture V&V and de-obligation information and documents, CPARS related information, etc.

2.3.7.4 XCAT – XCAT is a Python-based software application developed by the

TSL. It enables the design, manipulation, and insertion of threat objects into previously scanned luggage. The properties of the threat object (e.g., computed tomography number, Z-effective, density) are retrieved from a library and digitally placed in the desired location within the luggage. The image is then reconstructed by back calculating the corresponding sinogram, followed by forward projection of the correct images based on the explosive detection technologies (EDTs) settings and material properties, ensuring accurate capture of the X-ray scattering characteristics. The contractor will be responsible for the continued development of the software, which includes fixing bugs; optimizing the image generation process through parallelization and GPU configuration;

coding and installing the software onto networked computers; improving the graphical user interface; enhancing the software based on requested changes from the test and evaluation teams; and collaborating with physicists to incorporate new system parameters based on the configuration of additional EDTs. This work will require the contractor to perform the above requirements in addition to the following:

2.3.7.4.1 Create and improve software applications, ensuring the ability to expand existing systems to meet evolving requirements.

2.3.7.4.2 Focus on developing robust software that can handle errors gracefully and continue functioning effectively.

Draft Statement of Work

2.3.7.4.3 Design and implement scalable solutions that can

handle increased demand and automate processes to improve efficiency.

2.3.7.4.4 Establish and support multiple platform versions of software packages to ensure compatibility across various systems.

2.3.7.4.5 Develop, improve, and deploy Diffusion models and

other AI/ML algorithms to generate synthetic images.

2.3.7.4.6 Design and assess tools for evaluating the quality and accuracy of synthetic images.

2.3.7.4.7 Apply knowledge of gaming development and virtual

environments (e.g., Blender) for creating and manipulating 3D models and synthetic visuals.

2.3.7.4.8 Conduct tests to ensure the accuracy, functionality, and performance of the software and synthetic image generation systems.

2.3.7.4.9 Write and maintain detailed test plans for software validation and performance assessment.

2.3.7.4.10 Analyze user feedback and performance data to identify areas for improvement in software and image generation models.

2.3.7.4.11 Implement refinements and updates to applications

based on feedback and test results to improve user experience and performance.

2.3.7.4.12 Collaborate with other teams to integrate AI models, gaming development, and virtual environment tools into the overall system.

2.3.7.4.13 Continuously monitor and optimize the performance of AI models and synthetic image generation systems.

2.3.7.4.14 Perform software or computer engineering analyses and interface with security-related systems to assess the potential for further development, integration, and usefulness in the intended environment.

2.3.7.5 When possible and advantageous, the platform shall interface with existing systems in use within DHS S&T (S&T PR Tracker, STATS, etc.)

for the purposes of pulling relevant data (PR numbers, contract numbers, financial information, etc.)

2.3.7.6 Optimize, redevelop, and/or improve current IT ticket system to better respond to customer needs and be more informative to the ticket submitter.

Include current status, delays, issues, escalation to S&T or other entity with details as needed or at the direction of the Technical Monitor (TM).

2.3.7.7 Maintain and update current TSL SharePoint site and applicable user request systems to ensure they meet end-user requirements and retain software/hardware compatibility with TSL IT infrastructure.

Draft Statement of Work

2.3.8 The contractor will support other relevant and within scope activities as identified by the COR/alternate COR throughout the life of the contract.

3.0 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

The Contractor shall provide experienced and qualified personnel with all the skills necessary to perform the work identified. All Contractor personnel must have a security clearance at the SECRET level as well as DHS Suitability in order to perform work under this contract.

Required experience levels, training, qualifications, licenses, security clearances, DHS Suitability, or certifications must be obtained prior to commencement of work at Contractor expense.

3.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 Labor Categories and Key Personnel

The Contractor shall provide resumes of all key personnel designated in this SOW. The contractor shall notify the CO, COR, and alternate COR prior to making any change in the individuals identified in the proposal and/or assigned to this contract. Before replacing any individual designated as Key by the Government, the contractor shall notify the Contracting Officer, COR and alternate COR no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The contractor shall not replace Key contractor personnel without approval from the Contracting Officer.

The following table lists contractor personnel that are designated as Key for this requirement.

Note: The Government may designate additional contractor personnel as Key at the time of award.

TABLE 1

Labor Category FTE Project Manager Level II 0.1 Cloud SME Level III 1.0

Draft Statement of Work

Systems Engineer Level III 1.0 Applications Developer Level III 1.0 Systems/Data Architect Level III 1.0 TOTAL KEY FTEs 4.1

The following table lists contractor personnel that are non-Key for this requirement. General position descriptions for the required labor categories can be found in Attachment III – Labor Category Descriptions.

TABLE 2

Labor Category FTE Systems Engineer Level III 1.0 O&M System Engineer Level II 1.0 Applications Developer Level II 2.0 TOTAL NON-KEY FTEs 4.0

3.4 Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

3.5 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

Draft Statement of Work

3.6 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract.

The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

3.7 Non-Disclosure Agreements

All contractor personnel are required to sign non-disclosure agreement (DHS Form 11000-6) upon starting work and as deemed necessary under this contract to protect proprietary and/or source selection information.

4.0 OTHER APPLICABLE CONDITIONS

4.1 Security

The contractor will have access to DHS information systems. Contractor access to classified information may be required under this SOW. The maximum level of classification is Secret.

The details will be specified in a DD Form 254.

FAR clause 52.204-2 Security Requirements Clause (prescribes requirements, restrictions, and other safeguards that are necessary to prevent unauthorized disclosure of classified information and to control authorized disclosure of information released by the U.S. Government Executive Branch Departments and Agencies to their contractors; the proscribed Federal guidance is the National Industrial Security Program Manual [NISPOM]).

DHS has and will exercise full control over granting, denying, withholding, or terminating unescorted Government facilities and/or sensitive Government information access for Contractor employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the contractor to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment contractor fitness (suitability) authorization will follow as a result thereof. The granting of a favorable EOD decision or a full contractor fitness (suitability) authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the task order. No employee of the contractor shall be allowed unescorted access to a Government facility, access to any sensitive information or access to DHS IT Systems without a favorable EOD decision or contractor fitness (suitability) determination by the DHS Office of Security.

Contract employees assigned to the task order not needing access to sensitive DHS information, DHS systems or access to DHS facilities will not be subject to security contractor fitness

Draft Statement of Work

(suitability) screening. Contract employees waiting for an EOD decision may not begin work on the contract/task order.

DHS has determined the contractor and/or subcontractor employee access to CUI or government facilities does have to be limited to U.S. citizens and lawful permanent residents. Contractor will require recurring access to government facilities. Limited access to Government buildings is allowable prior to the EOD decision if the contractor is escorted by a government employee.

This limited access is to allow contractors to attend briefings, nonrecurring meetings, and begin transition work. Classified information is Government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the contractor has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility. If the contractor is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

Contractor will be required to access controlled unclassified information (CUI) in the form of Sensitive Security Information (SSI) under this SOW. Examples of SSI that the Contractor may access includes but not limited to, certain protected threat identification and properties and millimeter wave simulant formulations. Contractor will not be required retain CUI on behalf of the government. CUI will be kept in accordance to federal records schedule. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

Contractors will use DHS SharePoint, SciTech, LabNet, and Homeland Security Data Network (HSDN) to collect, process, store or transmit any controlled unclassified information in connection with this SOW. SSI will/will not be shared with any third parties.

In addition to the incident reporting requirements in HSAR 3052.204-72(c), contractors and subcontractors shall report, within 24 hours, all known or suspected incidents (e.g., Privacy, security, IT, classified spill, etc.) to the following entities: S&T Incident Reporting E-mail:

STIncidentReporting@st.dhs.gov.

Research work must be conducted in accordance with DHS privacy policies, to include the Fair Information Practice Principles (FIPPs). DHS privacy policy requires that privacy sensitive research programs and projects complete a Privacy Threshold Analysis (PTA). The PTA is a living document, which must be updated if there are changes to the activity, changes to data sets, user access to the data, and/or the technology and systems used. Additionally, the DHS Chief Privacy Officer schedules completed PTAs for mandatory review at least every three years. The project or activity will not be in compliance with Departmental privacy requirements until all necessary privacy compliance documentation requirements have been completed. Prior to any connectivity being established to DHS systems or access being granted, the performer and the S&T PM shall meet with S&T CIO and Privacy to clarify and refine the minimum set of requirements and access controls necessary for this effort. The performer must ensure compliance with NIST-800 Rev 5 and DHS 4300A security and privacy requirements, including the completion of an authorization to operate (ATO). These requirements collected by S&T CIO and S&T Privacy will drive the actual IT connections that are authorized.

mailto:STIncidentReporting@st.dhs.gov

Draft Statement of Work

The S&T program office will facilitate engagement with the respective DHS legal and Compliance Offices (to include, but not limited to, privacy, security, and the Compliance Assurance Program Office) to ensure adherence to applicable statutory requirements and DHS policies and guidance.

Secure Software Compliance

The purpose is to provide the Federal Government assurances that software used by agencies is securely developed and the Federal Government understands exactly what the constituent components of said software through an industry accepted reporting format. This information may be disclosed as generally permitted under Executive Order 14028, Improving the Nation’s Cybersecurity (E.O. 14028) and Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices” (M-22-18), as amended. This form collects contact information from vendor employees who make the attestation. Cybersecurity and Infrastructure Security Agency (CISA) has produced a Self- Attestation Common Form that is used and can be found here. It addresses numerous topics such as: the background on the requirement; what software is within scope; how attestation is to be performed; who is to sign the form; how compliance is to be demonstrated and other administrative items such as submissions for the same software to another Federal agency.

Software used in the process of adding capabilities to a government project must follow the latest FAR regulations regarding identifying all coding libraries used to build any capability used in a government project. All code must be verified by the provider by way of a Letter of Attestation indicating the code (including all code libraries) developed by the software producer presently makes consistent use of the secure software development framework (SSDF) and is free of defects and does not have viruses, flaws or other imperfections that would cause harm.

All code and associated libraries are to be listed on a Software Bill of Materials (SBOM) in an industry standard format such as Software Package Data Exchange (SPDX), CycloneDX, or Common Platform Enumeration (CPE). The SBOM is a chained inventory that lists and records software components, effectively showing an entire supply chain.

Note: A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management. A SBOM is a nested inventory, a list of ingredients that make up software components.

The contractor shall adhere to all applicable government laws, regulations, orders, guides, and directives pertaining to classified, Sensitive but Unclassified (SBU), FOUO, or personally identifiable information. The contractor shall safeguard SBU, FOUO information specifically in accordance with the DHS Management Directive 11042.1; and DHS Instruction 121-01-011.

Foreign end products and services are not applicable to this SOW.

If applicable, contractor support will not be needed for the completion of any privacy compliance documentation.

Draft Statement of Work

4.2 Access to DHS Facilities and Resources

DHS may exercise full control over granting, denying, withholding, or terminating unescorted access to DHS facilities, DHS systems, and/or sensitive DHS information for government/con-tract employees. Access will be based upon the results of a DHS fitness/suitability investigation.

DHS may, as appropriate, make favorable entry of duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the government/contract employee to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full DHS fitness/suitability authorization will follow. The granting of a favorable EOD decision or a full DHS fitness/suitability authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the BPA/task order. No employee of the government/contractor shall be allowed unescorted access to a DHS facility, access to any sensitive DHS information, or access to DHS Systems without a favorable EOD decision or DHS fitness/suitability determination by the DHS HQ Office of Security. Government/contract employees assigned to the BPA/task order not needing access to sensitive DHS information, DHS systems, or access to DHS facilities will not be subject to DHS fitness/suitability screening. Government/contract employees waiting on an EOD decision may not begin work on the BPA. Limited access to DHS facilities is allowable prior to the EOD decision if the government/contract employee is escorted by an approved DHS employee. This limited access is to allow government/contract employees to attend briefings, nonrecurring meetings, and begin transition work. During one’s limited access the government/contract employee will not have access to sensitive or classified DHS information.

4.3 Classified Information

Classified information is government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the government/contract employee has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility.

If the government/contract employee is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

Work on this contract cannot be performed unless the contractor personnel assigned to the labor categories are cleared at the appropriate levels as identified on each Task Order.

Prior to performing work, all contractor personnel must complete the suitability check process.

All contractor personnel must execute non-disclosure agreements (NDAs, DHS Form 11000-6).

While contractor personnel are on-boarding and going through the suitability check process, the contractor shall submit information in its weekly reports to the COR indicating the progress, status, and action items for each individual going through the suitability check. The COR will further specify the format and due dates for the reports at award.

All work performed under this BPA should be considered unclassified unless specified otherwise. When classified work is required, DHS will provide specific guidance to the

Draft Statement of Work contractor. The contractor shall adhere to all applicable government laws, regulations, orders, guides, and directives pertaining to Secret, Sensitive But Unclassified, FOUO, or personally identifiable information. The contractor shall safeguard Sensitive But Unclassified, FOUO information specifically in accordance with DHS Management Directive 11042.1.

The contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of classified and sensitive government information, data, and/or equipment. If contractor personnel are ever uncertain about the handling or treatment of any information or data, they shall consult the COR.

All contractor personnel will be required to receive DHS Security Awareness Training and IT system rules of behavior training when performance commences, and thereafter. Contractors will significant security responsibilities may be required to receive specialized training. All personnel who access government IT systems will be monitored in their use. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer.

A DD Form 254 with a facility security clearance level of Top Secret that gives the Quoter the ability to hold clearances for its employees up to and including Top Secret/Sensitive Compartmentalized Information (SCI) will be completed and incorporated into the BPA. The Quoter will not need to store classified information at their facility.

The table below lists anticipated positions requiring…