DRAFT CAMIN PWS (RFI).docx

DRAFT (Subject to Change) Development and Maintenance of the Chemical Accountability Management Information Network (CAMIN)

Performance Work Statement (PWS)

1 General Information:

Scope: The Contractor, as an independent Contractor and not as an agent of the Government, shall provide the necessary resources (except for those identified as Government furnished property) to perform the work described herein for services for the Chemical Materials Activity (CMA). The scope of the Chemical Accountability Management Information Network (CAMIN) is to provide accountability and reporting data to generate documentation in formats described in the Chemical Weapons Convention (CWC). CAMIN is integral to the reporting of the Army’s Toxic Chemical Munitions (TCM) and Bulk Agent (BA). System operation is critical for recovered chemical warfare materiel accountability. The CAMIN system accounts for the Army’s Toxic Chemical Munitions (TCM) and Bulk Agents (BA). The Stockpile Management Office (SMO) uses CAMIN to monitor the status of the recovered chemical warfare materiel, monitor inventory levels, monitor stock movements and transfers, maintain basic catalog data, process materiel release requests and orders, issue-controlled document numbers, plan and report annual inventory, and maintain historical information on past transactions. The CAMIN system contains data maintaining International Treaty Declarations in compliance with the Multilateral Chemical Weapons Convention. The database includes historic production facility data, and past transfers of production equipment.

1.1 Background/General Information: CAMIN is a system used to maintain toxic chemical munitions and bulk agent (TCM/BA) accountability data in accordance with (IAW) Department of Defense (DOD), Department of the Army (DA), and Army Material Command (AMC-R 740- 28), to store Chemical Weapons Convention (CWC) reporting data and generate documentation in formats described in the CWC. Through the CAMIN, CMA accesses a database developed for the U.S. Army and its Executive Agent for Chemical Treaty Compliance (EA-CTC), and generates treaty required documentation. This contract will provide services to the Stockpile Management Office (SMO) fulfillment of chemical treaty requirements for the center for treaty Implementation and Compliance (formerly the Executive Agent for Chemical Treaty Compliance) in the main areas of:(1) Program Management (2), Cybersecurity (3) Meetings, Reports and Materials (4) System Maintenance (5) Technical Support Services (6) Training/Certification and (7) Demobilization and Retirement.

Objective: The objective of this effort is to maintain and update CAMIN system functionality, maintain system operations, and provide user support.

Specific Tasks: (1) Program Management (2), Cybersecurity (3) Meetings, Reports and Materials (4) System Maintenance (5) Technical Support Services (6) Training/Certification and (7) Demobilization and Retirement.

Mission: SMO’s principal mission is to manage CAMIN and ensure Toxic Chemical Munitions (TCM) are stored in a manner that is consistent with established policy and procedures (AMC-R 740-28), that affords maximum safety and protection of the workforce, the environment, and surrounding communities. SMO must also manage the CAMIN system in compliance with the DOD Chemical Weapons Treaty and the Army Wholesale Accountability missions. SMO, as the National Inventory Control Point (NICP) is responsible for the full accountability of the TCM/BA with direct authority for the recovered chemical warfare materiel until demilitarization. This includes all logistics and accountability functions associated with the wholesale supply account. SMO maintains the NICP records for TCM/BA indefinitely, as they are subject to review/inspection by the Chemical Weapons Treaty inspection team members. SMO operates and maintains the CAMIN website, which provides the tools to maintain the inventory, initiate and process request for movement, document destruction, and provide management reports to all levels of Department of Defense/Department of State (DoD/DoS). SMO provides training to CAMIN users located at the chemical activities as well as a higher headquarters. SMO provide CAMIN management, user, and system technical support assistance. CAMIN must comply with Army Regulations 25-1 and 25-2, as well as DoD Instruction 8510.01, 19 July 2022. CAMIN satisfies Army goals for web (or browser) based information systems, public key enablement, and reductions in servers and applications.

2. General Contract Requirements

2.1 Organizational Conflicts of Interest(OCI) : The Contractor and subcontractor personnel performing services under this contract may not receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

2.2 Period of Performance (PoP): This contract will have a base of six-months starting on or about 16 April 2025 and then a base of one-year, starting on or about 15 October 2025. This contract will include four option periods of 12 months. This contract will also include FAR clause 52.217-8. The Contractor shall primarily perform work at the Contractor facility. Periodic work shall be required in the Edgewood Area of APG and Redstone Arsenal, AL. This contract work is to be executed by the contract administration of Army Contracting Command-Aberdeen Proving Ground- Edgewood Division from 16 April 2025 to 15 October 2025, with 4 option years.

2.3 Telecommuting: Telecommuting is permitted, pursuant to FAR 7.108. Telecommuting shall conform to security protocols. The Contractor shall provide a Telecommuting Program Plan as part of their proposal and provide any Telecommuting Program Plan Updates to the COR any plan updates within 15 calendar days of the update. Telecommuting shall be at no additional cost to the Government.

2.4 Combating Trafficking in Persons: The United States Government has adopted a zero- tolerance policy regarding trafficking in persons. Contractors and Contractor employees shall not engage in any forms of trafficking in persons during the period of performance of the contract such as, but not limited to procuring commercial sex acts during the period of performance of the contract, nor use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy and the actions that will be taken against employees for violations of this policy. Such actions may include, but are not limited to, removal from the contract, reduction in benefits, or termination of employment. The Contractor shall take appropriate actions, up to and including termination, against employees or subContractors that violate the US Government policy as described at FAR 22.17, and FAR 22.1701(a).

2.5 AT Level I Training: All Contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subContractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://jko.jten.mil/courses/AT- level1/launch.html

2.6 Access and General Protection/Security Policy and Procedures: Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204-9, Personal Identity Verification of Contract Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

2.7 Contractor CAC Requirements: Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated Tier 1 security investigation or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

2.8 Contractors that Do Not Require a CAC, but Require Access to a DoD Facility or Installation: Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

2.9 Locally Developed iWATCH Army Training: The Contractor and all associated subcontractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance, with the results reported to the COR NLT 30 calendar days after contract award.

2.10 Army Training Certification Tracking System (ATCTS): Registration for Contractor employees who require access to Government information systems. All Contractor employees with access to a government info system must be registered in the ATCTS at commencement of services and must successfully complete the DoD Information Assurance Awareness training prior to access to the information system and annually thereafter.

2.11 OPSEC Training: Per AR 530-1, Operations Security, the Contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

2.12 For IA/IT training: All Contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All Contractor employees working in IA/IT functions must comply with DoD and Army training requirements in AR 25-2.

2.13 For IA/IT certification: Per DoD 8140.01, DFARS 252.239.7001, and AR 25-2, the Contractor employees supporting IA/IT privileged access requirements shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8140.01 must be completed upon contract award any additional certification are required six months after award.

2.14 Controlled Unclassified Information (CUI): All Contractor employees and associated subcontractor employees must complete the initial DoD mandatory CUI training and annually thereafter. Include DFARS clause 252.204-7012, which requires the Contractor to comply with NIST 800-171. Also include DFARS provision 252.204-7019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn’t show a medium- or high-level assessment with a score of 110 or better (as described in the “NIST SP 800-171 DoD Assessment Methodology”), include clause DFARS 252.204-7020 and obtain the vendor’ system security plan” and “plan of action” for NIST SP 800-171 verification and assurance by Army security officials.

2.15 Qualified Personnel: The Contractor shall provide Qualified Personnel. The Personnel requiring access to Information Systems to fulfill their duties must possess the required security investigation, security clearance, or formal access approvals, and fulfill any need-to-know requirements. The Contractor shall ensure personnel supporting this effort are certified to the appropriate level per the DCWF work role. The Contractor shall ensure personnel performing Information Assurance duties (as defined by DoD Cyberspace Workforce Framework (DCWF) role per DODi 8140. Foundational qualifications for specific job roles are required prior to being employed on the contract with additional requirements being met within 6 months of being assigned a DCWF role. A record of IA certifications shall be maintained on the Army Training & Certification Tracking System (https://atc.us.army.mil/iastar/index.php). The Contractor shall ensure all position type for all personnel performing DCWF duties are properly certified.

2.16 Phase-In/Phase-Out: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the 15 Calendar Days phase in/phase out periods to ensure work is not affected between the current task order (Task W911SR-20-F-0001) and contract, and any potential subsequent award. During the phase-in period, the Contractor shall become familiar with performance requirements to commence full performance of services on the Period of Performance start date and shall not provide any duplicate services that would conflict with (Task W911SR-20-F-0001). During the Phase-Out period, the Contractor shall work with any incoming Contractor(s) to ensure services remain uninterrupted and ensure all deliverables/access to information is turned over to the COR prior to October 2029, unless otherwise specified herein or by the COR or Contracting Officer.

2.17 Monthly Progress and Status Report: The Contractor shall provide a Monthly Progress and Status Report (MPSR). The MPSR shall include the following information for all aspects of support listed in Section 4.0, to include, the following: (1) Narrative detailing any results and issues of any major/important milestones, plans, or events that were planned, (2) A table identifying all deliverables provided that month, (3) Schedule status updates, (4) Descriptions of any issues impacting delivery, (5) Highlights of any important forthcoming meetings and events that require Government participation/involvement, (6) Status of mandatory training of all Contractor personnel, and (7) Financial and labor data.

2.18 Monthly Progress Report Meeting: The Contractor shall participate in meetings, respond to agenda requirements and provide briefings on status and alternative courses of action, record meeting minutes and make distribution of minutes as required for Monthly Status Report Updates.

2.19 Remote Access: The Contractor shall remotely manage the CAMIN network via VPN or Citrix access. The Contractor shall establish connectivity via a Government authorized secure connection. The Contractor shall be compliant with the Government’s Authorized Use Policy (AUP).

2.20 Digital encrypted certificates: The Contractor shall obtain and maintain digital certificates through the renewal period of those certificates through the Department of Defense approved issuing authority for personnel performing work under this contract to exchange encrypted or digitally signed electronic mail with the Government. The Contractor shall maintain server and software signing certificates from a DoD trusted root certification authority. The Government will issue server certificates for Government owned or operated CAMIN servers. The Contractor shall install and verify certificates on CAMIN servers as required.

2.21 Customer Service: The Contractor shall provide Customer Services to stakeholders. The Contractor shall maintain a help desk responding to questions from CAMIN users on the CAMIN Network. The Contractor shall maintain a help desk to support on-post and off-post information technology (IT) personnel. The Contractor shall provide customer service that include problem identification, resolution, and follow-up. The Contractor shall maintain records of help desk calls and actions. The Contractor shall provide customer service available by telephone twenty-four (24) hours per day, seven (7) days per week to receive and provide answers. The Contractor shall receive questions and provide answers via electronic mail and help desk web site on a twenty-four (24) hour per day basis. The Contractor shall provide a summary of help desk requests/responses shall be submitted as part of the monthly status report. The Contractor shall provide customer services that include responding to emails, phone calls from stake holders and coordinating with the appropriate government personnel to provide the information requested by the stakeholder. Any phone calls forwarded to a voicemail system shall be returned within one business day. The Contractor shall not provide any legal advice nor act as a representative of the Government.

2.22 Post Award Meeting/Periodic Progress Meetings: The Contractor shall attend any Post Award Meeting convened by the Contracting Officer in accordance with FAR Subpart 42.5. The Contracting Officer, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contactor’s performance. At these meetings, the Contacting Officer will apprise the Contractor of how the Government views the Contractor’s performance and the Contractor shall apprise the Government of problems, if any, being experienced the Contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

2.23 Quality Control (QC): The Contractor shall provide as part of their proposal an Initial Quality Control (QCP) Plan. Thereafter, the Contractor shall provide QC Plan Updates if any changes are required to ensure services are performed in accordance with this PWS. Any QC Plan Update shall be provided to the COR and Contracting Officer within 15 calendar days after any changes. The Contractor shall ensure the Initial QCP and any QCP Updates implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s Initial QCP and relevant QCP Updates are provided to ensure that deliverables comply with the requirements of the contract.

2.24 Quality Assurance (QA): The Government will evaluate the Contractor’s performance under this contract in accordance with the performance requested stated herein and the Contractor’s QCP.

2.25 Service Contract Reporting (formally Contract Manpower Reporting): The Contractor is required to provide data on Contractor manpower, including subcontractor manpower, for performance of this contract at https://sam.gov/content/entity-reporting (see also FAR Clauses 52.204-14 & 52.204-15).

2.26 Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-Contractor employees shall provide all information required for background checks to meet installation access requirements or the requirements of additional Information Assurance duties, to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office (AR 380-67). Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes. The Contractor shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor and sub-Contractor workforce shall comply with all personal identity verification requirements as directed by Department of Defense, Headquarters Department of Army and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes. During FPCON Charlie and Delta, Contractor services may be restricted. Contractor services will resume without restriction when the FPCON level is reduced to level Bravo or lower.

2.27 Unscheduled gate closures and location operations: Unscheduled gate closures by Security Police may occur at any time causing all personnel entering or exiting a closed gate to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by Contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the Contractor employee’s installation driving privileges. The Contractor’s employees shall become familiar with and obey the regulations of the installation; including, but not limited to fire, traffic, safety, and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All Contractor employees shall always carry proper identification with them. The Contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

2.28 Emergency Issues: The Contractor shall notify Government personnel of an emergency/safety/cyber issues and notify the COR. The Contractor shall report any severe or urgent issue to the COR, Contracting Officer, and/or other Government representative immediately. Any severe or urgent issues shall be documented in the Monthly Progress Status Report (MPSR) per Contracts Data Requirements List.

2.29 Alert Notification Tests: The Contractor shall respond to Alert Notification Tests. Historically, there are wide Alert Notifications for security. In the event the Contractor is alerted they shall follow the instructions in the Alert Notification and respond accordingly.

2.30 Communications: The Contractor shall respond to Line referrals from CMA and provide technical support assistance from 0800hrs to 1700hrs and shall provide an emergency means of communication by cell phones operated twenty-four (24) hours, seven (7) days a week for emergency calls received during non-business hours. The Contractor shall maintain the emergency line after normal duty hours but also in the event the SMO needs assistance or is not available to provide Site assistance.

2.31 Threat Awareness Reporting Program: For all Contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), Contractor employees must receive annual TARP training by a CI agent or other trainer as specified in AR 381-12 para 2-4b.

2.32 Identification of Contractor Employees: All Contractor personnel are required to identify themselves as such in to avoid creating an impression that they are Government employees. Situations when Contractors shall identify themselves as such while attending meetings, emailing on Government networks, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties. The Contractor shall ensure that all documents or reports produced by Contractor personnel are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. The Contractor’s status as a “Contractor” shall be predominantly displayed in ALL correspondence types (to including e- mail signature blocks), and all dealings with Government or non-Government entities. Contractor personnel shall wear identification badges distinguishing them as such. These badges, if necessary, will be provided by the government. The Contractor shall retrieve all identification media (including vehicle passes) from their employees who depart employment for any reason. All identification media (i.e., badges and vehicle passes) shall be returned to the Contracting Officer’s Representative (COR) within 14 days of an employee’s departure.

2.33 Recognized Holidays: The following are recognized US holidays. While the Contractor is ultimately responsible for determining how their employers will work, the below recognized holidays are observe by federal employees and may affect the Contractor’s ability to perform specified services:

2.33.1 New Year’s Day

2.33.2 Martin Luther King, Jr. Birthday

2.33.3 Washington’s Birthday

2.33.4 Memorial Day

2.33.5 Juneteenth National Independence Day

2.33.6 Independence Day

2.33.7 Labor Day

2.33.8 Columbus Day

2.33.9 Veteran’s Day

2.33.10 Thanksgiving Day

2.33.11 Christmas Day

3 Applicable Documents

3.1 Availability: Applicable documents are available via the internet which has a designated website address. Some of the documents will be provided by the Government as part of the Request for Proposal. The remaining documents will be provided by the Government to the Contractor as needed or requested following contract award.

3.2 Military Specifications: None.

3.3 Military Standards: None.

3.4 Other Military Documents:

3.4.1 Department of the Army Regulation (AR) 50-6, Nuclear and Chemical Weapons and Materiel; Chemical Surety. 13 November 2022.

3.4.2 Department of the Army Pamphlet 5-11, Verification, Validation, and Accreditation of Army Models and Simulations. 30 September 1999.

3.4.3 Department of the Army Regulation 25-1, Army Information Technology. 15 July 2019.

3.4.4 Department of the Army Regulation 25-2, Army Cybersecurity. 4 April 2019.

3.4.5 DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Systems, 19 July 2022.

3.4.6 DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019.

3.4.7 DoD 8140.01, Cyberspace Workforce Management, 5 October 2020.

3.4.8 Army Directive 2014-05, Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors, 7 March 2014.

3.4.9 AR 190-13, The Army Physical Security Program, 27 June 2019.

3.4.10 AR 530-1, Operations Security, 26 September 2014.

3.4.11 AR 381-12, Threat Awareness and Reporting Program, 01 June 2016.

3.4.12 AR 525-27, Army Emergency Management Program, 29 March 2019.

3.4.13 Security Agreement (DD Form 441), 1 March 2020.

3.4.14 National Industrial Security Program Operating Manual (DoD 5220.22-M)

3.4.15 NIST SP 800-171, Rev 2, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, February 2020.

3.4.16 DoD Architectural Framework Version 2.02, August 2010. https://dodcio.defense.gov/library/dod- architecture-framework/

3.4.17 OASIS Common Alerting Protocol Version 1.2, OASIS Standard, 01 July 2010.

3.4.18 Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction, 27 Sep 05 https://www.opcw.org/sites/default/files/documents/CWC/CWC_en.pdf

3.4.19 AR 735-5, Relief of Responsibility and Accountability, 10 March 2024. https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r735-5_Web_Final.pdf

3.4.20 AR 725-50, Requisitioning, Receipt, and Issue System, 15 Nov 95 https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r725_50.pdf

3.4.21 AR 25-2, Information Assurance, 24 Oct 2007 w/RAR 23 Mar 2009 https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r25_2

3.4.22 AMC-R 740-28, Toxic Chemical Munitions, Bulk Agent and Binary Materiel Inventory and Accountability, 27 Apr 17 https://hqamc.aep.army.mil/gstaff/amcio/ia/r/p/Publications/AMC-R%20740-28.pdf

3.4.23 CFR Part 1194, paragraph 1194.22 Web-based intranet information and applications. http://edocket.access.gpo.gov/cfr_2001/julqtr/pdf/36cfr1194.22.pdf

3.4.24 DOD Instruction 8510.01, 19 July 2022, subject: Risk Management Framework for DOD Systems. http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf

3.4.25 DOD Directive 8140.01, 5 October 2020, *: Cybersafe Workforce Management. http://www.dtic.mil/whs/directives/corres/pdf/814001p.pdf

3.4.26 AR 710-4, Property Accountability, 26 January 2024, https://armypubs.army.mil/epubs/DR_pubs/DR_a/ARN40040-AR_710-4-001-WEB-2.pdf

4 Specific Contract Requirements:

4.1 Overview: This PWS supports CAMIN, which is required at the Blue Grass Chemical Activity (BGCA), Redstone Chemical Activity (RCA) and the Headquarters (HQ), Chemical Materials Activity to maintain recovered chemical warfare materiel accountability. The Contractor, as an independent Contractor and not as an agent of the Government, shall supply the necessary personnel, facilities, equipment, expertise, and materials (except as furnished by the Government) to accomplish the work described below in all applicable general requirements and technical specifications. These services encompass the entire work describe herein under the 7 main service areas: (1) Program Management (2), Cybersecurity (3) Meetings, Reports and Materials (4) CAMIN System Maintenance (5) CAMIN Technical Support Services (6) CAMIN Training/Certification and (7) CAMIN Demobilization and Retirement. The noted Data Item Descriptions (DIDs) in the DD 1423, Contract Data Requirements List (CDRL) is located at: https://quicksearch.dla.mil/

4.2 Program Management: The Contractor shall perform program management activities to include planning, quality assurance and configuration management.

4.3 Contract Manager: The Contractor shall designate a Contract Manager (not to be confused with a Program Manager/Site Lead/Supervisor), who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the Contractor when the Contract Manager is absent, shall be designated in writing to the Contracting Officer. The Contract Manager (historically, the main person who works with the Contracting Officer) or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The Contract Manager shall work through the COR, to resolve issues, receive technical instructions, and ensure adequate performance of services. The Contract Manager shall ensure that Contractor employees do not perform any services outside the scope of the contract without an official modification issued by the Contracting Officer. The Contract Manager shall ensure Contractor employees understand that services performed outside the scope of the contract are performed solely at the expense of the Contractor.

4.4 Government-Furnished Property: The Government will provide (if required), incidental to services being provided, the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

4.5 Property: The Government, if necessary, will furnish the necessary workspace in Government facilities for Contractor employees to perform services outlined in this PWS to include desk space, telephones, computer access (either by laptops or Government Virtual Desk Enterprise) and other items necessary to maintain an office environment.

4.6 Materials: The Government will provide the Contractor with access to all existing and relevant Standard Operating Procedures and Policies associated with the required services. The Contractor shall operate under conditions that preclude the waste of material.

4.7 Utilities: The Government will provide all utilities in the Government’s facility for the Contractor’s use in performance of tasks outlined in this PWS. The Contractor shall instruct employees in utility conservation practices. The Contractor shall operate under conditions that preclude the waste of utilities, such as turning off the water faucets or valves after using the required amount.

5 Cybersecurity

5.1 Accreditation of the Authority to Operate (ATO) for CAMIN: The Contractor shall maintain the Risk Management Framework (RMF) Authorization to Operate (ATO) for CAMIN and all requirements therein at the discretion of the DEVCOM CBC G6 who maintains an Authorization to Operate (ATO) for all assets in the approved hosted datacenter. If DEVCOM CBC where unable to provide the ATO for any reason the Contractor would be required to support a DOD system of record in the Army’s Enterprise Mission Assurance Support Service (eMASS) currently hosted at https://army.emass.apps.mil to obtain an ATO independently from the mission partners. This includes technical/administrative support. The Contractor shall provide Control and Policies documentation to the Government for review and signature. The Contractor shall, within two weeks of government request, provide working drafts of any documents being updated under this effort to the government. The Contractor shall upload and maintain documentation in eMASS. The Contractor shall implement all security controls per RMF requirements. The Contractor shall implement any new standards promulgated within 30 days of notification.

5.2 Contingency Plan: The Contractor shall maintain the Government Contingency Plan Updates (1-2 times per year) for CAMIN, and in consultation with the COR, submit revisions. The contingency plan shall include a Contingency Test Plan for conducting a tabletop or actual test of the Contingency Plan. The Contractor shall conduct at minimum one Contingency Plan Test (tabletop exercise or actual test) of the contingency plan at one (1) CSEPP site. The Contractor shall conduct Additional Contingency Testing if required per RMF guidance. The Contractor shall deliver the Contingency plan, Test plan, and Contingency Test report (like an After-Action Report) to the government and compliant with DoD Instruction 8510.01.

5.3 Exporting contingency Plan: The Contractor shall maintain data backups by exporting the production database to a Government Off-Site location as recommended by CCDC CBC. The Contractor shall maintain a contingency plan for shifting CAMIN processing from the central server at Edgewood IT DEVCOM Building Aberdeen Proving Ground, Maryland to the backup server, which will need to be relocated when and appropriate location is determined.

5.4 CAMIN Contingency Plan: The Contractor shall provide a CAMIN Contingency Plan. The CAMIN Contingency Plan shall include all procedures that the users need to connect to the alternate server if the central server at Aberdeen is unavailable. The Contractor shall coordinate user testing of the contingency plan once a year with the COR, which must include a test of the backup server.

5.5 CAMIN Hardware/Software Inventory: The Contractor shall provide the CAMIN Inventory List Updates (annually). The Inventory List Update will account for all essential CAMIN equipment, servers, storage arrays, and system software at each on-post site and on the eMASS website. The Contractor shall provide the Inventory List Update within 30 days of installation of all hardware and software changes. The Government will provide vendor services to maintain all essential equipment (i.e. hardware). The Government shall procure all software and hardware through CHESS to obtain appropriate software licenses and hardware maintenance contracts.

5.6 Troubleshooting: The Contractor shall troubleshoot, and correct problems as needed. The Contractor shall provide means to notify users of registration expirations. All new requests for CAMIN accounts must be approved by the NICP (National Inventory Control Point). The Contractor shall gather and maintain statistics on CAMIN application usage. The Contractor shall provide a report for expired registrations

5.7 Scanning: The Contractor shall perform scanning of all available software code quarterly to identify vulnerabilities using automated scanning technologies as recommended per RMF DoDI 8510.01 and any applicable Application and Development Systems Requirements Guides (SRG). The Contractor shall provide the results of the software code scans to the Government. The Contractor shall make every effort to remediate open findings in the scans of custom scans within 30 days of reporting.

5.8 Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) compliance: The Contractor shall monitor essential CAMIN systems for compliance with quarterly STIGs and make configuration changes as required. The Contractor shall configure new equipment and software for compliance with DISA STIGs prior to installation.

5.9 System audits: The Contractor shall audit on-post systems weekly for secure configuration, perform virus scans (manual or automatic), and inspect all audit logs for abnormal events.

5.10 Software/Patch upgrades: The Contractor shall apply patches and upgrades to essential system software within the time frame prescribed by the information assurance alert, tasking order, or other event requiring the patch or upgrade in accordance with CCB procedures.

5.11 Antivirus: Antivirus shall be installed per the hosting partner CCDC CBC’s guidance. CCDC CBC will provide all packages and monitor the application/program if required. Installation and maintenance will remain the Contractor’s responsibility.

5.12 Hardware and Software Report (Excel): The Contractor shall provide a monthly Hardware and Software Report and advise the Government if additional hardware and software is needed and recommend performance standards for the hardware and software. The Contractor shall maintain source code, database software. Software testing shall be conducted before installation on the hardware at the central server and maintain the necessary test results.

6 Meetings, Reports and Materials

6.1 CAMIN Configuration Control Board (CCB) Meeting and Report: The Contractor shall manage a monthly CAMIN Configuration Control Board (CCB) meeting. The CCB exists to facilitate efficient and effective computer operations of CAMIN in maintaining its treaty and accountability missions and to accomplish long term planning. Following the CCB, the Contractor shall manage all CCB request and provide meeting minutes and artifacts of all CCB decisions to the government for disposition. The Contractor shall attend task review meetings with the CCB and the COR prior to commencing development activities for upgrades. The meetings shall be conducted by Microsoft Teams or tele-conference with the CAMIN Contractor. The NICP, COR, and a CMA IT representative are the CCB voting members.

6.2 CCB Documentation: The Contractor shall provide read ahead materials, a week in advance, to the CCB membership for the review process. The read ahead materials shall include estimates of the time required, assessment of the risk and any pertinent detail useful to the CCB. The CCB will provide a list of preapproved changes that can be implemented once documented and a process for emergency approval.

7 CAMIN System Maintenance

7.1 Bi- Weekly Technical Status Meeting: The Contractor shall conduct a bi-weekly Technical Status Meeting including, but not limited to, reviewing Help Desk calls, IAVAs, feature requests, software modifications and updates to CCB efforts etc.

7.2 CAMIN Application Components: The Contractor shall coordinate with CMA Information Technology personnel in matters affecting CAMIN application components. The Contractor shall provide remote support to the remaining CMA sites that include, fixing software defects and software patch releases.

7.3 Site Server Monitoring: The Contractor shall monitor CAMIN site servers at CMA HQ, for resource usage, software problems, and connectivity among site servers. The Contractor shall document and report any monitoring problems at the Bi-Weekly Technical Status Meeting.

7.4 CAMIN Application and Graphical User Interface Functional Maintenance: The Contractor shall document all submitted Feature Request and prioritize them at the Weekly Technical Status Meeting and seek CCB approval. The Contractor shall implement the feature requests as approved by the Configuration Control Board process.

7.5 CAMIN Information Databases: The Contractor shall maintain the CAMIN information databases and transfer existing databases to new database designs and software versions as required.

7.6 User Support: The Contractor shall provide support to CAMIN users, both on and off- post, in troubleshooting and correcting software problems. The Contractor shall provide support remotely NICP and COR to assist customers.

7.7 CAMIN System Evaluation and Testing: The Contractor shall develop Test Procedures, Test Plans, and execute Software Verification to include testing at each site following the installation of a major release or build of the system. The Contractor shall deliver the Test Procedures and Test Plans, to the Government.

7.8 Section 508 of the Rehabilitation Act: The Contractor shall maintain the CAMIN software and CAMIN support site compliance with Section 508 of the Rehabilitation Act.

7.9 Advanced Troubleshooting: The Contractor shall support CMA for all advanced troubleshooting requests working with CMA and CCDC CBC as needed for outages and associated user issues.

7.10 System Administration Tasks: The Contractor shall perform routine system administration tasks including confirming periodic backups, maintenance of logs, monitoring file space and other resource usage, and monitoring processes. The Contractor shall maintain existing scripts used for system administration.

7.11 Migration of Files: The Contractor shall migrate file systems, applications, user accounts, databases, and other system items to new or replacement CAMIN hardware when required.

7.12 Vendor Support: The Contractor shall monitor essential hardware and system software for problems, failures, errors, and other anomalies. The Contractor shall perform actions to resolve the issues and call vendor support for replacement parts if required. The Contractor shall notify the COR whenever vendor support is required.

8 CAMIN Technical Support Services

8.1 CAMIN Documentation: The Contractor shall revise CAMIN documentation effected by major software updates. The existing documentation on CAMIN will be revised and provided to the Government immediately upon release.

8.2 System Requirements Specification (SysRS): The Contractor shall update the System Requirements Specification (SysRS) for the CAMIN application and to submit the Government. The SysRS shall update end user and administrator functional requirements, user characteristics, rationale, priority, criticality, dependencies, and evaluation criteria. The SysRS shall contain a master list of functional requirements based on subordinate functional requirement specifications.

8.3 Interface Design Description: The Contractor shall update and maintain the Interface Design Description for the CAMIN application. The Contractor shall deliver the Interface Design Description to the Government via e-mail communication. The Interface Design Description shall document internal system interfaces as well as interfaces to external systems.

8.4 System Architecture Description: The Contractor shall update the system architecture using the appropriate operational, systems, and technical views prescribed in the Department of Defense Architecture Framework.

8.5 Bill of Materials: The Contractor shall update and maintain the Bill of Materials for the CAMIN application which includes hardware recommendations, required software components, and network requirements.

8.6 CAMIN Admin Tool User Guide: The Contractor shall update and maintain the CAMIN Admin Tool User Guide which provides an overview on the control features of CAMIN. The Contractor shall provide online access to the manuals as a component of the CAMIN application services.

8.7 CAMIN User Guide: The Contractor shall update and maintain the CAMIN User Guide documenting all functions of the CAMIN system. The Contractor shall provide online access to the manuals as a component of the CAMIN application services.

8.8 CAMIN Quick Reference Guide: The Contractor shall update and maintain the content on CAMIN Quick Reference Guide panels impacted by revisions to the new version or build of CAMIN Network.

8.9 CAMIN Technical Manual: The Contractor shall update and maintain the CAMIN technical manual whenever modifications are made to CAMIN.

8.10 CAMIN Reference Manual: The Contractor shall update and maintain the CAMIN Reference Manual, documenting changes due to revision in the new version or build of CAMIN.

9 CAMIN Training/Certifications

9.1 Personnel/Performance: The Contractor shall identify key personnel needed for the technical execution of the contract. The Contractor will immediately notify the Contracting Officer or Contracting Officer Representative (COR) of any changes to personnel during the performance of the contract or prior to contract award.

9.2 Sun Solaris training: System Administrators and Software Engineers shall obtain Sun Solaris training certifications to work on the CAMIN central server cluster. Sun Solaris Training is comprised of various training on products such as Sun Solaris, Cluster, and Java, which are tools used to manage the Microsystems of a computer program or specified system. Newly assigned system administrative personnel shall complete DCWF Role requirements per DODI 8140.02 and forward training certificates to the COR.

9.3 CAMIN User Training.

9.3.1 The Contractor shall provide CAMIN Users Training using the Government provided training located at https://camin.apgea.army.mil/j_security_check. The Government provided training provides CAMIN users pertinent to their mission area, storage sites, destruction facilities, and treaty community. All classroom training shall be administered at the CMA Operations Center Building E-5240, Aberdeen Proving Ground, Maryland; no training shall be administered on site at the Contractor’s facility. The Government will provide all equipment and supplies (if needed). As required, the Contractor will conduct up to two courses, each lasting three days training sessions per year, either in- person or via Microsoft Teams.

9.3.2 The Contractor shall provide CAMIN Training Plan, contractor format. The CAMIN Training Plan shall be provided per standard industry learning practices (e.g. Adult Learning Theory).

9.3.3 The Contractor shall provide CAMIN Classroom Exercises, in Contractor format.

10 CAMIN Demobilization and Retirement-OPTION

10.1 Notification: The Government may require demobilization and retirement service in the event CAMIN is no longer needed. The Contracting Officers will exercise an option if the conclusion of the CMA’s requirement to maintain CAMIN management of the NICP is required. The Contractor shall perform the demobilization of equipment, and retirement of CAMIN within 180 days of notification.

10.2 Demobilization Plan: The Contractor shall, upon notification by the Government of the conclusion of the CMA Accountability mission, finalize the CAMIN software code and documentation. The Contractor shall compile a listing of all documentation to include but not limited to all software, model, hardware and analyst related information along with all software, code, notes required for the development effort and submit it NLT 30 days after the request from the COR.

10.3 Retirement Plan: The Contractor shall back-up all data from the CMA CAMIN servers on magnetic storage media and transfer it via an approved method with CMA IT.