Draft PWS DPW_Support Services.pdf

PERFORMANCE WORK STATEMENT (PWS)

DPW SUPPORT SERVICES

JOINT BASE LEWIS-MCCHORD (JBLM) DIRECTORATE OF PUBLIC WORKS

01 January 2025

1. GENERAL: This is a non-personal services contract to provide IT & Support Services at Joint Base Lewis-McChord (JBLM) Directorate of Public Works. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform IT & Support Services at Joint Base Lewis-McChord (JBLM) Directorate of Public Works (DPW) as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background:

Public Works (PW) operates and maintains all facilities and utilities at Joint Base Lewis McChord (JBLM), Washington (WA) and the Yakima Training Center, Yakima, WA. This includes buildings, roads, utility systems, grounds maintenance, and environmental & natural resources.

PW Information Technology systems are critical enablers which allow efficient completion of the mission.

The PW IT department provides a wide range of services primarily to PW including IT Hardware, Software and Services Procurement, Industrial Control Systems, Cybersecurity, Help Desk Support, Database Management and Administration, and Webmaster Services.

The PW IT department provides application support and assistance for Geographical Information Systems (GIS) and Computer Aided Drafting (CAD) for Army Units at JBLM, Yakima Training Center and occasionally other Army Organizations outside of JBLM, WA for regional/national project support.

1.3 Objectives: The contractor shall provide IT & business support services at JBLM Public Works as a part of the PW IT Department, PW Business Operations and Integration Division (BOID), PW Engineering Services Division (ESD) and Yakima Training Center.

1.4 Scope: The contractor will support the daily operations of JBLM DPW IT Infrastructure. JBLM DPW has physical and virtual servers, desktop computers and notebook computers running Windows operating systems. Other hardware includes printers, large-width plotters, scanners and smartphones. DPW also runs a wide variety of desktop & enterprise software and supports users connecting to enterprise systems run by other organizations.

Army Information Technology Service Catalog (AITSC) formally known as C4IM: The JBLM Network Enterprise Center (NEC) provides AITSC Baseline IT Services to Army activities. The contractor is not responsible for AITSC Baseline IT Services.

The contractor shall provide the following services as a part of the DPW IT department:

• Cybersecurity, hardware support, software support and user management for DPW server systems, DPW common user equipment (such as workstations, printers, scanners, and accessories), DPW Industrial Control Systems (ICS), and DPW Facility Related Control Systems (FRCS).

• Operate an Information Technology (IT) Help Desk to receive requests via phone, email and walk-in.

• GIS Services

• CAD Services

• Database Administration

• Web Services

• Data Analyst Services

• Configuration Control

The contractor shall provide the following services within PW BOID:

• Data Entry

The contractor shall provide the following services within PW ESD:

• Data Analysis

• Data Entry and Procurement Support

The contractor shall provide the following services within PW YTC:

• Data Entry

• Data Analysis

1.5 N/A

1.6 General Information

1.6.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The contractor shall deliver the quality control program by email to the COR within 30 Calander days of contract award. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.6.2 Quality Assurance: The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: Offices are closed on holidays. The contractor is not required to perform services on recognized holidays.

New Year’s Day Labor Day Juneteenth Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 0700 and 1600 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

After hours work shall be performed as necessary to accomplish maintenance and emergency service on servers and databases (Typically 4 to 8 hours per month). All after-hours work and schedule deviations shall be coordinated in advance with the COR. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.6.5 Place of Performance: services shall be performed at JBLM, Washington. For the purposes of this contract, JBLM is defined as JBLM-Lewis Main, JBLM-Lewis North, and JBLM-McChord Field. JBLM is a United States military installation located within Pierce, Thurston, Kittitas, and Yakima counties in Washington State which will require the contractor to supply means of transportation.

1.6.6 Type of Contract: The government will award a Firm Fixed Price contract.

1.6.7 Security Requirements:

1.6.7.1 Specific Security Guidance for Contract, Refer to attached Department of Defense Contract Security Classification Specification (DD FORM 254). The attached copy (Technical Exhibit 4) is the preliminary DD Form 254 for planning purposes only. Upon contract award, the DD Form 254 will be completed (by Government) and attached to the contract.

1.6.7.2. N/A

1.6.7.3 Access and General Protection/Security Policy and Procedures: All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation/facility access requirements to be accomplished by installation Directorate of Plans, Training, Aviation, Mobilization and Security (DPTAMS) office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any installation or facility change, the Government may require changes in contractor security matters or processes.

1.6.7.3.1 For contractors requiring Common Access Card (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated Position designation Investigation Type 1 (T1), or an equivalent or higher investigation in accordance with Army Directive 2014-05 and Homeland Security Presidential Directive-12 (HSPD-12). The contractor and all sub-contractor employees will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled T1 at the Office of Personnel Management.

1.6.7.4 Suspicious Activity Reporting Training (iWATCH): The contractor and all associated sub-contractors shall receive a brief/training (provided by the requiring activity) on the local suspicious activity reporting program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the project manager, security representative or law enforcement entity. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after the completion of the training.

1.6.7.5 Contractor Employees Who Require Access to Government Information Systems: All contractor employees with access to a government info system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services, and must successfully complete the DOD Cybersecurity Awareness prior to access to the information systems and then annually thereafter in accordance with personnel security standards listed in AR 25-2 (Cybersecurity), an appropriate background investigation will be conducted prior to accessing the government information systems.

1.6.7.6 OPSEC Training: All new contractor employees will complete Level I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee to the COR within 5 calendar days after completion of training.

OPSEC awareness training is available at the following websites: https://www.iad.gov/ioss/ orhttps://www.lms.army.mil/; or it can be provided by the Requiring Activity OPSEC Officer in presentation form which will be documented via memorandum.

1.6.7.7 Cybersecurity information technology (IT) training: All contractor employees and associated sub-contractor employees must complete the DoD Cybersecurity awareness training before issuance of network access and annually thereafter. All contractor employees performing System Administrator CS/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M and AR 25-2 within three months of employment.

1.6.7.8 Cybersecurity /information technology (IT) certification: All contractor employees performing System Administrator CS/IT functions shall be appropriately certified upon contract award IAW DoDM 8140.03, DFARS 252.239-7001 and AR 25-2. The baseline certification as stipulated in DoDM 8140.03 must be completed upon contract award.

1.6.7.9 Handling or Access to Classified Information: Contractor shall comply with AR 380-67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors) as well as FAR 52.204-2, Security Requirements.

Additionally, Contractors must comply with - (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22- M, notice of which has been furnished to the contractor. For classified contracts, the DD Form 254 will be attached with the contract. All contractors that require access to classified information will receive a briefing from their Facility Security Officer and sign a Non-Disclosure Agreement, SF 312, dated 2013.

The SF 312 will be forwarded to the Contractor Officer Representative (COR).

1.6.7.10 Escort of contract employees in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas: All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

1.6.7.11 Prime Contractor Company to obtain a Facility Clearance (Level Secret or higher) and individual clearances at the appropriate level: The Prime Contractor Company must have a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22-M and AR 380-49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380-67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD Form 254 attached to the contract.

1.6.7.12 Pre-screen candidates using E-Verify Program; The Contractor must pre-screen Candidates using the E-verify Program (http://www.uscis.gov/e-verify) website to meet the established employment eligibility requirements. The Vendor must ensure that the Candidate has two valid forms of Government issued identification prior to enrollment to ensure the correct information is entered into the E-verify system. An initial list of verified/eligible Candidates must be provided to the COR no later than 3 business days after the initial contract award.

https://www.iad.gov/ioss/ https://www.iad.gov/ioss/ http://www.cdse.edu/catalog/operations-security.html http://www.uscis.gov/e-verify

1.6.7.13 Threat Awareness Reporting Program: All new contractor employees will complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381-12. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record to the COR within 5 calendar days after completion of training.

1.6.7.14 Use of DISS in accordance with DoD Manual 5200.02 “Procedures for the DoD Personnel Security Program (PSP) to verify security clearance levels for personnel who require access to classified information within DoD. Within Army, use of the DISS is mandated. The Contractor Facility Security Officer (FSO) shall ensure all personnel performing on this work effort have security access level, Information Technology (IT) level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in DISS. The Contractor shall make available to the Government requiring activity, and all work locations under this contract, all information necessary to enable verification of security access level/affiliation via DISS. When Visit Authorization Letters (VALs) are required by the Government requiring activity, they shall be transmitted via DISS. If any concerned organization is not on-line with DISS, a hardcopy VAL may be necessary until DISS is available. Non-DoD organizations may still require a hardcopy VAL.

1.6.7.15 Contractor may have access to Control Unclassified Information (CUI) and Personally Identifiable Information (PII). The contractor is required to protect information per AR 380-5, Information Security Program and 1974 Privacy Act for PII. The contractor shall also ensure any sensitive information, including but not limited to, PII, Executive Order (E.O.) 13556, Controlled Unclassified Information For CUI, proprietary and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media is protected in accordance with current Data at Rest (DAR) guidelines and requirements using an authorized, approved and prescribed DAR solution. MCDs include, but are not limited to laptop, Netbook, notebook, or tablet computers; external media includes optical disc media such as compact disks (CDs), Digital Video Disks (DVDs), USB drives, also referred to as flash or thumb drives (when authorization to use them is restored) and floppy disks, or other portable digital storage devices.

Guidance for protecting DAR information is found in Executive Office of the President Memo M-06-16 dated June 23, 2006, DoDI 8320.02, Security Technical Implementaion Guide “Rule ID SV- 206407r397744_rule, and 9th SC (A) OPORD 0910-300.

1.6.7.16 Conduct of Contractor Personnel. The Contractor shall be responsible for the performance and conduct of the Contract employees at all times. The persons employed by the Contractor in the performance of this Contract, or any representative of the Contractor entering the Installation, shall abide by the security regulations listed in the Contract and shall be subject to such checks by the Government, as deemed necessary.

In accordance with the Federal Acquisition Regulation (FAR) subpart 37.114, all contractor personnel attending meetings, answering Government telephones, and working in other situation where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractor personnel must also ensure that all e-mails, documents or reports they produce are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.6.7.17 Personnel Removal. Government rules, regulations, laws, directives, and requirements which are in place or issued during the Contract term relating to law and order, Installation administration, and security on the Installation shall be applicable to all Contractor employees or representatives who enter the Installation or who travel on Government business. Violation of such rules, regulations, laws, directives, or requirements shall be grounds for removal (permanently or temporarily as the Government determines) from the work site. Such removal of employees does not relieve the Contractor from the requirement to timely perform Contract tasks.

1.6.7.18 Training of Replacement Personnel. The contractor shall train all replacement personnel subsequent to the initial training period. Training shall occur on site using Government furnished equipment. The Contractor shall initiate procedures to ensure that there is no lapse in the Contractor’s ability to complete the specified tasks. A replacement must meet all the qualifications. A replacement shall possess a SECRET clearance prior to assignment if replacing personnel in a position requiring SECRET clearance. Continuing education, cross training, and refresher training is encouraged.

1.6.7.19 Information Systems Security Compliance. The Contractor shall comply with all Department of Defense (DOD), Department of the Army (DA), United States Army Forces Command (FORSCOM) and local Intervene, Act and Motivate (IAM) instructions and Regulations. The contracted individual providing services under this contract must comply with the information system security requirements prescribed by

AR 25-2.

1.6.7.20 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.21 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards, key codes, and key Forward Operating Base’s (FOBs). No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the COR.

1.6.7.21.1 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

1.6.7.22 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.8 Special Qualifications: All contractor employees will obtain and maintain minimum Army requirements for computer access including, Cyber Awareness training and signing the Acceptable Use Policy. Contractor employees performing System Administrator functions must obtain and maintain minimum requirements for Privileged Access, including Baseline Certifications, Computer Environment Certifications and signing a Privileged Level Access Agreement. Contractor employees performing System Administrator functions shall have and maintain a SECRET clearance. System Administrators and Content Managers are appointed by the DPW Director.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contracting Officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance:

maintain written and oral communications with the Contractor concerning technical aspects of the contract.

Monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The following personnel are considered key personnel by the government: Help Desk Senior System Administrator, Senior Specific Product Specialist (ESRI GIS), Senior Internet/Intranet Webmaster, Mid-Level Database Administrator. Replacements to key personnel shall have the same qualifications and the COR and Contracting Officer will be notified in writing. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the COR. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 0700 to 1600 PST, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

1.6.11.1 Help Desk Senior System Administrator must have 5 years of experience with both servers and workstations, leading in a large, complex help desk/system administration function, must have Baseline and Computing Environment Certifications as specified in the Army Training and Certification Tracking Systems (ATCTS).

1.6.11.2 Senior Specific Product Specialist (ESRI GIS) must have demonstrated experience applicable to the Army environment in complex data editing, data modeling, data analysis, scripting (including web map scripting) and GIS system performance enhancements. This experience shall include 3 years using ArcGIS Pro software for data management, maintenance and analysis, 1 year using ArcMap extensions particularly Spatial Analyst and 3D Analyst, 1 year data management using ArcSDE, minimum 1 year administering an ArcSDE database, 1 year using SDSFIE data standards (version 2 or above) for data management, and 2 years of experience using scripts and Model Building in ArcMap and/or ArcServer to automate or customize ArcGIS Pro processes. Experience shall include data migration from other geospatial data sources such as AutoCAD, Microstation, LiDAR or other Remote Sensing data work.

Experience shall include acquiring and integrating data through the use of Global Positioning Technology (preferably Trimble) or related mobile technologies. This position requires a Bachelor’s degree in Geography, Geology, Urban Planning, Environmental Science, or similar/related field and a certificate in Geographic Information Systems (GIS).

1.6.11.3 Senior Internet/Intranet Webmaster must have a minimum 3 years of experience designing websites, generating and revising web pages, working with content contributors, and replying to user comments.

1.6.11.4 Mid-Level Database Administrator must have a minimum 5 years of experience Microsoft SQL Server database management including server operations, database user management and reporting services management.

1.6.12 Contractor Access. The contractor shall, prior to the contract start date, provide the sponsoring agency a list of employees who shall require access to JBLM to perform work. This notification shall include the employees’ last name, first name, middle initial and Social Security number. All contractor employees will require Common Access Cards (CAC) for access to JBLM and for access to the Army Network. CAC requests are made through the Trusted Associate Sponsorship System (TASS) and CACs are issued at Waller Hall, Building 2140. If an employee no longer needs a CAC for any reason (e.g., quits his/her job or is no longer performs work under the contract), the Contractor shall return the badge to the Contracting Officer’s Representative (COR), or his designee within two (2) calendar days of such change.

If the CAC cannot be returned within the required time frame for any reason, the contractor shall immediately notify the COR, or his designee verbally, followed up in writing the next work day. An employee’s inability to obtain entrance to a Government installation because he/she does not have the required Government provided CAC shall not excuse timely performance of the requirements of this contract. The Government may change the location(s) at which CAC's are issued or returned, with or without advance notice to the Contractor, at no additional cost to the Government as a result thereof.

Access and General Protection/Security Policy and Procedures for Access to the Installation: The contractor and all associated subcontractors’ employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by the Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. The contractor workforce must comply with all personal identity verification requirements as directed by DOD, Headquarters Department of the Army (HQDA), and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.12.2 Compliance with Rules, Regulations, and Statutes. All contractor employees shall observe and comply with all applicable local, State, and Federal rules, regulations, and statutes including those concerning fire, safety, sanitation, security, vehicle safety, and hazardous material handling.

1.6.12.3 Entrance Denial by Military Police. Contractor employees may be denied entry to the Installation by Military Police if it is determined that such entry may be contrary to good order, discipline, or the security of the Installation.

1.6.13 Contractor Travel: Contractor shall be required to travel during the performance of this contract to attend meetings, conferences, and technical training for specialized systems operating at DPW. The contractor shall be responsible for all travel and training costs as well as travel arrangements.

Contractor training/travel required each year to maintain certifications on government systems and commercial software. All tasks from para 5.2 through 5.2.12 require certifications per DoD 8140.03M Training opertunitiesoccur at varying Continental United States (CONUS) locations.

Additional contractor travel is required from JBLM to YTC or from YTC to JBLM for the contractor to provide training to DPW civilian employees or work with DPW GFEBS personnel. This local travel requiring an overnight stay is expected two times per year (TDY & transportation only).

1.6.13.1 Contractor Training and Certifications. The Contractor shall provide appropriately trained personnel and shall be responsible to ensure that necessary certifications are kept up to date in all relevant areas. The contractor shall be responsible to provide training in order to keep contractor personnel up to date in their areas of work before or within 6 months after release of new versions of operating systems or major software packages used in the exercise of this task. These costs are the responsibility of the contractor.

1.6.14 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.15 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.16 Government Business Communications and Content: For the purpose of performing work under this contract, the Contractor shall use only authorized Government-provided services for email, telecommunications, collaboration, and content management. In particular, the Contractor shall use Government email account for electronic messaging correspondence under this contract.

All work performed under this contract shall be conducted on and through a government-managed device operating on a government-managed network. Commercial internet service provider networks are not authorized for official government business.

1.6.16.1 Contractor Correspondence: All Contractor correspondence (telephone, oral presentation, written, facsimile, and email display) shall explicitly identify or announce themselves as a contractor and their company name. All email correspondence generated under this contract shall be conducted through a government email account.

1.6.17 Mission Essential Contractor Services: In the event of an Operational Emergency, it is possible that DPW will close its facilities temporarily to anyone who is not designated Mission Critical or Mission Essential. In the most severe instance, only Mission Critical personnel will be allowed in DPW facilities.

The contractor will be notified by the Contracting Officer if this happens. The contractor shall identify Mission Critical and Mission Essential personnel by memorandum and send this memorandum to the Contracting Officer and COR.

Mission Essential Tasks: All tasks in Paragraphs 5.2 through 5.2.12, 5.3, and 5.5 through 5.5.1 are Mission Essential. Data Analyst Services tasks in paragraph 5.8 performed at Yakima Training Center are Mission Essential tasks. The Procurement Support tasks in paragraph 5.9 are Mission Essential tasks necessary to support the DPW Engineering Services Division. Data Entry tasks in paragraph 5.9 are not Mission Essential.

Essential Tasks will be primarily performed on-site in DPW facilities. Some Essential Tasks may performed remotely by Telework using Government workstations if that is effective and if the Government provides support.

Contractor personnel not designated Mission Critical or Mission Essential may be allowed to telework from their residence if the tasks can be accomplished remotely and if the Government can support sufficient remote connections.

All Telework shall be performed on Government workstations. Each Government workstation will be signed out to an individual person. The user shall connect the Government workstation only to his/her home internet. Connection will not be made to public internet sources such as coffee shops. The Government cannot guarantee the level of service on remote connections. Services that are required on remote workstations shall be accomplished by returning the workstations to the DPW Help Desk. Special care shall be taken with sensitive information (paragraph 1.6.7.15) when Teleworking. Sensitive information shall be in a CAC encrypted folder and the users shall remove their CACs and lock the workstation when unattended.

Telework Equipment: The Contractor shall utilize, consume, move, and store Government Property only as authorized under this contract. The Contractor shall take all reasonable actions necessary to protect the Telework equipment from damage or loss. The Contractor shall investigate and report to the Government all incidents of damage or loss as soon as the facts become known.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.2. Above Baseline Services. Any software/hardware services not provided through the NEC’s AITSC are above baseline support that are not provided by the NEC.

2.2.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.2.2 CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.2.3 CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.2.4 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.2.5 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.2.6 DPW PERSONNEL. All persons working at DPW including civilian personnel, Service members and contractor employees.

2.2.7 KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS.

2.2.8 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.2.9 QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.2.10 QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.2.11 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.2.12 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2.13 WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.2.14 WORK WEEK. Monday through Friday, unless specified otherwise.

2.2 ACRONYMS:

ACOR Alternate Contracting Officer’s Representative AFARS Army Federal Acquisition Regulation Supplement AR Army Regulation AITSC Army Information Technology Service Catalog BOID Business Operations and Integration Division C4IM Command, Control, Communications, Computers, and Information Management replaced by Army IT Portfolio CAD Computer Aided Design CCE Contracting Center of Excellence CFR Code of Federal Regulations CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer’s Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf CUI Controlled Unclassified Information DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD Form 254 Department of Defense Contract Security Requirement List Defense Information System for Security DFARS Defense Federal Acquisition Regulation Supplement DISS Defense Information System for Security DMDC Defense Manpower Data Center DOD Department of Defense DPW Directorate of Public Works ESD Engineering Services Division FAR Federal Acquisition Regulation FOB Forward Operating Base GIS Geographic Information System HIPAA Health Insurance Portability and Accountability Act of 1996 CS CybersecurityCybersecurity IT Information Technology KO Contracting Officer JBLM Joint Base Lewis-McChord NEC Network Enterprise Center OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SSP System Security Plan TE Technical Exhibit YTC Yakima Training Center

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. “GOVERNMENT FURNISHED” ITEMS AND SERVICES:

3.1. Not applicable.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. “CONTRACTOR FURNISHED” ITEMS AND RESPONSIBILITIES:

4.1 The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform IT & Support Services at Joint Base Lewis-McChord (JBLM) Directorate of Public Works (DPW) as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. Basic Services.

5.2 The contractor shall perform Cybersecurity services, above baseline hardware support, above baseline software support and user management throughout DPW.

5.2.1 Desktop Support - The contractor shall set up, configure, maintain, troubleshoot, and perform information assurance for computers. Computer hardware consists primarily of standard commercial desktop, notebook and tablet computers typically with 3-year warranty. Most computers are running Microsoft Windows operating system, makes and models vary. Upgrades to newer operating systems and software are executed as available and as certified by the Army.

5.2.2 Printers and Scanners Support – The contractor shall set up, configure, maintain, troubleshoot, and perform information assurance for printers and scanners. Most printers are Hewlett-Packard brand.

Scanners include desktop and wide format scanners.

5.2.3 Servers Support – The contractor shall set up, configure, maintain, troubleshoot, and perform information assurance for physical and virtual servers to include updating all System Security Plan (SSP) documentation. The contractor shall maintain drive and folder permissions for DPW data on DPW computers, servers and on other systems where control belongs to DPW.

5.2.4 Industrial Controls Systems Support – The contractor shall maintain the computer hardware and software. This includes computer operating systems, and electronic communication/networking portionsinclude: servers, workstations, network troubleshooting, user accounts and information assurance.

Operation and maintenance of Industrial Control Systems/Facility Related Control Systems include but not limited to: Direct Digital Control (DDC) System to monitor and control Heating Ventilation and Cooling (HVAC) systems in approximately 350 buildings at JBLM McChord Airfield Lighting System;

Keyless Entry. The contractor shall maintain the IT portion of additional smaller systems such as fuel control, compost temperature monitoring and various other platform information technology systems.

These systems operate with varying software and hardware configurations. Daily support for maintenance and troubleshooting of non-Windows devices will be performed by the contractor such as maintaining connectivity, initial troubleshooting, backups and data management. Reprogramming or replacement of non-Windows devices is provided by others. The Industrial Control Systems have their own networks of varying size belonging to DPW which the contractor shall maintain, troubleshoot and operate. Per DoDI

8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), and AR 25-2 Army Cybersecurity the contractor will maintain 100 percent of the active and ongoing iterations of Industrial Control Systems (ICS) under the DPW prevue to include transportation to site locations to collect, manage, and document all system data relevant to the requirement deliverable to the government POC for further processing.

5.2.5 User Support - The contractor shall provide user support to include responding to user requests;

troubleshooting user issues; enabling, maintaining and disabling user accounts & permissions in coordination with the AITSC providers; technical assistance with computer-based training; technical assistance with remote systems; coordinating with AITSC service providers. Location of support across JBLM, Washington. For the purposes of this contract, JBLM is defined as JBLM-Lewis Main, JBLM- Lewis North, and JBLM-McChord Field. JBLM is a United States military installation located within Pierce, Thurston, Kittitas, and Yakima counties in Washington State. . Support is accomplished by remote access when possible and by walking or driving to the user as necessary.

5.2.6 User Request Process - The contractor shall receive requests by phone, email or in-person for support from DPW personnel, and enter request into a ticket system, troubleshoot and resolve problem. Requests shall be prioritized in accordance with the Computer Help Desk Response Prioritization Matrix (to be provided upon contract award), which set requirements for notification, response time and completion time.

Contractor shall maintain request status, through completion, in Government provided tracking system.

Support is provided, as necessary, to upgrade existing or implement new DPW systems, as necessary, on JBLM and at the Yakima Training Center; all other support is provided by phone or email.

5.2.7 System Administration - Contractor shall perform above baseline services that are not provided by the NEC’s AITSC system administration duties on DPW IT equipment, to include but not limited to all DPW purchased and owned computers, printers, scanners, etc… which includes Industrial Control systems outlined in para 5.2.4 of this PWS. Contractor services to be provided include moving & setting up computers, updating operating system & software, user management, license management, assisting users in new user processes, printer configuration, troubleshooting equipment, managing physical maintenance of equipment including monitoring warranties, calling for warranty repair when needed and for repair of non-warranty equipment. DPW will be responsible for procuring non- warranty repair parts and consumables. Contractor shall monitor operational health of the workstations, servers, printers and other equipment. Contractor shall administer user permissions, backups, security updates, security monitoring. The contractor shall take appropriate steps to ensure that safeguards are in place at all times to protect sensitive information. The Contractor shall work closely with the NEC and other service providers.

5.2.8 Configuration Control - The Contractor shall maintain documentation of system status and configuration to include: server status, services, software, settings and patches; desktop and notebook computer software, settings and standard builds; network diagrams and identification of network cables and outlets. The contractor shall maintain the software media. The Contractor shall apply Army Security Technical Implementation Guides (STIG) to properly configure hardware and software while providing updated digital checklist files (.ckl) through the DISA Stig Viewer application or equivalent acceptable application. The contractor will update and maintain SSP documentation in the location provided by the government POC.

5.2.9 Equipment/Warranty Tracking, Disposal, and Lifecycle - The contractor shall perform equipment management at DPW to include adding and removing equipment to property book hand receipts and tracking current location of equipment’s physical location along with utilizing DA forms 3161, and 2062.Computers are usually retired after 3 to 4 years. Help Desk personnel issue machines, track warranties, track their location and turn them in for disposal at the Installation Property Book Office (building 9660) which require transportation large enough to hold equipment being turned in with the PBO office. The contractor shall destroy/dispose of computer hard drives at NEC building 9665, or location specified by the government POC. DPW conducts a one third lifecycle of computer hardware every year to satisfy the continuous 3-year lifecycle routine. Upon receipt of new lifecycle computer hardware, the contractor will work with DPW’s users and create a schedule delivered to the COR no later than 10 calendar days and conduct lifecycle of computer hardware to meet the ongoing DPW standard of completion no later than 90 calendar days of computer hardware received.

5.2.10 Army Cybersecurity (CS)Cybersecurity - All CS requirements shall be met at all times. CS alerts shall be acknowledged and completed by the designated date and time. Cybersecurity applies to hardware, software and user management. The contractor shall provide services to assist in management of user accounts on various systems. The contractor shall assist users to comply with Army Minimum Requirements including Cyber Awareness training, acceptable user agreements and system access requests.

5.2.11 Mobile Device Support – Contractor shall provide support for mobile devices at PW. Mobile devices are typically Windows tablets or notebook computers connected via cellular internet…