DRAFT PWS Energy Management Control System JB Andrews -13 Jan 2026.pdf

DRAFT Performance-based Work Statement (PWS) For

316th Civil Engineering Squadron Energy Management Control System Services

Joint Base Andrews

316th Civil Engineering Squadron Date: Created/Edited 13 Jan 2026 Draft / Revision #5

TABLE OF CONTENTS

1.0 DESCRIPTION OF SERVICES

• 1.1 Scope

• 1.2 Tasks

• 1.2.1 EMCS Operations and Management

• 1.2.1.1 System Monitoring and Performance Analysis

• 1.2.1.2 Energy Management Support

• 1.2.1.3 Technical Support

• 1.2.1.4 HVAC System Modifications

• 1.2.1.5 Network Outages

• 1.2.1.6 EMCS Equipment/Power Outages

• 1.2.1.7 Software and Firmware Updates

• 1.2.1.8 Training

• 1.2.1.9 Reporting Requirements

• 1.2.1.10 Preventive Maintenance Program

• 1.2.1.11 System Backups and Diagnostics

• 1.2.1.12 Annual Facility Inspections

• 1.2.1.13 Graphics Creation

• 1.2.1.14 Estimated Quantities

• 1.2.2 Cybersecurity

• 1.2.2.1 Topology/Inventory

• 1.2.2.2 Compliance and Governance

• 1.2.2.3 Flaw Remediation and Patch Management

• 1.2.2.4 Configuration Management

• 1.2.2.5 Cybersecurity Controls

• 1.2.3 Emergency Services

• 1.2.4 Reimbursable Parts and Materials

• 1.2.5 System Upgrades, Replacements, and Expansion

2.0 CONTRACTOR REQUIREMENTS

• 2.1 Contractor Requirements

• 2.1 General

• 2.2 Key Personnel

• 2.3 Industrial Security

• 2.4 Submission of Qualifications

• 2.5 Privileged User Requirements

3.0 GENERAL INFORMATION

• 3.1 Quality Control Program

• 3.2 Quality Assurance

• 3.3 Normal Hours & Holidays

• 3.4 Physical Security Requirements

• 3.5 Key Control

• 3.6 Performance of Services During Crisis

• 3.7 Prohibited Items (Weapons, Illegal Substances)

• 3.8 Warranty Replacement

• 3.9 Police, Fire, and Medical

4.0 SERVICES SUMMARY

5.0 SERVICE DELIVERABLES CHART

APPENDICES

• Appendix A: Estimated Workload Data

• Appendix B: Estimated Workload Data - Modular Building Controllers

DESCRIPTION OF SERVICES

1.1 Scope. The contractor shall provide all personnel, labor, equipment, tools, materials, transportation, supervision, and other items and services necessary to operate, maintain, repair, and upgrade the Energy Management Control System (ECMS) for the 316th Civil Engineering Squadron (316 CES) at Joint Base Andrews, as well as two satellite locations in Brandywine and Davidsonville Maryland.

Contractor personnel shall be responsible for operating the EMCS, aiding technicians, modifying HVAC systems, responding to outages, updating EMCS software, performing maintenance and repairs to the EMCS system/components, and providing cybersecurity services.

1.2 Tasks

1.2.1 EMCS OPERATIONS AND MANAGEMENT [CLIN 0001]

The objective of this task is to ensure the EMCS is operating at peak efficiency, providing a comfortable and safe environment for facility occupants while maximizing energy conservation. This task includes all actions necessary to operate heating, ventilation, and air conditioning (HVAC) equipment to minimize total operating costs. This includes, but is not limited to, test and evaluation, integration, execution, construction, operation, maintenance, sustainment, operation control, and adjustment of EMCS equipment; monitoring and control of HVAC equipment; remediation of alarm conditions; maintenance and inspection of EMCS equipment; maintaining logs and producing reports; and assisting in the troubleshooting of HVAC equipment. The contractor shall perform recordkeeping of operations and conditions, analysis of records to correct non-optimal practices, monitor warranties, test operations and capabilities of equipment, periodic operation and inspection of EMCS equipment, purchasing of supplies (parts & materials), cleaning, preservation, calibration, and adjustment to the EMCS equipment. All work will be in compliance with Unified Facilities Criteria (UFC) Cybersecurity of Facility-Related Control Systems and the latest Department of the Air Force Guidance Memorandum, Civil Engineering Control System Cybersecurity DAFGM2022-32-01.The EMCS currently installed at JBA, MD is Siemens Building Technologies, Landis Division, Insight System 600 with Desigo/Apogee software that controls the base-wide Direct Digital Control (DDC) system components located in remote cabinets.

1.2.1.1 System Monitoring and Performance Analysis. The Contractor shall perform daily on-site monitoring of the EMCS system to ensure optimal performance. This includes, but is not limited to, routine performance analysis as well as conducting root cause analysis of any system alarms, faults, and operator overrides to identify and resolve system issues promptly. The Contractor shall utilize system trend data to verify and optimize building system performance, identify operational deficiencies, and recommend corrective actions to the Contracting Officer’s Representative before they result in critical failures. NOTE: Access to the Energy Management Control System and Industrial Control Systems (ICS) from outside Joint Base Andrews (JBA) is strictly prohibited. These systems operate within an air-gapped network, ensuring they remain isolated from external connections for security purposes. As a result, remote connectivity is not authorized under current security policies.

1.2.1.2 Energy Management Support. The Contractor shall provide direct support to the Base Energy

Manager and other authorized Government personnel. Key support functions include assisting with the execution of seasonal HVAC system change-overs, administering temperature set-point policies across facilities, and implementing power shedding energy load (demand response) procedures.

1.2.1.2.1 Power Shedding Energy Load (demand response). The contractor will assist the Energy Manager within a four-hour notice before the actual event. There will be no more than 10 events in a year, lasting up to eight hours per event. Power Shedding actions will include implementation of night setbacks, chiller cycling, adjusting lighting schedules, and monitoring generators. After each event, all systems must be returned to normal operating conditions.

1.2.1.3 Technical Support. The contractor shall provide onsite troubleshooting, diagnostics, and repair of

EMCS malfunctions and failures during normal Government duty hours (defined as 0730 to 1630, Monday through Friday, excluding Federal Holidays). Contractor shall utilize EMCS equipment resources and provide information as required to assist service technicians (Government or other contractor personnel) in troubleshooting malfunctions and failures in equipment controlled or monitored by the EMCS, i.e. problem equipment and controllers, map control points at building level and EMCS head, trouble shoot network issues with Communications and Civilian Engineer Squadrons, understand HVAC systems, processes, and sequences, and any field devices. This includes configuring the EMCS equipment to produce logs, trends, system graphics, and graphs as necessary. The contractor shall obtain 316th CES Configuration Control Board (CCB) approval before implementing corrections for failed system software communication pathways. The Contractor shall be capable of executing demand response actions upon request from authorized Government personnel, with a target execution time within four (4) hours of notification. For all routine service requests, the Contractor shall initiate a response by the next business day. Note:

Emergency Support is not included in this sub-task, but rather under PWS task 2.1.3/ Contract Line-Item Number (CLIN) 4.

1.2.1.4 HVAC System Modifications. The contractor shall install, program, edit, and modify hardware and software configurations and control sequences as necessary to accommodate HVAC system modifications and optimize system performance per UFC and industry best practices, and train Government personnel when requested for new systems. The contractor will make no changes to the systems hardware or software configuration without first informing the ISSO and ISSM and gaining approval IAW the CCB and CMP guidance.

1.2.1.5 Network Outages (Re-stablishing Connectivity). The contractor shall notify the Communications Squadron Focal Point (CS Focal Point) of an outage within (2) hours of identification by creating a support ticket using the “Service Now” (EITaaS) system, and then e-mailing the CS Focal Point (email address). Then notify 316 CES IT staff via email at (email address) of the situation, provide the ticket number, and courtesy copy the COR. The contractor’s e-mail shall contain the building number, JACE identifier, Internet Protocol (IP) Address and Media Access Control Address (MAC), as well as a contact name and phone number to expedite processing. The CS Focal Point shall then address the support ticket. Where the outage is determined to be at the building JACE level the contractor shall actively assist CS and CES users to return the building JACE to network connected conditions until the building JACE is recognized at the EMCS server.

1.2.1.6 EMCS Equipment/Power Outages. Where an outage is determined to be caused by an EMCS equipment failure the contractor shall notify 316 CES IT staff via email at (email address) of the situation and courtesy copy the COR. The contractor’s e-mail shall contain the building number, JACE identifier, and description of the outage cause. The contractor shall check the JACE uninterruptible power supplies (UPS) at each building location at a minimum of once per year, verify the status and condition of the UPS, and replace the UPS when there are signs of failure or degraded performance.

1.2.1.7 Software and firmware updates. The contractor shall provide, install, and configure updates to operational software and firmware as required, including workstation, server, and network manager, at no additional cost to the Government. The contractor will test all updates related to flaw remediation for effectiveness and potential side effects before installation. The contractor shall comply with AFI 17-101 and all applicable existing standards and policies, including the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, UFC 04-010-06, NIST SP 800-82r2, Guide to Industrial Control Systems (ICS) Security, NIST SP 800-53r4 (or subsequent guidance from this memo), Security and Privacy Controls for Information Systems and Organizations.

1.2.1.8 Training. Upon request, the contractor must provide five hours of monthly familiarity training to base Civil Engineer technicians in troubleshooting EMCS.

1.2.1.9 Reporting Requirements. The Contractor shall be responsible for the timely and accurate submission of all required operational reports.

• Daily Alarm Report: The Contractor shall generate and deliver a daily report summarizing all EMCS alarms, faults, and overrides to the COR and the 316th CES Infrastructure and Facilities Superintendents for trend analysis and fault isolation.

Existing faults in trend data must be archived on the server until repairs are corrected.

• Monthly Energy Report: The Contractor shall submit a monthly electrical consumption and demand report for all metered facilities to the Base Energy Manager no later than the fifth working day of each month.

• System Inventory: The Contractor shall maintain a complete hardware and software inventory list for the entire EMCS. This inventory shall be delivered on a quarterly basis to the Contracting Officer Representative (COR) and the Information System Security Manager (ISSM). The contractor shall also provide an updated list when they make any changes to the system hardware/software.

1.2.1.10 Preventative Maintenance. The Contractor shall develop, implement, and manage a comprehensive Preventive Maintenance (PM) program to ensure the continuous and optimal performance, reliability, and longevity of the Energy Management Control System (EMCS). This program shall be based on the equipment manufacturer's recommendations for all EMCS components, including but not limited to the central Desigo/Apogee servers, network switches, Uninterruptible Power Supplies (UPS), and all field-level controllers and devices.

Preventive Maintenance Schedule. Within fourteen (14) calendar days after contract award, the Contractor shall submit a detailed Preventive Maintenance Schedule to the Contracting Officer’s Representative (COR) for approval. This schedule shall outline all planned PM activities and their frequencies for the entire performance period. The Contractor shall provide a monthly report to the COR detailing all PM actions completed, any deficiencies found, and corrective actions taken in the following format:

a. Proposed Actions: Include a detailed description of each vulnerability and actions: Resolve, Mitigate, Accept with dates and owner’s representatives (ISO, Information System Security Manager (ISSM), Information System Security Office (ISSO), and COR)

b. Status: Draft, Pending Approval, Expired, Completed

c. Risk: High, Medium, Low

d. Status: Pending, Approved

1.2.1.11 System Backups and Diagnostics. The Contractor shall perform full backups of the EMCS to safeguard system data and configurations. At a minimum, quarterly backups of all field panel databases, historical trend data, central system software (including the Insight 600 Graphics database and all Desigo/Apogee application data) shall be completed. Backups shall be stored in a secure, government-approved location. In the event of memory failure, the contractor must reload the database and system files and provide the ISSM with an updated copy of the database. The contractor must also perform panel diagnostics following manufacturer requirements. Annually, the Contractor shall perform and document full diagnostic checks on all field panels to verify hardware integrity and test the operational status and battery health of all associated UPS units.

1.2.1.12 Annual Facility Inspections. The Contractor shall conduct and document a comprehensive inspection of each facility connected to the EMCS at least once per contract year. The purpose of this inspection is to verify that all EMCS-connected equipment is functioning in accordance with the designed sequence of operations. This includes, but is not limited to, validating point-to-point functionality, calibrating sensors and actuators as needed, confirming correct device-to-panel communication, and ensuring all control sequences respond as programmed. The Contractor shall document all inspection results and provide a summary of findings and any corrective actions performed to the COR.

1.2.1.13 Graphics Creation. The contractor shall create or modify graphics displays when modifications, installations, maintenance, or repairs to the system have been completed to ensure the system graphics interface with system software is consistent with the JBA EMCS currently in use. The contractor must perform graphic creation and/or modification within five working days of notification.

1.2.1.14 Estimated Input/Output Points and Buildings with DDC Controls. Quantities are expected to increase approximately five percent per year for the life of the contract. Appendices A and B provide current estimated workload.

***The labor required to maintain and/or repair EMCS components, not to include upgrades or replacements when warranted, will be covered under the monthly contract line item number (CLIN) 1. No additional labor will be authorized without written consent from the Contracting Officer.***

1.2.2 CYBERSECURITY [CLIN 0002]

1.2.2.1 Topology/Inventory. At the beginning of the contract, the contractor will provide the

Cybersecurity team with the Vendor’s topology and a hardware/software list which reflects the topology. The contractor shall provide an updated data flow diagram and updated hardware/software list to the ISSO and ISSM whenever any changes or updates are made.

1.2.2.2 Compliance and Governance. The Contractor shall be responsible for ensuring the EMCS maintains full compliance with all applicable Department of Defense (DoD), Air Force, and local installation cybersecurity policies, procedures, and regulations. The EMCS is a Platform IT (PIT) system and must be managed as such. The Contractor shall provide all necessary support to achieve and maintain the system’s Authority to Operate (ATO) under the Risk Management Framework (RMF). The contractor shall participate in annual AFCEC Incident Response Tabletop Exercises upon notification by the COR.

The Contractor shall ensure all hardware, software, and configurations comply with, at a minimum, UFC 4-010-06: Cybersecurity of Facilities-Related Control Systems, DoDI 8500.01:

Cybersecurity, and DoDI 8510.01: Risk Management Framework for DoD Information Technology. All work performed on the system must align with the security controls and configurations outlined in the system’s approved RMF package.

1.2.2.3 Flaw Remediation and Patch Management. The Government will perform quarterly vulnerability scans of the EMCS network and components using tools such as the Security Content Automation Protocol (SCAP) scanner or the Assured Compliance Assessment Solution (ACAS).

The government will provide the scan results to the contractor, who will mitigate all identified vulnerabilities and non-compliances provided they do not adversely affect the system. The contractor will notify the ISSM when mitigations have been completed; The contractor will advise the ISSO and ISSM via an MFR of any mitigations that cannot be applied because they will adversely affect the system. This includes the application of all relevant Security Technical Implementation Guides (STIGs) and Information Assurance Vulnerability Management (IAVM) directives.

The Contractor shall remediate all identified vulnerabilities in accordance with DoD-mandated timelines, which are typically within 30 calendar days for Critical and High findings, and 90 calendar days for Moderate findings, from the time of notification. The contractor will test software updates and firmware updates related to flaw remediation for effectiveness and potential side effects before installation.

1.2.2.4 Configuration Management. No modifications to the EMCS hardware, software, firmware, network firewall rules, or system configuration shall be made without prior review and written approval from the Government’s Configuration Control Board (CCB). The Contractor shall document all proposed changes and present them to the CCB for evaluation to ensure they do not introduce security risks or deviate from the approved system baseline.

1.2.2.5 Cybersecurity Controls. The contractor shall follow AFCEC Authorizing Official's (AO) baseline of Security Controls with Assessment Procedures (APs) and will perform and provide the Cybersecurity team with:

1.2.2.5.1 Access Control and Account Management. The Contractor shall adhere to the principle of least privilege for all user accounts. All Contractor personnel requiring privileged access to the EMCS server or network components must be approved by the Government and meet the IAT Level II certification requirements as defined in Section C.4.1. The Contractor shall assist the Government in the annual review of all system accounts to ensure they are still required and have the appropriate permissions.

1.2.2.5.2 Administrative access to all EMCS computers and servers must be granted to the ISSM and ISSO to run scans within 5 business days of the ISSM request.

1.2.2.5.3 Malicious Code Protection. The Contractor shall ensure that all system components, including servers and workstations, are protected by Government-approved antivirus and anti-malware software. The Contractor is responsible for ensuring that all security software signatures are updated automatically and at least daily.

1.2.3 EMERGENCY SERVICES [CLIN 0003]

1.2.3.1 Emergency Service Support. The Contractor shall provide on-site emergency service support 24 hours per day, 7 days per week, 365 days per year (24/7/365). An "Emergency" is defined as a critical system failure that directly impairs a mission-essential facility, poses a risk to life or safety, or could result in significant damage to Government property. The Contractor shall have a qualified technician on-site within two (2) hours of receiving notification of an emergency. Upon arrival, the technician shall diagnose the failure, report the status to the COR or designated Government representative, and initiate immediate corrective action to restore the system to an operational status as quickly as possible.

1.2.3.2 Emergency Service Calls shall be invoiced on CLIN 0003 Emergency overtime. Estimated annual overtime for Service Calls (after hours/weekends/holidays) is 60 hours per year.

1.2.3.3 The unit of measure for Emergency Service Call CLINs is per service hour not per man-hour. For example, if you bring in two technicians to work on an emergency and they both work eight hours, you can only charge eight hours and not sixteen for that service.

1.2.4 REIMBURSABLE PARTS AND MATERIALS [CLIN 0004]

1.2.4.1 The Contractor shall be responsible for the procurement of all new parts, components, and materials required for the maintenance, repair, and replacement of EMCS equipment under this contract. All parts shall be procured on a reimbursable basis. Procured parts must be on the DISA Approved Products List (disa.mil).

1.2.4.2 Reimbursement at Cost. The Government will reimburse the Contractor for the actual cost of parts and materials with no additional markup, fees, or handling charges. The Contractor agrees to pass on any and all savings, including trade discounts, bulk purchase savings, and rebates, to the Government

1.2.4.3 Quotation and Approval. For any single part or a collective group of parts for a single service action estimated to exceed $1,000, the Contractor shall obtain a written quote and provide it to the COR for approval prior to procurement. For parts under this threshold, the Contractor may proceed with the purchase without pre-approval to ensure service timeliness.

1.2.4.4 Invoicing for Reimbursement. To receive payment, the Contractor shall submit original, itemized vendor receipts and invoices to the COR along with their monthly invoice. Each submission must clearly identify the service call or maintenance action for which the parts were used. Payment for parts shall be paid under Contract Line-Item Number (CLIN) 4 and must be invoiced in accordance with the contract instructions.

1.2.5 SYSTEM UPGRADES, REPLACEMENTS, AND EXPANSION [CLIN 0005]

1.2.5.1 The Contractor shall provide services for the upgrade, replacement, and expansion of the EMCS.

Work under this section is distinct from routine maintenance and repair and will be initiated as separate, funded task orders under CLIN 0005 of this Indefinite Delivery, Indefinite Quantity (IDIQ) contract. When such work is needed, the government will provide the contractor with a separate PWS for upgrade or replacement requirements, whereupon the contractor will provide their proposal for this work inclusive of all material and labor costs. The contractor’s quote will be reviewed for technical acceptability and price fair and reasonable, whereupon a task order will be issued for the work.

1.2.5.2 All work shall be designed and executed to enhance system capability, replace obsolete components, or expand the EMCS footprint while maintaining full compatibility and cybersecurity compliance with the existing Desigo/Apogee architecture.

1.2.5.3 Definitions. For the purpose of this contract, the following definitions apply:

• A bona fide “hardware repair” is defined as fixing a non-operational part of a piece of equipment or device to make the equipment or device fully operational.

• A bona fide “software repair” or “software update” is to change settings, install patches or firmware updates, or reset the software to factory conditions for reprogramming at the equipment, device, workstation, or server level.

• A “replacement” is defined as replacing a non-operational piece of equipment or device with a new one of the same make and model.

• An equipment or device “upgrade” is defined as replacing a non-operational or operational piece of equipment, or device with a newly purchased piece of equipment or device in full.

• A software “upgrade” is defined as the installation of a newer software version that significantly improves or alters the existing software including, but not limited to, new features, functionality, and license key, in place of a prior software version that is no longer used at the equipment, device, workstation, or server level.

1.2.5.4 System Design and Installation. The Contractor shall be responsible for all aspects of system design and installation for approved upgrade, replacement, or expansion projects. All designs must be fully compatible with the current and future updated versions of the EMCS/ICS. EMCS sequence of operation for all cabinet operations must use JBA established set point determined by the Energy Manager. The contractor must provide a proposed cost of explicitly compatible equipment and explicitly compatible software to be installed submitted to the COR and the Government’s cybersecurity office for approval prior to the procurement or installation of any equipment. The Contractor shall ensure that all new hardware and software are fully compatible with the existing Desigo/Apogee system, adhere to all applicable Unified Facilities Criteria (UFC), and meet the cybersecurity requirements of AFCEC and the Risk Management Framework (RMF).

1.2.5.5 Programming and Graphics. Upon installation of new hardware or software, the Contractor shall perform all necessary programming to integrate the new components into the EMCS. This includes creating or modifying system graphics within the Desigo/Apogee user interface to provide a complete and accurate visual representation of all system changes, ensuring that operators have seamless control and visibility of the new components. All new graphics and programming shall be reviewed and approved by the COR.

2 CONTRACTOR REQUIREMENTS

2.1 The Contractor shall provide personnel who possess the necessary knowledge, skills, and abilities to ensure the EMCS is operated and maintained in a professional and effective manner. The contractor must employ individuals who possess state and federal certification to handle refrigerants when required. Contractor EMCS technicians must read, write, speak, and understanding English fluently.

2.2 Key Personnel. The Contractor shall designate personnel to fill the following key roles, who must meet or exceed the qualifications listed below.

2.2.1 EMCS Service Administrator: This individual shall be the primary technical point of contact for all contract operations.

• Experience: A minimum of five (5) years of documented experience in the installation, maintenance, and troubleshooting of energy control systems, preferably on large-scale federal or military installations and/or with Siemens Desigo/Apogee control systems.

2.2.2 EMCS IT Administrator: This individual shall be responsible for the administration of the EMCS server, network components, and ensuring compliance with all DoD cybersecurity requirements.

• Experience: A minimum of five (5) years of documented experience in system or network administration within a DoD environment.

• Certification: Must possess a baseline Information Assurance Technical (IAT) Level II certification (e.g., CompTIA Security+) in accordance with DoD Directive 8570/8140.

2.3 Industrial Security. Contractor personnel assigned to this contract who shall have privileged access to Government systems must meet investigative requirements of DoDM 8140.03, Cyberspace Workforce Qualification and Management Program, and DoDM 5200.02_DAFMAN 16-1405 Table 2 (T3), Department of Air Force Personnel Security Program. All contractor personnel shall also comply with Operations Security (OPSEC) requirements asset forth in DoD Directive 5205.02E, DoD Operations Security (OPSEC) Program and AFI 10-701, Operations Security (OPSEC). Application and cost for the appropriate Personnel Security Investigation (PSI) is the responsibility of the contractor. All contractor employees performing services under this contract must be US citizens.

The contractor may be required to provide employee background information to comply with contract requirements including Common Access Cards (CACs) and building access badges. Clearance Revocation/Suspension. If the contractor is notified by any Government official having security cognizance over the contract that a contractor employee’s Security Clearance has been revoked or suspended, the contractor must notify the CO the same day the contractor receives the notice, and all access for the contractor employee must be revoked.

2.4 Submission of Qualifications. The Contractor shall submit resumes and copies of all required certifications for all personnel to the COR for verification prior to the commencement of work. The Contractor shall provide the same documentation for any proposed new or replacement personnel for the duration of the contract.

2.5 Contractor Employees working on the EMCS/ICS systems in an admin capacity shall complete the

Privileged User Cybersecurity Responsibilities training (https://public.cyber.mil/training/privileged-user-cybersecurity-responsibilities/) and provide the training certificate to the ISSM and ISSO who will upload them into eMASS as artifacts. Contractor Employees shall also Sign user agreement, stipulating authorized actions or procedures to be performed on associated named system (include eMASS ID) and type of account(s) required to perform needed actions, and sign DD Form 2875, System Access Authorization Request, with “Authorized User” selected.

3 GENERAL INFORMATION.

3.1 QUALITY CONTROL PROGRAM. In compliance with Federal Acquisition Regulation (FAR), clause 52.246-4, Inspection of Services – Fixed Price, the contractor shall maintain a quality control program to ensure services are performed in accordance with commonly accepted commercial practices and services identified in this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-performance and continual repeat of defective service does not occur. The contractor shall submit their quality control plan to the Contracting Officer and COR, no later than 30 days after contract award for acceptance. The plan shall include:

• A description of the inspection system to cover all services listed in the PWS. Description will include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, https://public.cyber.mil/training/privileged-user-cybersecurity-responsibilities/ https://public.cyber.mil/training/privileged-user-cybersecurity-responsibilities/ frequency of inspections, submission of quality control scheduling, and the title and organizational placement of the quality control inspectors.

• A description of the methods to be used for identifying and preventing defects in the quality of service performed before the level of performance becomes unacceptable.

• A description of the records to be kept to document inspections and corrective or preventive actions taken.

• A description of the records which shall be required to monitor EMCS for efficient and effective operations.

• A procedural document demonstrating that a contractor understands the requirements of operating and preventive maintenance procedures respect

3.2 QUALITY ASSURANCE: The Government shall inspect and evaluate the contractor’s performance by appointing a COR to monitor performance and to ensure services are received and an ISSM to monitor cybersecurity-related obligations. The COR will evaluate the contractor’s performance through intermittent on-site inspections of the contractor's quality control program and receipt of complaints from base personnel. The Government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. Likewise, the Government may decrease the number of quality control inspections if merited by performance. The government will periodically inspect the environmental condition of selected buildings, including the central computer console center, to ensure compliance with regulatory standards and maintenance of comfortable conditions in buildings under the control of the EMCS. The COR will be responsible for validating customer complaints.

3.3 NORMAL HOURS: Normal duty hours are 0730 - 1630, Monday through Friday. The contractor must be able to be contacted at all times. Contact phone numbers must be provided to the CO and COR before the start of the contract. Phone numbers must be local or toll-free.

HOLIDAYS: The contractor is not required to provide normal service on the following days: New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Independence Day, Juneteenth Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas Day, Presidential Inauguration Day.

3.4 PHYSICAL SECURITY REQUIREMENTS: The contractor shall comply with all requirements and procedures IAW AFFAR 5353.242-9000, Contractor Access to Air Force Installations. All documentation shall be submitted at the pre- performance conference. The contractor must safeguard all Government property and materials provided for contractor use. The contractor will be responsible for the actions of his employees and the subcontractor’s employees while performing work under this contract on the installation. In addition, the contractor agrees to abide by all security regulations and procedures, as stipulated by the Security Police, and to surrender all permanent type passes issued to him, according to this paragraph, upon completion of this contract. The contractor must submit an original written request on company letterhead for each employee to the COR specifying employee name, social security number, home address, employer, vehicle tag number, and state when performing work under this contract. Short-term base access or contractor identification cards will be obtained for all employees including subcontractors. The contractor’s employees must have possession of their pass at all times while working on the installation. The contractor must return any pass when employment and/or contract is terminated. Lost or stolen passes will be reported in writing immediately to the CO and COR. Additionally, Government-issued passes must be returned upon the employee's separation or the termination of the contract; whichever comes first. Failure to do so may result in the withholding of fund payment.

3.5 KEY CONTROL. The contractor shall establish and implement methods of ensuring that all keys issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The contractor must not duplicate any Government-provided keys. The contractor shall report the occurrences of lost or duplicated keys to the COR or CO immediately upon discovery. If the keys are lost or duplicated, the contractor shall reimburse the Government to re-key or replace the affected lock.

3.6 PERFORMANCE OF SERVICES DURING CRISIS DECLARED BY THE NATIONAL

COMMAND AUTHORITY OR OVERSEAS COMBATANT COMMANDER. All activities must continue uninterrupted according to the Department of Defense Directive 3020.37, Continuation of Essential DOD Contractor Services during Crisis.

3.7 WEAPONS: Weapons of any sort are not authorized on JBA, MD. This includes, but is not limited to pistols, shotguns, assault rifles, rifles, knives, swords, nun chucks, brass knuckles, or any other instrument designed with the purpose to injure or maim. Combination tools such as a Leatherman and small pocketknives with folding blades less than four inches are authorized if used in the performance of duty. If there are any questions concerning authorization of an item, the contractor will verify with the Non-Commissioned Officer in Charge at JBA, MD Visitor Control Center before transporting the item on the installation. Those found in violation of directives are subject to apprehension, criminal charges, and debarment from the installation.

ILLEGAL/CONTROLLED SUBSTANCES. The United States Federal Government is the most vocal opponent of the drug industry, and it has set the de facto international standards regarding the legality and illegality of different drugs. Illegal controlled substances and narcotics are not authorized on JBA, MD. Controlled substances may not be transported on the installation via vehicle or on a person. Marijuana / Cannabis, cocaine, crack cocaine, LSD, Methamphetamine (Meth), Heroin, Anabolic steroids, and psilocybin mushrooms are some examples of forbidden substances (this list is not all-inclusive). Prescription medications are authorized for the person to whom the medication is issued; however, the medication must not be expired, and the label must indicate the name of the person to whom the medication is issued. Otherwise, the prescription medication may be deemed illegal by law enforcement officials. Those found in violation of directives are subject to apprehension, criminal charges, and debarment from the installation.

3.8 WARRANTY REPLACEMENT. The contractor shall honor manufacturers and contract warranties, and the contractor shall maintain on-site records of equipment bearing warranties. The contractor shall provide support documentation for any warranty claims.

3.9 POLICE AND FIRE PROTECTION. The Government will provide police and fire emergency response services for the contractor while performing work on the installation under this contract.

MEDICAL. The Government will provide necessary ambulatory services to transport to the local hospital for contractor employees injured while performing work on this installation under this contract at a cost-reimbursable basis. The contractor is responsible for reimbursing the Government for all medical services provided.

Chapter 4

SERVICES SUMMARY

Performance Objectives PWS Ref Performance Thresholds

1. Operate EMCS. Perform daily system monitoring, analysis, and optimization.

Provide energy management support and generate required operational reports.

2.1.1 No more than 1 complaint validated by the

COR per month. All required reports submitted accurately and on time 95% of the time.

2. Develop and execute a comprehensive preventive maintenance program, including system backups, diagnostics, and annual facility inspections.

2.1.1.10 Preventative Maintenance Schedule

submitted to COR within two weeks of contract start. 100% of all scheduled preventative maintenance tasks and inspections completed within the scheduled month. No more than 1 validated complaint per month.

3. Provide both routine (next business day) and 24/7/365 emergency technical support to diagnose and resolve system failures.

2.1.1.3, 2.1.1.5, 2.1.1.6, 2.1.3

Virtual Technical Support provided within 4 hours of request 95% of the time.

On-site Routine Service: Response initiated by next business day 95% of the time.

Emergency Calls: Response initiated within 2 hours 100% of the time.

4. Parts and Materials Management. Procure all necessary parts and materials for maintenance and repair on a reimbursable, at-cost basis, managed through an approved price list.

2.1.4 98% of all reimbursement invoices and quotes are accurate and submitted with correct supporting documentation.

5. Replacements and Upgrades. Design, install, and program system upgrades, replacements for obsolete components, and expansions as separately funded tasks under the IDIQ.

2.1.5 95% of all project milestones for funded tasks are completed by the mutually agreed-upon deadline.

6. Cybersecurity & Compliance. Ensure the system maintains its ATO by adhering to RMF, applying all required STIGs/patches, and managing the system under strict configuration control.

2.1.2 100% of all Critical and High vulnerabilities remediated within 30 days of notification;

Moderate vulnerabilities remediated within 90 days.

7. Provide and maintain a staff of fully qualified and certified technicians who meet all experience and DoD IAT certification requirements.

2.2 100% of all personnel performing technical work shall have valid, current certifications on file with the COR at all times.

Chapter 5

SERVICE DELIVERABLES CHART

Deliverable PWS Paragraph Frequency Recipient(s)

Preventative Maintenance Initial Schedule

2.1.1.10 Within 14 days of

contract award

COR

Monthly Preventative Maintenance Report

2.1.1.10 Monthly COR

Full System & database backup

2.1.1.11 Quarterly (minimum) ISSM (updated

copy)

Annual Facility Inspection Report

2.1.1.12 Annually COR

Daily Alarm Report 2.1.1.8 Daily Report COR

Monthly Energy Report 2.1.1.8 Monthly, by 5th working day of month

Base Energy Manager

System Hardware & Software Topology and Inventory and updated data flow

2.1.2.1 Quarterly and upon any

system change

COR, ISSM

Graphics Creation/Modification

2.1.1.13 Within 5 working days of

notification

COR

Vulnerability or Flaw Remediation Reports

2.1.2.4, 2.1.2.5 Critical/High: 30 calendar days. Moderate:

90 calendar days

ISSM/ISSO

Admin Access to EMCS 2.1.2.7.2 Within 5 business days of request

ISSM, ISSO

Quality Control Plan 2.5.1 Within 30 days of contract award

Contracting Officer, COR

Reimbursement invoices (routine)

2.1.4 Within 7 business days

of purchase

COR

Reimbursement invoices (emergency)

2.1.4, 2.1.3 Within 4 days of emergency repair

COR

Personnel Resume & Certifications

2.2 Prior to commencement

of work for all personnel

COR

Privileged User Training Certificates and Signed user agreement/DD2875

2.2.4.2 Before privileged access

is granted

ISSM/ISSO

Appendix A

ESTIMATED WORKLOAD DATA FOR PREVENTIVE MAINTENANCE

AND TECHNICAL SUPPORT

Description Quantity Insights Apogee (Air Force, B5032, B1558) (rev.) 3 Siemens DDC Panels 184 Info center (rev. 1.6.5) 1 Isonas Mechanical Room Locking Server 1 Switches 108 Printers 2 Servers 3 Desktop Workstations 3 Laptop Workstations 10

Appendix B- ESTIMATED WORKLOAD DATA FOR PREVENTIVE MAINTENANCE AND

TECHNICAL SUPPORT MODULAR BUILDING CONTROLLERS

196 locations across JB Andrews, Brandywine, and Davidsonville locations; appendix provided upon award.