DRAFT SOW.pdf

Attachment 1 - DRAFT SOW

AUTOMATIC ENVELOPE INSERTER EQUIPMENT

1.0 INTRODUCTION

Defense Logistics Agency (DLA) Document Services seeks to purchase the following equipment and associated services; this acquisition is to acquire a High-Speed Automated Envelope Inserter (“device”) that accomplishes all steps in sizing, folding, inserting, and stacking various sized and thickness pages into envelopes/shipping sleeves. The requested equipment and supplies represent the minimum requirements of the government.

The requirement includes:

- Delivery and installation of the equipment.

- Maintenance and repair of the equipment.

- Information Technology (IT) Security Accreditation and technical support for the equipment throughout the duration of connectivity to the network.

- Training on use and daily upkeep/operations of the equipment,

- Documentation on material and supplies, and hardcopy/digital User Manuals will be provided.

2.0 GENERAL INFORMATION

DLA Document Services requires the equipment and associated services at the Robins AFB GA location, the purchase is for one (1) unit of an Automated Envelope Inserter System.

The maintenance is for a 1-month base period, 4 one-year options, and eleven (11) month option. A single rate, up to three year “warranty” is optional.

Equipment is to be delivered to DLA Document Services Robins AFB, POC:

Nicholas DeWald (478) 236-3645 Address: 255 Deryl Israel Way 301 West Wing, Suite C-12, Robins AFB, GA 31098-1887

3.0 SPECIFICATIONS: AUTOMATIC ENVELOPE INSERTER SYSTEM

REQUIREMENTS: Product Features Specifications

3.1 Speed Minimum 6,000 envelopes per hour

3.2 Monthly Volumes Minimum 300,000 per month

3.3 Multiple Feeder options Minimum 3

3.4 Envelope Feeder Capacity Minimum 700 #10 Standard Envelopes

3.5 Flat Envelope Capacity Minimum 450 10" x 13"

3.6 Sheet Feeder Capacity Minimum 2,000 sheets (500 & 1000 sheet hoppers)

Attachment 1 - Statement Of Work

3.7 Insert Thickness Minimum 10 mm (3/8")

3.8 Document Height Minimum 16" portrait (folding) or 8.5" landscape feed (no folding)

3.9 Document Width Minimum 8.5" portrait feed (folding) or 12" landscape feed (no folding)

3.10 Folding Capacity Minimum 7 sheets

3.11 System Detection Required

3.12 Collation of Inserts Required

3.13 Sealing Liquid Capacity Minimum 9 liters

3.14 Feeder-Folding Options Letter, ZigZag (Z), Single, C, Double Parallel, No Fold

4.0 MAINTENANCE AND REPAIRS

4.1 Maintenance and repairs refer to a base period of one (1) month, plus four (4) one-year option periods and an eleven (11) month final option period. The Automated Envelope Inserter must be registered with the Original Equipment Manufacturer (OEM) for any extended maintenance offered by the specific OEM manufacturer.

The contractor shall provide a telephonic answering service number and email address to report issues. Service calls not immediately answered must be returned within four (4) hours. Service calls above operator level repair, must respond to the facility with technician or higher-level support personnel.

4.2 On-site repair service includes spare parts for verified hardware and software failures. Parts required for repairs are provided via overnight shipment. When operator(s) can make minor adjustments or repairs using remote services to resolve an error or malfunction, a technical support group can utilize phone support to relay instructions and repair the device.

4.2.1 If remote repairs that do not alleviate the problem or the issue is above an operator’s technical skill level, an in-person service call is immediately generated with contractor response for maintenance. Facility access is limited to Monday thru Friday 0700-1600 hours local time, no weekends or federal holidays.

4.3 If the Contractor chooses to repair on-site, Contractor must ensure all service technicians are eligible for access to Department of Defense facilities in accordance with Section 11 of this SOW.

4.3.1 Technicians must be eligible for access at the time of the award. In addition, in the case of device is cleared for CLASSIFIED material, the contractor’s repair technicians shall ensure they do not access the device without a Government employee escort present and observing during the support/repair services.

4.3.2 To ensure an escort is present the Contractor shall contact the Customer a minimum of 24 hours prior to the site visit to schedule the time of arrival.

5.0 DELIVERY AND INSTALLATION

5.1 The Contractor will be responsible for all installation processes of the device. All costs associated with providing installation of the Envelope Inserter, shall be included in the quoted price and will not be reimbursed separately.

5.2 The Contractor shall comply with all Federal, DoD and local rules and regulations to obtain Government installation access to meet all response times identified within the SOW. See Section 11 of this SOW.

5.3 The Contractor shall be responsible for all fees associated with the application process and/or enrollment to access the installation.

5.4 Within five (5) business days after selection, the contractor shall contact the delivery location POC and begin the planning/scheduling process to ensure proper installation of the device.

5.5 Upon completion of device delivery, the Contractor shall obtain customer signature and date on each Bill of Lading (BOL) or packing slip, with serial number of the device, and provide this proof of delivery to the designated DLA Point of Contact (DLA Document Services POC) within ten (10) business days after delivery.

6.0 TRAINING REQUIREMENTS

6.1 The contractor shall provide a hardcopy User Manual which is concise, written in English, user friendly and provides specific steps and processes in all operational aspects regarding the use of the device and the accompanying peripherals, and software.

6.2 Within five (5) business days after the complete installation of the device, the contractor shall provide initial hands-on, in-person training regarding the device and its software. This training must be in the English language and accomplished by an individual with expert knowledge in all operational aspects of the device and software.

All costs associated with providing this initial training (to include travel costs of the contractor-provided instructor) shall be included in the quoted price and will not be reimbursed separately.

6.3 The contractor shall provide video training materials on electronic media

(CD/DVD/Blu-Ray) for ongoing/recurring training. The videos must be formatted for MS Windows 11 compliant systems and provide basic operations and operator-level maintenance overview of the equipment.

7.0 EQUIPMENT AND ACCESSORIES

7.1 During the period covered under this contract, should the Government and/or the contractor desire to substitute or upgrade equipment with technological improvements, all such actions must be approved by the Contracting Officer (KO) prior to the contractor taking any action.

7.2 If a substitution is needed, the contractor must notify the KO and a formal review process will be conducted. Substitutions will be provided at no cost to the government.

8.0 IT CONFIGURATION

8.1 All devices/components shall be maintained and kept current with DoD/DLA required and approved operating system patches and drivers. All devices/components with an embedded operating system shall be maintained and kept current with DoD/DLA required and approved operating system patches and drivers. The following is the list of the current operating system requirements:

Microsoft Windows 11 or current DoD required Operating System.

Microsoft Windows Server 2019, Microsoft Windows Server 2022, or current

DoD required Operating System.

Sun Solaris 11 or current DoD required Operating System

8.1.1 This list is not inclusive of any future requirements or changes by the DLA or CYBERCOM. The contractor will be required to perform, or make available to DLA, all system updates, and patches in accordance with (IAW) future DoD or DLA directives at no additional cost to the Government. Any requirements that could create cost to the Government such as a major operating system (OS) changes from one revision level to the next, will be quoted and processed through the KO to determine acceptance

8.2 All contractor-provided software (including Operating System drivers) must be supported by the contractor and the software’s original manufacturer at all times during its use by the Government. If it becomes apparent that either the contractor or original manufacturer will no longer support any contractor-provided software, the contractor must provide and install replacement software in coordination with delegated Government POC that is still supported by the contractor and the software’s original manufacturer.

8.3 Contractor solution must be capable of functioning in a common security environment, given that DLA Document Services is required to add additional software that is standardized within DLA including, but not limited to, Trellix Endpoint Security (multiple modules including Antivirus and Host Intrusion Prevention), Micro Focus® Reflections, ArcSight Logger, Active Client Software and Axway Desktop Validator.

8.4 All hard drives that are put into service at DLA Document Services must remain in the custody of DLA Document Services. All hard drives, whether internal, external, or otherwise, shall not be returned to the contractor.

8.5 All devices/components shall meet DoD information security specifications when interfacing with classified materials to ensure no remnants of the classified data exist after the classified process has been completed. The contractor shall indicate the specific steps needed to clear classified data from the device to prevent disclosure. Any proposed process must include the use of removable hard drives and receive Government approval, which will occur during the certification and accreditation process (see Section 9).

8.6 All devices shall be configured in compliance with all applicable DoD Security Technical Implementation Guides (STIG) (Ref: http://iase.disa.mil/stigs). Any remaining deficiencies that cannot be resolved shall be identified to Government POC prior to the Certification and Accreditation testing phase (Section 9) for evaluation of acceptance.

8.7 The equipment shall operate and coexist on a network that can support each of the following:

Internet Protocol Version 4 (IPv4) Internet Protocol Version 6 (IPv6) Internet Protocol Version 4/6 Hybrid (IPv4/6)

8.8 All devices/components shall have the capability of turning on and off any ports and protocols.

8.9 As part of the installation process, the contractor will label all equipment, with the appropriate classification as defined by DLA Document Services. DLA Document Services will provide the appropriate instructions and labels.

8.10 DLA Document Services will provide a configuration standard/settings document for each hardware model that the contractor shall utilize when installing hardware at a designated site. This configuration standard/settings document will be developed for each asset/model in conjunction with the contractor post-award meeting with DLA Document Services headquarters facilities in New Cumberland, Pennsylvania.

8.11 The use of a key dongle for equipment is authorized in a standalone configuration.

The contractor will work with DLA Document Services headquarters prior to any dongle being installed on the DLA network. The dongle shall be included in the price of the contract.

8.12 The use of USB flash drives is strictly prohibited at DLA Document Services locations. In addition, non-government issued IT devices (e.g. phones, laptops, etc.) are prohibited from being used on DLA Document Services equipment and network.

Firmware/hardware updates must be applied using DVD, and/or CD.

8.13 Section 508 Accessibility Standards - The user interface shall comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 Code of Federal Regulations (CFR) 1194. The standard 1194.21 (Software applications and operating systems) has been determined to be applicable to this contract. 508 VPAT proof documentation must be provided to the government for each device offered at time of quote submission.

9.0 IT CERTIFICATION & ACCREDITATION, INSTALLATION, AND TECHNICAL

SUPPORT

9.1 Upon award of the contract and prior to any orders taking place, DLA Document Services shall identify the specific pieces of equipment and software that require network testing, security accreditation, and approval. Within 30 calendar days of notification of award, the contractor shall deliver the identified equipment and/or software, at no cost to the Government, to the DLA Document Services production facility in Mechanicsburg, PA for testing its compliance to the requirements set forth in the Statement of Work.

9.1.1 All testing will be conducted by DLA Document Services with the contractor’s assistance. The acceptance of the award does not occur until testing has been completed.

9.1.2 Testing is expected to take place within 30 calendar days. The testing will determine if the equipment meets all the requirements of the SOW, can function as delivered, and will develop a standard configuration that the contractor will use for all installations.

9.1.3 The acceptance of equipment does not occur until testing has been completed. Testing will include but is not limited to vulnerability scanning, port scanning, and STIG compliancy checks. Upon notification of a discrepancy, the Contractor will have seven (7) calendar days to provide corrective action. The Contractor shall, at no additional cost, provide onsite engineering assistance and other support necessary to configure, set up, and test the equipment.

9.1.4 The equipment must be free of vulnerabilities and be configured in a compliant manner with any known STIG deficiencies identified prior to the testing commencement for evaluation of acceptance. The DLA Document Services Information Assurance Manager will determine the acceptance or rejection of any unmitigated risk as part of the Certification and Accreditation process.

9.1.5 Orders will not be processed until successful completion of the IT Certification and Accreditation phase as determined by DLA/DLA Document Services; no actual equipment delivery shall be made until the contracting officer provides a notice to proceed.

9.2 Upon installation of each approved device, and at no additional cost to the Government, the contractor shall provide technical support to the on-site Information Technology personnel for each device installed. Initial technical support is considered complete upon connectivity to the network.

9.3 The contractor shall monitor industry standard vulnerability sites (e.g.

http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their equipment is subject to a known vulnerability. In addition, DLA Document Services will notify the contractor as security vulnerabilities are identified concerning the installed equipment. When a vulnerability is identified, the contractor shall provide remediation (patches) for distribution to all installed equipment within 30 calendar days unless a shorter time period is directed by DLA Document Services Contract Point of Contact (POC). The following is authorized to be quoted from the TASKORD for reference:

9.3.1 Assured Compliance Assessment Solution (ACAS) assigns severity scores of critical, high, medium, and low to plug-in findings.

9.3.2 Critical findings reflect the discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities shall be initiated upon discovery with the goal of mitigation/remediation within twenty-one (21) calendar days.

9.3.3 Findings with a severity score of high shall be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within thirty (30) calendar days of discovery.

9.3.4 Findings with severity scores of medium and low shall be addressed in accordance with local Approving Official (AO), Information System Security

Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

9.3.5 In all instances, DoD components shall consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

9.3.6 In the event remediation cannot be achieved within the mandated timeline, the

Contractor shall provide a Plan of Action and Milestones and receive approval thereof by the Customer’s agency Authorizing Official or designee for risk acceptance.

9.4 The contractor shall update all contractor supplied software with the following exception. DLA Document Services retains responsibility for patching all Microsoft Windows systems that can be updated via Microsoft WSUS or SCCM. Prior to and during the execution of contractor-initiated software updates, coordination shall be made with the Government POC named in the order.

9.5 All purchased hardware shall be registered by the contractor under the “DLA” name for 3rd party technical support. Proof of registration must be provided to DLA POC.

9.6 The contractor shall not have remote access to equipment unless authorized.

9.7 Provided workstation hardware will be imaged with a DLA standard image for both classified and unclassified systems.

9.8 Media validation and testing will be performed on various media types and weights.

All listed paper/media must pass testing during the IT validation process. If in the event a test media is deemed unacceptable or does not pass testing due to repeated issues (Jamming, Ink Quality, other) the contractor will be required to adjust settings/hardware, if possible, to make compliant with required media types.

10.0 SUPPLY CHAIN RISK MANAGEMENT

10.1 As part of its quote, the Contractor shall provide written documentation demonstrating how the integrity and security of all equipment, components thereof, repair parts and consumables it will provide and/or use in performing this contract will meet the standards set forth in National Institute of Standards and Technology (NIST) Special Publication 800-161. This documentation shall clearly demonstrate how the Contractor is taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services DLA receives through this contract. Additionally, this documentation shall provide specific details of what—

10.1.1 Policies the Contractor has in place to prevent both (a) the use of counterfeit or altered equipment, components thereof, consumables and parts and

(b) their introduction into the Contractor’s supply chain;

10.1.2 Security procedures the Contractor uses to track the chain of custody of equipment, components thereof, consumables and parts, to include while this material is in storage and in transit; and

10.1.3 Steps the Contractor takes to ensure the integrity and authenticity of equipment, components thereof, repair parts and consumables to prevent tampering so they will perform according to specifications without additional unwanted functionality.

10.2 The Contractor shall continuously meet the standards of NIST Special Publication 800-161 while taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services provided through this contract. Upon request, the Contractor shall provide written documentation meeting all NIST requirements.

11. INSTALLATION SECURITY ACCESS REQUIREMENTS

11.1 Contractors must comply with DoD facilities in accordance with the authority in Directive Type Memorandum (DTM) 09-012, and in DoD manual 5200.08 Volume 3, which establish DoD access control policies and the minimum DoD security standards for controlling entry to DoD installations and stand-alone facilities. Contractors must also check and follow installation access policies specific to each DoD installation.

11.2 The Contractor shall be escorted by Government personnel for all issues related to maintenance. No contractor personnel will be allowed unescorted access to government facilities

11.2.1 The Contractor shall comply with all rules and regulations to obtain Government installation access in order to meet all response times identified within the SOW.

11.2.2 The Contractor shall comply with Government base access requirements as set forth in the base/command regulations.

11.2.3 The Contractor shall be responsible for any and all fees associated with the application process and/or enrollment to access any installation or facility.

11.2.4 For devices cleared for CLASSIFIED material, the Contractor’s repair technicians shall have a DoD security clearance equal to or higher than the classification of the device and shall provide verification when requested.

12. NETWORK SECURITY

12.1. The Contractor shall provide devices that are Trade Agreement Act (TAA) compliant and can be configured to comply with the current Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) titled Multifunction Device and Network Printer STIG (latest version and release), available at:

https://cyber.mil/.

12.2 All devices shall support Simple Network Management Protocol (SNMP) version 3 (v3). Versions 1 and 2 (SNMPv1/SNMPv2) shall be disabled.

12.3 All devices shall be International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15408 (Common Criteria) certified IAW CNSSP-11 using the National Information Assurance Partnership (NIAP) approved criteria or equivalent.

12.3.1 A device shall be acceptable if it is included on either the NIAP CCEVS Product Compliant List (https://www.niap-ccevs.org/Product/) or Common Criteria Portal Certified Products list (http://www.commoncriteriaportal.org/products/).

12.3.2 All devices shall have current ISO/IEC 15408 certification and recertification, if applicable, before the Contractor can schedule lab time. Guidance for Common Criteria Maintenance and Re-evaluation is available at: https://www.niap-ccevs.org/documents_and_guidance/ccevs/scheme-pub-6.pdf

12.4 All devices shall be capable of obtaining accreditation through the Risk Management Framework (RMF) for DoD Information Technology (IT). As part of this, the Contractor agrees to provide all requested information and work in good faith with DLA so the DLA customers can expeditiously obtain RMF accreditation prior to device delivery and installation. The Contractor shall also provide devices for vulnerability and STIG testing to DLA or customer’s site. The Contractor further agrees that if the proposed device(s) does not obtain RMF accreditation, the contractor shall remove the device(s).

12.4.1 Information regarding RMF is found in Risk Management Framework (RMF) for DoD Information Technology (IT) Instruction 8510.1 dated 12 March 2014:

http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. In order to maintain RMF and STIG compliance, devices are required to be delivered with the most up-to-date firmware.

13.0 INVOICES

13.1 The Contractor shall electronically submit invoices in accordance with the Defense Federal Acquisition Regulations Supplement (DFARS) Clause 252.232-7006.

13.2 The Contractor shall not be paid for the invoice until all equipment is installed, functioning and, if required, certifications for mapping devices are completed, initial training is completed, as well as connection to the Government’s network.

13.3 Invoices shall be submitted within 30 calendar days after the delivery, installation or maintenance services occurred. Invoice submissions will include all Bills of Laden, proof of receipt of supplies and services fully signed by an authorized government customer.

Failure to submit a complete invoice via WAWF in the expected timeframe will result in penalties.

13.4 Liquidated damages for failure to submit invoices via WAWF within the timeframe specified in this contract, will be calculated at $3.00 per calendar day. In that any invoice submitted 31 or more calendar days after delivery or service completion, will be reduced by $3.00 each day the invoice is not submitted.

Days Late

Penalty Amount Deducted

1 $3.00 $3.00 30 $3.00 $90.00

13.5 If the Contractor fails to submit the invoice within the time specified in this contract, the KO will notify the Contractor of the invoicing discrepancy, and the Contractor shall deduct the penalty from the next invoice related to this contract delivery order.

13.6 If the Contractor does not submit an invoice with all the expected documentation for the specific action, within 60 days, after completion of the action, the government will not accept any invoices for that action, and the funds related to that action will be de-obligated from the contract.

14.0 REPORTS

14.1 The Contractor shall prepare and submit an Installation Report that includes, at a minimum, the serial number(s) for all device(s) and accessories, and the location to include DLA Document Services Office Group (East/Europe and West/Asia), military/base installation name, building number as applicable, and contract number. The report will be sent to the Government POC named in the contract and to the KO within 30 days of installation.

14.2 The Contractor shall provide a single POC for service issues (i.e. the Prime Contractor telephone and/or email address) to place service calls or report issues with the equipment. This information will be on a label or a sticker, located on the device in plain sight.

14.3 The Contractor shall provide the Government POC with a Training

Completion Report for all DLA Document Services personnel (location) trained.

The report must include trainee’s name, location, date, and equipment make and model trained on, including hardware as well as software. Each report will be sent to the Government POC (Program Manager) responsible for that equipment location as indicated in the contract.

14.4 The Contractor shall provide a single POC for administration of the contract and a single POC for service issues. The Contractor shall prepare and deliver a monthly Equipment Availability Report via email to each DLA Production Managers and the DLA delegated POC named in the Delivery/Task order. At a minimum the report shall contain the following for each piece of equipment delivered under this IDIQ contract:

• Location

• Product Name

• Serial Numbers to include accessories

• Monthly Meter Reads

• Number of Monthly Service Calls

• Monthly Total Downtime

• Available Hours

• Percentage of Up-Time/Availability (MUA as defined in

Section 3)

14.5 The Contractor’s Administrative POC and the Contractor’s Service POC shall attend, a Quarterly Equipment Meeting with the DLA delegated POC via a Microsoft TEAMS to discuss the report set forth in paragraph 8.4, above. The meeting discussion will be based on previous month(s) device information.

14.6 The Contractor shall provide the DLA delegated POC with a monthly Security Vulnerability Report. The report shall contain the location of all equipment, product names, serial numbers, details of all security vulnerabilities and the status of eliminating or mitigating each vulnerability.

15.0 GOVERNMENT OWNED OR FURNISHED PROPERTY/EQUIPMENT/SPACE

15.1 Government owned or furnished property/equipment will not be offered as part of this Request for Proposal (RFP) and resulting contract. Reliance, in whole or part, on any currently owned government equipment in fulfilling the requirements of this RFP, will result in a technically unacceptable proposal.

15.2 The Government will not provide administrative space for use by the Contractor.

15.3 The Contractor will be responsible for providing all necessary equipment required for delivery, installation, and upgrades. The Government will ensure the final location meets the requirement of the device to be purchased and installed.

15.4 The Contractor must inform the Government POCs of any dedicated equipment that is not provided by the Contractor. If the Government determines this is acceptable, the individual location will be responsible for providing Government Owned Property for use with the equipment provided by the Contractor.

16.0 REMOVAL OF EQUIPMENT AND HARD DRIVES

16.1 In the event that purchased equipment requires replacement, it shall be the Contractor’s responsibility to remove and dispose of existing equipment, as part of the Contractor’s quoted price.

16.2 DLA requires the Contractor to remove all hard drives from the controllers and print engines and turn the hard drives over to the DLA Document Services, when a device is removed or replaced. The Contractor shall provide documentation, signed by the Contractor and the DLA delegated POC, that attests to the hard drive removal and receipt by DLA. All hard drives will remain in the possession of DLA Document Services. Contractors will list the cost of removing the hard drive(s) with the submission of quotes to this RFP.

16.3 Contractor’s technicians shall ensure they do not access the device(s) without a government employee escort present and observing during the removal of hard drives.