DSCR East Gate PWS Final 20200812.pdf

PERFORMANCE WORK STATEMENT (PWS)

1.0 BACKGROUND

Defense Logistics Agency (DLA) has a requirement for installation (East Gate only), configuration, cybersecurity and other related support for Electronic Security Systems (ESS) at the Defense Supply Center Richmond (DSCR) in Virginia. The DSCR ESS consists of a legacy Access Control System (ACS), Intrusion Detection System (IDS), Closed-Circuit Television (CCTV) system and a Global Facilities Management System (GFMS) electronic key control system. Currently there is an ongoing effort for a base wide ESS upgrade from the legacy Honeywell system to a Lenel system (Lenel version 7.4) and upgrade GFMS to a 2016 server.

2.0 SCOPE

This PWS includes support for three lines of effort at DSCR. First, DSCR requires configuration, cybersecurity and other related support for Government furnished/Government installed ESS devices for ACS, IDS and CCTV as part of a site-wide replacement/upgrade. Secondly, DSCR requires installation, configuration and other related support for new cameras and new duress buttons at the newly built Richmond East Gate. Both efforts require the Contractor supporting the configuration and integration of these ESS devices into the base wide Lenel security system. These efforts are being conducted in parallel and the efforts must integrate. Exceptions to the complete integration shall be submitted in writing to the Contracting Officer (KO), Contracting Officers Representative (COR) and Contracting Officer’s Technical Representative (COTR). Third task outlined in section 3.1.2.1 includes migrating existing GFMS application from Server 2008 to Server 2016, which includes an application upgrade from version GFMS 2.5 to GFMS 3.0. The scope of work includes all incidental work that can reasonably be expected to successfully complete the installation (East Gate only) of the security system e.g., cleaning, adjusting, cabling, conduits, switches, testing, configuration and tuning.

3.0 TASK REQUIREMENTS

The Contractor shall adhere to the following general requirements and definitions for all tasks for both efforts within this PWS:

1. The Contractor shall submit an accident prevention plan to the COR. The approval authority for the accident prevention plan is the Richmond safety office. No work shall start prior to COR receiving the approved accident prevention plan.

2. The Contractor shall provide a Test Plan and Migration Plan to keep the legacy Honeywell ESS system active and available to the extent possible during the installation (government installed devices), configuration and migration of the new Lenel system.

3. The testing should include at a minimum individual building testing and a complete integrated testing once all buildings have been migrated to the Lenel OnGuard 7.4

4. The Contractor shall document and turn over any equipment or material removed or disabled to the Government weekly in the Hardware/Software Inventory Report and at the completion of work or after COR approval. The Contractor shall properly dispose of in accordance to DOD and DLA regulations, policy, guidance and/or local codes.

5. The Contractor shall return all video, photos, usernames/passwords and any documentation obtained and developed.

6. The Contractor shall maintain a separate set of drawings, elementary diagrams, and wiring diagrams of the system to be used for As-Built Drawings and shall keep this set accurately and neatly up to date with all changes and additions throughout the contract. As-Built Drawings shall be developed and maintained by the Contractor and depict actual conditions.

As-Built Drawings are to be submitted to the COR and COTR in original AutoCAD and Adobe Portable Document Format (PDF) format and shall not be overlays. Complete As- Built Drawings will be submitted to the Government within 14 calendar days of completed work. These drawings and diagrams shall follow all DFARS 252.204-7012 reporting requirements.

7. The Contractor will provide a weekly status report which shall include, but not limited to:

a. Contract number

b. Brief task description

c. Review of project plans including work accomplished during the reporting period and/or significant events

d. Schedule

e. Project progress

f. Problem areas

g. Anticipated activity for the next reporting period

8. The Contractor shall follow all applicable National Electrical Code (NEC), Unified Facilities Criteria (UFC), United Technologies Corporation (UTC), National Fire Protection Association (NFPA), and Security Standards.

9. The Contractor will follow all Security Technical Implementation Guides (STIGs), Data Encryption standards, Intelligence Community Directive (ICD/ Intelligence Community Standard (ICS) 705, DLA Physical Security Manual and DLA building codes.

10. The Contractor shall not turn off any power for an outage unless authorized by the COR.

The Contractor is required to provide a written request to the COR at least 14 days in advance of any required outages and for any after duty hour work requirements.

11. The Contractor shall obtain written COR approval if any digital or media is required. All video, still photos, digital photos, all usernames, passwords and any other documentation obtained and developed during the execution of this contract shall be turned over to the Government with all digital and hard copy files and associated negatives at the completion of this project. Digital photographs shall be submitted to the Government on Compact Disk (CD) in Joint Photo Experts Group (JPG) format, and the Contractor shall delete all associated files from their records.

12. The Government (DLA) shall install compatible client software on nine (9) workstations. All cameras will be compatible with and integrated in the installation PELCO VideoXpert CCTV system. Cameras should be configured to record and distributed strategically and in coordination with COR on existing PELCO servers.

13. All video footage will be integrated in the base CCTV system PELCO VideoXpert. Storage of video footage is done on DLA base wide servers and will need to be tied into that system.

3.1 Hardware Procurement, Installation and Configuration

3.1.1 Procurement

For the DSCR Base-Wide ESS Replacement/Upgrade effort, the Government will provide and install the equipment listed in Attachment 4 as Government Furnished Property (GFP). The Contractor will be responsible to integrate these devices with the Lenel base wide system.

For the East Gate effort, the Contractor shall procure all materials and equipment required within 30 calendar days of award of contract, specifically the CCTV security cameras and duress buttons with alarms in Attachments 2 and 3 for the East Gate. For the East Gate effort only, the Contractor shall install all procured (Contractor Furnished) equipment. All materials and equipment for this project shall be new, not refurbished, and shall be submitted in the Hardware/Software Inventory Report to the COR and approval by the Government Information System Security Manager (ISSM) prior to procurement to ensure it can be supported and complies with the 2019 National Defense Authorization Act (NDAA) which at the time of this writing specifically bans security cameras by Hikvision, Dahua and their Original Equipment Manufacturers (OEMs). All security equipment shall be compatible with Lenel OnGuard version 7.4 or higher and PELCO VideoXpert as directed by the Government. Attachment 3 are the MILCON Contractor’s blueprints for building the East Gate entrance. The MILCON Not in Contract (NIC) notations are for the physical construction of the entry control point. All MILCON NIC items are items in this contract and shall be the responsibility of this Contractor to furnish and install (see Attachment 3 for NIC items). The Contractor shall be responsible to ensure all equipment can be configured/programmed to make the security system of this contract operational with the Lenel base wide system.

TABLE 3.1.1.1 PROJECTED LIST OF MATERIALS FOR EAST GATE

Hardware for East Gate Count Fixed camera with enclosures and mounts 7 Exterior PTZ HD camera with enclosures and mounts 2 32-inch monitor 1 Full motion mount for 32-inch monitor 1 Duress button with alarm 5 Government Furnished Equipment (GFE) Laptop/Workstation with Windows 10 OS 1 Lenel Client software with license 1 CAT6 Plenum wire As needed Misc. materials, cables and other related items As needed

3.1.2 Installation and Configuration

The Contractor shall furnish all labor needed to support the installation (East Gate only), configuration, cybersecurity and other related support required for the DSCR base-wide effort and the East Gate effort.

Upon completion of work, Contractor shall turn over a complete and fully operational integrated system as described in this PWS and the referenced documents. A Lenel OnGuard 7.4 ESS shall be provided as described in the PWS. The Contractor shall configure, integrate and test the Government Furnished (Attachment 4). The Contractor shall procure, install, configure, integrate and test (Table 3.1.1.1) devices and software. All items purchased must have approval by the ISSM prior to procurement to ensure it can be supported and complies with the 2019 National Defense Authorization Act (NDAA).

The Contractor shall implement the ESS by completing installation (East Gate only), configuration, cybersecurity, integration, testing and to establish the required ESS network and integrating all required ESS equipment, systems and software. The Contractor will provide a design to the Government for the integration to the Base Wide system within 10 days of contract start date. The existing Honeywell system is to stay operational, to the extent possible, while the Government is installing, and the Contractor is configuring the new devices (the Lenel and Honeywell systems will run in parallel).

1. The Contractor shall install (East Gate only), configure and test all installed devices to include any Government installed devices.

2. The Contractor shall setup all ACS, IDS and CCTV devices on the Lenel Server and PELCO VideoXpert and make operational.

3. The Contractor shall install (East Gate only), configure, STIG and test all NVRs and make operational.

4. Attachment 2 shows the specific number, location and viewing angles of the security cameras at the East Gate and checkpoint areas. Attachment 3 (available upon request) includes drawings on sheet reference numbers ES-602, ES-603, ES-103, ES-104, and ES-401 with locations of the intrusion detection system duress buttons for arming/disarming zones for the East Gate effort.

5. The Government will provide to the Offerors a schematic, Attachment 4 DSCR ESS - Bldg.

Survey and equipment list for each building and gate that provides information on the currently installed system. Contractor and any of its employees must meet any specific security requirements to view and handle such data as outlined in section 4.0.12.

If any device/equipment fails after the Contractor has commenced work on that device/equipment (East Gate only), necessary corrections shall be performed to this equipment in a timely manner or replaced.

Responsibility for repair costs due to negligence or abuse of Government equipment shall be the responsibility of the Contractor.

3.1.2.1 DSCR Base-Wide ESS/GFMS Replacement/Upgrade Effort

1. The Contractor will configure on servers all ESS devices and cameras and all other items required to provide the Government with a complete working ESS base wide Lenel security system. Contractor will use GF naming conventions when configuring.

2. The Contractor shall furnish all labor, Contractor specific equipment and materials, and perform all work necessary, as described herein. Workmanship, materials and equipment supplied under this effort shall comply with contract specifications.

3. The Contractor shall identify any system wireless communication capability, enabled or disabled. All wireless communications shall meet applicable STIG requirements.

4. The Contractor will support the configuration and conduct the STIG review of the Network

Video Recorders (NVRs).

5. The Contractor shall configure all devices.

6. The system shall be installed, configured to comply with all STIG, applicable DOD, DLA and Defense Information Systems Agency (DISA) cybersecurity guidance and the requirements.

7. The current GFMS server is running on a Windows Server 2008 platform. The Government will decommission this server in the future and provide a new Windows Server 2016 or newer. The Contractor shall be responsible for migrating the GFMS applications, dB and other related software from the 2008 server platform to the new server and conduct STIG review to meet all DoD, DLA and Defense Information Systems Agency (DISA) standards.

To complete the migration contractor will be required to complete GFMS upgrade from version 2.5 to version 3 to ensure compatibility for execution/functionality.

8. The Contractor shall be responsible for all physical maintenance activities for the devices, appliances and applications including but not limited to replacement of defective components (Contractor furnished) for the duration of the contract period.

9. Fire Alarms/Fire Suppression systems connecting to the ESS and National Fire Protection Association (NFPA) 72. The Contractor shall connect to the existing fire control relay at DCSR to the new ESS working with the local DSCR Fire Alarm/Fire Suppression systems expert.

10. All devices, appliances and applications must be STIG’d and meet all DoD, DLA and Defense Information Systems Agency (DISA) standards.

3.1.2.2 East Gate Effort

1. The Contractor shall furnish and install all equipment, components and cabling required for the CCTV and Duress button for the new East Gate as per Attachment 2, Attachment 3 and Table 3.1.1.1

2. The Contractor shall provide and install cameras, enclosures, and mounts designed to withstand the local environmental and weather conditions and capable of supporting Power over Ethernet and multiple H.264 streams.

3. The Contractor shall provide and install fixed cameras (7) which shall be 1080p High Definition (HD) Internet Protocol (IP) based with built in Infrared (IR) illuminators and comply with NDAA 2019 monitoring the access lanes of the New East Gate and be comparable/compatible with Pelco VideoXpert , Sarix IXE series box camera with surevision (SCSPEL-IXE22). In addition, provide local monitoring only capability of the East gate installed cameras at the primary gate house.

4. The Contractor shall provide and install exterior Pan, Tilt, Zoom (PTZ) cameras (2) which shall be suitable for outside use with day/night functionality; pan, tilt and zoom (PTZ) dome network cameras; High Definition Television (HDTV) 720p; 18x optical zoom; and with 220 degree tilt, located on the outside corners of the New East Gate and should be comparable/compatible with Pelco, SPECTRA (P1220-ESR1).

5. The Contractor will make sure all cameras need to have five (5) or greater mega pixel requirements.

6. The Contractor will make sure all cameras need to be able to operate in low light.

7. The Contractor shall provide and install all duress buttons/alarms and are identified on drawing ES-602 in Attachment 3.

3.1.3 Lenel OnGuard

The Contractor shall integrate to the Lenel base wide system. The Contractor shall configure and test all devices, components, and alarm points once integrated. The Contractor shall coordinate all work activities (times and locations) with the COR. All work shall be performed during hours previously coordinated with the COR.

3.2 Meetings

Contractor shall attend a post award Kickoff meeting prior to the initiation of work, this meeting will be held with the Contractor, KO, Contract Specialist (KS), COR, COTR, Project Manager (PM), On-Site Representatives (OSRs) and any other individuals designated by the Government to discuss overview of Contractor’s plans, manage scope, schedule and resources. Kickoff meeting will be held within 5 business days from date of award. The Contractor will discuss with stakeholders’ expectations and details of contract execution and resulting delivery order. General conditions, project schedule, work schedules, coordination, security, safety, deliverables, permits and other matters pertinent to work accomplishments shall be discussed in this meeting.

Contractor shall attend any meetings requested/required to ensure the project is successful

3.3 Testing, Inspection and Integration

1. The Contractor shall demonstrate to the Government that all security equipment functions as intended throughout the project and as one integrated ESS system at the end of the project.

The Contractor shall configure and test all devices, components, and alarm points. The testing should include a completed integrated testing once devices have been installed per approved Test Plan and Project Schedule. The Contractor will provide documentation of the system operational acceptance/commissioning test in the Test Report.

2. The Contractor shall, within 5 working days after the final inspection and acceptance, completely fill out the equipment data sheet found in Attachment 1 for all equipment removed and/or installed. The Contractor shall send the completed sheets electronically in Adobe Portable Document Format (PDF) to the COR and COTR by email. Equipment data sheets shall be legible and filled out in their entirety. The COR will provide the form to the Contractor.

3. The Contractor shall integrate the system into the base wide Lenel system.

4.0 CYBERSECURITY

The Contractor shall design, develop, and integrate Cyber Security (CS) solutions supporting the Department of Defense and all other applicable Government agencies. This will be achieved through abiding by all applicable CS regulations and directives to ensure a favorable Assessment and Authorization (A&A) / Assessment and Incorporate (A&I) decision (an Authority to Operate (ATO)) as well as obtaining an Authority to Connect (ATC) to all requisite Government networks as required per specific task requirements. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official. The Contractor shall directly support the Government to attain a final ATO/ATC in accordance Risk Management Framework (RMF), Department of Defense Instruction (DoDI) 8510.01 and any other applicable policies and regulations. The Contractor shall utilize all reciprocity agreements for any ATO/ATC currently fielded for a like configuration. The Contractor shall ensure ATO/ATC meets all DLA specific requirements.

1. This work shall be done in accordance with all applicable cybersecurity regulations and directives. All network and equipment provided shall be listed on the Unified Capabilities Approved Products List (UC APL) and approved by the COR prior to procuring. The systems (to include, but not limited to, all hardware, software and/or equipment) provided by the Contractor and provided by the Government as Government Furnished Equipment/Government Furnished Property (GFE/GFP) shall be able to obtain a favorable Authority to Connect and/or Operate (ATC/ATO) to all requisite DOD Government networks. Contractor shall perform all cybersecurity activities associated with this PWS.

2. As a part of the Systems Security Plan (SSP) documentation, the Contractor shall provide physical and cyber security features for end devices (i.e. the source or destination of network traffic) including, but not limited to, authentication, encryption, access control, event and communication logging, monitoring, and alarming to protect the device and configuration computer from unauthorized modification or use. The Contractor shall clearly identify the physical and cyber security features and provide the methodology(ies) for maintaining the features including the methods to change settings from the Contractor-configured or manufacturer default conditions. The Contractor shall verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput. The Contractor shall remove or disable all software components that are not required for the operation and maintenance of the device prior to delivery. The Contractor shall provide documentation on what is removed and/or disabled. The Contractor shall provide, within a pre-negotiated period, appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

3. Physical Access of Cyber Components. The Contractor shall provide a detailed plan for physical security mechanisms appropriate for the type of devices being installed (enclosures, etc.) as part of the SSP.

4. The Contractor shall provide all documentation required to obtain a favorable cybersecurity assessment to include a Level 1 Cybersecurity Assessment (LCA) package.

5. The Contractor shall provide a complete list of all Ports, Protocols and Services (PPS) required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation.

The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

6. The Contractor shall identify heartbeat signals or protocols and recommend whether any should be included in network monitoring. The Contractor shall provide packet definitions of the heartbeat signals and examples of the heartbeat traffic if the signals are included in the network monitoring.

7. Disabling, Removing, or Modifying Well-Known or Guest Accounts. The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The DLA Contracting Officer, COR or COTR shall approve in writing the Contractor’s recommendation. The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation.

8. The Contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet Advanced Encryption Standard (AES) 256 and comply with Federal Information Processing Standard Publications (FIPS) 140.2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The Contractor shall provide user account-based logout and timeout settings.

9. The Contractor shall implement two-factor authentication using DoD Common Access Card (CAC) where technically feasible, with exceptions noted in the proposal. The Contractor shall provide a configurable account password management system that allows for selection of password length, frequency of change, setting of required password complexity, number of login attempts, inactive session logout, screen lock by application, and denial of repeated or recycled use of the same password. The Contractor shall not store passwords electronically or in Contractor-supplied hardcopy documentation in clear text unless the media is physically protected.

10. The Contractor shall provide physical and cyber security features for end devices (i.e. the source or destination of network traffic) including, but not limited to, authentication, encryption, access control, event and communication logging, monitoring, and alarming to protect the device and configuration computer from unauthorized modification or use. The Contractor shall clearly identify the physical and cyber security features and provide the methodology(ies) for maintaining the features including the methods to change settings from the Contractor-configured or manufacturer default conditions. The Contractor shall verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput. The Contractor shall remove or disable all software components that are not required for the operation and maintenance of the device prior to delivery. The Contractor shall provide documentation on what is removed and/or disabled. The Contractor shall provide, within a pre-negotiated period, appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

11. FIPS 199 / CNSSI 1253 Security Categorization: The Contractor shall in coordination with the DLA ISSM support categorization in accordance with FIPS 199 and Committee on National Security Systems Instruction (CNSSI). The Contractor shall participate in categorization discussions with the DLA ISSM as requested to support security categorization.

12. The Contractor shall provide cybersecurity that is in accordance with current policies, procedures, and statutes, to include (but not limited to) the following (most current):

a. The Federal Information Security Management Act (FISMA)

b. Committee on National Security Systems, Policy No 11

c. 44 U.S.C. § 3542

d. Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems

e. Federal Information Processing Standards Publication 199, Standards for Security

Categorization of Federal Information and Information Systems

f. Federal Information Processing Standards Publication 200, Minimum Security

Requirements for Federal Information and Information Systems

g. Federal Information Security Management Act (P.L. 107-347, Title III)

h. Department of Defense Instruction 5000.02, Operation of the Defense Acquisition

System

i. Department of Defense Instruction 5200.39, Critical Program Information (CPI)

Identification and Protection within the Research, Development, Test, and Evaluation

(RDT&E)

j. Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems & Networks

k. Department of Defense Directive 8140.01, Cyberspace Workforce Management

l. Department of Defense Instruction 8330.01, Interoperability of Information

Technology (IT), Including National Security Systems (NSS)

m. Department of Defense Instruction 8500.01, Cybersecurity

n. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology

o. Department of Defense 8570.01-M, Information Assurance Workforce Improvement

Program

p. Department of Defense Instruction 8580.1, Information Assurance (IA) in the

Defense Acquisition System

q. DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk

Management Framework (RMF) into the System Acquisition Lifecycle

r. Defense Acquisition Guidebook (DAG)

s. Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19

Mar 14, subject: Real Property Related ICS Cybersecurity.

t. Defense Information Systems Agency (DISA) Secure Technical Implementation

Guides (STIGs)

u. National Institute of Standards and Technology Special Publication 800-30, Guide for

Conducting Risk Assessments

v. National Institute of Standards and Technology Special Publication 800-37, Revision

1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

w. National Institute of Standards and Technology Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

x. National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

y. National Institute of Standards and Technology Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security

z. UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

aa. United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related

Control Systems

bb. 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment. (See Attachment 5 for more information)

cc. DFARS Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber

Incident Reporting

5.0 WARRANTY

The Contractor shall provide a warranty for one-year parts and labor for all components Contractor installed during this contract. Warranty shall include all Contractor installed new equipment, hardware, and software and all modified existing equipment by the Contractor. The warranty will commence upon Government acceptance of the completed work at the new East Gate.

Upon Government acceptance, the Contractor shall provide a Warranty listing of all equipment and software Contractor installed under this PWS in a Microsoft Excel spreadsheet within 10 business days after final inspection and acceptance. This list shall include item nomenclature (common name) Contractor/vendor, model number, serial number, warranty start date, Contractor’s warranty expiration date and equipment manufacturer’s warranty expiration date. Manufacturer's certifications, licensing documentation and all manuals and/or hard copy documents shall be included with warranty documentation.

6.0 CONTRACTOR QUALITY CONTROL PLAN (QCP)

The Contractor shall submit a QCP within 10-business days of contract start date to the COR and COTR.

This plan shall describe the Contractor’s methodology of compliance with the Deliverables and Performance Requirements Summary outlined herein. The COR will notify the Contractor of concurrence or required modifications to the QCP within 10 business days of receipt. The Contractor shall make appropriate modifications of the COR’s notification and provide a revised QCP within 5-business days.

7.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The QASP identifies the methods the Government will use to measure performance of the Contractor against the requirements and performance standards of the PWS. The QASP consists of guidelines for performance surveillance, evaluation, reporting, deficiency notification, and adjustments. The Government will conduct quality assurance inspections on all phases and types of work performed. The Government reserves the right to perform quality assurance inspections at any time. The Government will perform quality assurance of Contractor's performance under this contract using the method of surveillance described in the Section 10, Table 10.2.

8.0 PERFORMANCE REQUIREMENTS SUMMARY

The tasks the Contractor shall perform are defined in the PWS. All deliverables (reference Section 10) will be submitted to the COR and COTR for acceptance unless otherwise agreed upon.

The Government will make objective and subjective assessments of the Contractor’s performance to determine whether contract performance is acceptable. The Contractor is expected to perform all functions in a professional manner and prepare accurate and timely documentation. Progress will normally be tracked based on the milestone event such as when a deliverable is due or when the Contractor receives a specific tasking. It is expected that the documentation and procedures will comply with all major regulatory and process requirements, and agency policies and procedures.

8.1 Method of Surveillance

The Government will ensure quality assurance and timeliness of all tasks via COR random inspections and customer feedback. The Government will inspect and evaluate performance of each completed task or deliverable required in this PWS.

8.2 Inspection and Acceptance Criteria

Final inspection and acceptance of all work performed, reports and other deliverables will be performed at the place of delivery by the COR. All deliverables will be inspected for content, completeness, accuracy, legibility and conformance to contract requirements by the COR. At the discretion of the Government, inspection may include validation of information or software using automated tools and/or testing of the deliverables, as specified in the PWS.

If the Government finds that a draft or final deliverable contains spelling errors, grammatical errors, improper format, or otherwise does not conform to the requirements stated within the PWS, the document may be immediately rejected without further review and returned to the Contractor for correction and resubmission. If the Contractor requires additional Government guidance to produce an acceptable draft, the Contractor shall arrange a meeting with the COR.

The basis for acceptance shall be compliance with the requirements set forth in this PWS, the Contractor's proposal and other terms and conditions of the contract. Deliverable items rejected shall be corrected in accordance with the applicable clauses. Reports and document deliverables will be accepted when all discrepancies, errors or other deficiencies identified in writing by the COR have been corrected to the Government’s satisfaction. The Government will notify the Contractor within 10 working days if the document requires any edits or corrections or the document is considered final.

The Contractor shall provide electronic copies of deliverables. Electronic copies shall be delivered via email attachment or other media by mutual agreement of the parties. The electronic copies shall be compatible with the current DLA Microsoft (MS) Office products or other applications as appropriate and mutually agreed to by the parties. The Contractor shall use best commercial practices for formatting deliverables under this contract. If the draft deliverable is adequate, the Government may accept the draft and provide comments for incorporation into the final version. All the Government's comments to deliverables must either be incorporated in the succeeding version or the Contractor must demonstrate to the Government's satisfaction why such comments should not be incorporated.

8.3 General Acceptance Criteria

General quality measures, as set forth below, will be applied to each work product received from the Contractor under the resultant contract. These performance measurements are defined as:

Quality

• Accuracy – Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity – Work products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

• Consistency to Requirements – All work products must satisfy the requirements of this Performance Work Statement.

• Format – Work products shall be submitted in digital format or hard copy (where applicable) in media mutually agreed upon prior to submission. Hard copy formats shall follow any specified Directives or Manuals. All text and diagrammatic files shall be editable by the Government.

Timeliness

• Work products shall be submitted on or before the due dates determined/specified between the COR and Contractor or submitted in accordance with the delivery schedule frequency.

8.4 Performance Review and Payments

The Contractor’s performance will be monitored by the COR. The tasks will be rated on the performance of the Contractor on the timeliness and quality of the services provided using the adjectival ratings for each criterion as shown below. For any rating less than Satisfactory, the Contracting Officer will review the performance documentation and make the final determination for the rating. Payment of the full monthly price for services rendered requires a Satisfactory rating for the applicable monthly period.

Below are the Performance Standards that will be used in evaluating performance in determining the amount of the payment owed to the Contractor.

Performance standards and ratings are designed to determine if performance meets or does not meet a given metric and acceptable quality level. The performance will be rated by the COR prior to payment.

These findings will be the basis for the amount paid for that period.

Note: The application of these performance ratings or failure of the Government to apply these performance ratings does not waive any of the Government’s rights to other remedies under this contract or otherwise available to the Government. The following overall ratings will be used:

Overall Performance Ratings Satisfactory – Performance meets or exceeds contractual requirements. The contractual performance reflects a minor problem(s) for which corrective actions taken by the Contractor appear or were satisfactory. The COR recommends and the Contracting Officer will decide to pay the Contractor 100% of the invoice amount.

Fair – Performance does not meet some contractual requirements. The contractual performance reflects a minor problem(s) for which the Contractor either has not yet identified corrective actions or the Contractor’s proposed actions appear only marginally effective or were not fully implemented. The minor performance problem(s) do not adversely impact the mission of the Agency. The COR recommends and the Contracting Officer will decide to pay the Contractor 90% of the invoice amount.

Marginal – Performance does not meet some contractual requirements. The contractual performance reflects a serious problem(s) for which the Contractor either has not yet identified corrective actions or the Contractor’s proposed actions appear only marginally effective or were not fully implemented. The COR recommends and the Contracting Officer will decide to pay the Contractor 80% of the invoice amount.

Unsatisfactory – Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains a serious problem(s) for which the Contractor’s corrective actions appear or were ineffective.

Timeliness Satisfactory Meets or exceeds contractual requirements in terms of timeliness of delivery. The timeliness of contractual performance reflects a minor problem(s) for which corrective actions taken by the Contractor appear or were satisfactory.

Fair Does not meet some contractual requirements in terms of timeliness of delivery. The timeliness of contractual performance reflects a minor timeliness problem(s) for which the Contractor either has not yet identified corrective actions or the Contractor’s proposed actions appear only marginally effective or were not fully implemented. The minor timeliness problem(s) do not adversely impact the mission of the Agency.

Marginal Does not meet some contractual requirements in terms of timeliness of delivery. The timeliness of contractual performance reflects a serious problem(s) for which either the Contractor has not yet identified corrective actions or the Contractor’s proposed actions appear only marginally effective or were not fully implemented.

Unsatisfactory Does not meet most contractual requirements in terms of timeliness of delivery and recovery is not likely in a timely manner. The timeliness of contractual performance contains a serious problem(s) for which the Contractor’s corrective actions appear or were ineffective.

Quality Satisfactory Meets or exceeds contractual requirements in terms of quality of work performed. The quality of contractual performance reflects a minor problem(s) for which corrective actions taken by the Contractor appear or were satisfactory.

Fair Does not meet some contractual requirements in terms of quality of work performed. The quality of contractual performance reflects a minor quality problem(s) for which the Contractor either has not yet identified corrective actions or the Contractor’s proposed actions appear only marginally effective or were not fully implemented. The minor quality problem(s) do not adversely impact the mission of the Agency.

Marginal Does not meet some contractual requirements in terms of quality. The quality of contractual performance reflects a serious problem(s) for which the Contractor either has not yet identified corrective actions or the Contractor’s proposed actions appear only marginally effective or were not fully implemented.

Unsatisfactory Does not meet most contractual requirements in terms of quality and recovery is not likely in a timely manner. The quality of contractual performance contains a serious problem(s) for which the Contractor’s corrective actions appear or were ineffective.

Disincentives are applied for ratings of “Fair”, “Marginal”, and “Unsatisfactory” as follows:

Satisfactory = 100% payment Fair = -10% disincentive Marginal = -20% disincentive Unsatisfactory = Payment will be withheld pending resolution of cure notice(s). Termination for default or cause may result.

9.0 PERSONNEL

In order to be eligible for award, the offeror must be a certified LenelS2 Government Value Added Reseller (VAR) employing, and staffing to this project, one or more current expert level technicians.

The Contractor shall provide certain skilled, experienced, professional and/or technical personnel consistent with the requirements of this PWS and the staffing plans in the Contractor’s technical quote.

Contractor personnel shall be certified to perform all items within this PWS.

9.1 Personnel Requirements

The following personnel requirements are applicable:

1. The provisions of this PWS shall be fully applicable to any subcontract which may be entered into.

2. The Contractor will provide certain skilled, experienced, professional and/or technical personnel consistent with the requirements of this Performance Work Statement and the staffing plans in the Contractor’s technical proposal. All proposed personnel shall be required to possess an IT-II or IT-I at the time of award. Contractor personnel supporting Cyber Security (CS) functions shall be appropriately certified prior to being engaged. The Contractor is responsible to provide qualified personnel as specified and required by the PWS and shall bear all cost for training of its personnel. The Government will not reimburse the Contractor for the cost for training of Contractor personnel. Training will not be allowed on Government time. The 8570.1- M, Information Assurance Workforce Improvement Program provides IA Workforce Certification organizations. The contracting officer will verify that Contractor personnel are appropriately certified and remain so for the duration of the task order

3. All contract personnel connecting, administering and or requiring privileged (non-standard) access to devices, systems or applications that reside on the DLA network require current 8570.01-M certifications which include Information Assurance Technical (IAT) Level II, Computer Environment (CE). These certifications must be sufficient to install, configure, administer, mitigate and maintain Lenel Server applications (DLA CE Server Admin M account) and Lenel Client applications (DLA CE Directory Level Admin L account) and the connection of this security system to the Base Wide Lenel Security system. The Contractor shall provide the certificates at proposal submission, five (5) days after award and then within two (2) days of any changes (expirations, additions or recertification) along with the Contractor 8570 Deliverable Template (will be supplied at award).

(https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/).

4. The contracting officer will verify that Contractor personnel are appropriately certified and remain so for the duration of the task order.

5. The Contractor shall designate a Project Manager who will have the authority to act as the principle point of contact to the Government Contracting Officer (KO), Program Manager, Contracting Officer’s Representative (COR) and Contracting Officer’s Technical Representative (COTR) and the authority to act on the Contractor’s behalf in all contract performance matters relative to this performance work statement.

9.2 Personnel Security Requirements

A majority of the work to be performed under this requirement is unclassified, however, a security clearance maybe required for any Secret Internet Protocol Router Network (SIPRNet) room(s) and Position. All Contractor personnel proposed to work on the network or any IT Capabilities/Functions (at a minimum) will be required to have IT-II, a clearance requiring a National Agency Check with Law and Credit (NACLC) or NACLC equivalent.

Citizenship. Each Contractor employee shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence, or who presents evidence from the Immigration and Naturalization Service that employment will not affect his immigration status.

Access. Contractor employees (including those of sub-contracts) are required to obtain Common Access Card (CAC) prior to starting work. Lost or stolen Contractor employee badges must be reported to Government security. A replacement CAC will be issued.

Contractor shall provide, prior to the Kickoff Meeting, a list of the personnel performing the work with the required certifications to the Contracting Officer’s Representative (COR). All Contractor personnel shall be United States (US) citizens, speak fluent English, and shall have the required security clearances.

DLA retains the right to request removal of Contractor personnel whose actions while assigned to this contract, clearly conflict with the interest of the Government. The reason for removal shall be documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor shall within a two to four-week timeframe, assign qualified personnel to vacancy(s) thus created.

10.0 DELIVERABLES / PERFORMANCE REQUIREMENTS

The Tables below identifies the deliverables and performance requirements resulting from the tasks defined in this PWS. All completed deliverables shall be forwarded to the COR and COTR. Contractor shall use best commercial practices for formatting all deliverables under this effort. Electronic copies of all deliverables shall be sent to the COR and COTR via email in Microsoft Office compatible formats.

TABLE 10.1 DELIVERABLES

PWS

Section Deliverable Quantity: No. of

Reports/Data Calls Deliverable Due Date to Government for review

3.2 Attend Project Kickoff Meeting 1 Meeting Meeting will be held within 5 business days from date of award

4.0 9.1 21.0

8570 IAT II and Computing Environment (CE) certifications

1 soft copy 5 days after contract award and within 2 days of any changes

9.1 8570 Spreadsheet 1 soft copy 5 days after contract award and within 2 days of any changes

3.2 3.3 9.3

Project Schedule 1 soft copy Within 5 business days of award and weekly (Monday by noon)

6.0 Contractor Quality Control Plan 1 soft copy Within 10 business days of contract start date

3.1 Contractor Hardware/Software

Inventory Report

1 soft copy Within 10 days of contract start date (before procurement) and Weekly (Monday by noon)

3.1 Design to Integrated East Gate into

Base Wide System

1 soft copy Within 10 days of contract start date

3.3 Test Report 1 soft copy Within 1 business day of

test completion

3.0 Weekly Status Report 1 soft copy Weekly (Monday by

noon)

4.0 LCA Package 1 soft copy 3 months after contract

award

4.0 SSP Document 1 soft copy 3 months after contract

award

3.0 Test Plan / Migration Plan 1 soft copy As required/requested

19.0 Training Documentation 1 soft copy and with

any hard copy of manufacturer manuals

Prior to Government acceptance

3.3 Equipment Data Sheet (Attachment 1) 1 soft copy Within 10 business days after the final inspection and acceptance

3.0 As-Built Drawings 1 soft copy Within 10 business days

after the final inspection and acceptance

3.3 System Inspection Operational

Acceptance/Commissioning Test

1 soft copy Within 10 business days after system is brought online

3.0 Return all video, photos, usernames/passwords and any documentation obtained and developed

All items Within 10 business days after the final inspection and acceptance

5.0 Equipment and Software Inventory, Installation Warranty, Warranty Spreadsheet, Manufacturer Certification, Manuals and Licensing List

1 soft copy of the spreadsheet and with any hard copy manufacturer manuals, certifications and documentation

Within 10 business days after the final inspection and acceptance

TABLE 10.2 PERFORMANCE REQUIREMENTS

PWS

Section

Title Surveillance Method and Performance

Standards

Surveillance Schedule

Incentive

10.0 Deliverables 100% COR Inspection

Performance Standards – see Section 8

As required Timeliness and quality ratings to be assigned pursuant to section 8

3.0 Task

Requirements

100% COR Inspection

Performance Standards – see Section 8

As required Timeliness and quality ratings to be assigned pursuant to section 8

11.0 OTHER REQUIREMENTS

Identification Badges / Common Access Card (CAC): Every Contractor employee (including those of sub-contracts) is required to obtain an identification card badge (ID Card) / Common Access Card

(CAC).

The Contractor shall submit DD Form 2875 (or current form) for those employees requiring elevated / privileged systems access.

The Contractor will not employ any person whose employment will violate the requirements of DOD5500.7, Joint Ethics Regulation.

The Contractor shall make no public disclosures of work being performed under this effort and will only provide applicable information to authorized individuals on a need to know basis

12.0 SAFETY AND STANDARDS

The Contractor shall be responsible for compliance with all local, state, federal laws and codes.

The Contractor shall follow all safety regulations, industry standards and practices.

The Contractor shall always be responsible for and maintain a safe and clean work area. The Contractor shall remove all refuse and trash daily and ensure not to block and fire egress walkways.

13.0 SECURITY

13.1 Access to Classified and Sensitive Information

The provisions listed below apply to the prime Contractor and any Sub-Contractors the Prime Contractor may employ during this contract.

This Project is categorized as unclassified, For Official Use Only (FOUO).

The Contractor’s personnel shall submit their information to the…