PWS.docx

OEM Professional Services Performance Work Statement

U.S. Department of Commerce NOAA National Ocean Service Original Equipment Manufacturer Professional Services Performance Work Statement Version 1.4

6/22/2017

PART 1

INFORMATION

1.01 Background

The National Ocean Service (NOS) is a line office of the National Oceanic and Atmospheric Administration (NOAA) which is a bureau of the United States Department of Commerce (DOC). The mission of NOS is broad and includes a variety of technical and scientific services in support of coastal ocean natural resource stewardship and navigation support. Within NOS are program offices that are charged with carrying out the NOS mission.

The NOS Information Management Office provides enterprise-wide IT infrastructure services to all NOS programs and users as well as IT services to the Headquarters staff offices. These enterprise-wide IT infrastructure services include:

· Local and Wide Area Network Management and Administration

· Active Directory Domain Infrastructure Management

· Enterprise Storage Management Services

· Desktop Configuration Management Services

· IT Security Management Services

· IT Service Management

· Web and Application Hosting Services

· Video Teleconference Management and Administration

In addition, NOS program office use IT services implemented and supported by the DOC and NOAA:

· DOC Enterprise Cybersecurity Monitoring and Operations (ECMO)

· NOAA IT Security Scanning Services (Security Center)

· NOAA Enterprise Security Services

These services are implemented using products and diverse technologies from a number of IT vendors.

It is not practical for IT staff to be knowledgeable of and possess the in-depth subject matter expertise for all the technology in use at all times. NOS has the need to be able to procure the expert professional services of the Original Equipment Manufacturer (OEM) vendors of products and technology implemented in its enterprise services. The expert-level of support required is sporadic and for very short duration but must be provided within a very short turnaround otherwise mission and business essential functions may be impacted. To manage IT Infrastructure services in an efficient, cost-effective manner, NOS IT staff need access to a pool of OEM subject matter experts in a just-in-time fashion. Having access to this specialized knowledge at the time it is needed, and for only as long as it’s needed, will enable staff to quickly overcome obstacles and complete complex assignments.

It is not efficient to develop individual professional services contracts on an as needed basis. NOS requires a means to bring OEM professional services in in a timely fashion.

NOS envisions the need for three (3) short-term (10 day) engagements over the course of the year. This could change as conditions warrant.

1.02 Objectives

The overarching objectives of the support described in this PWS are to:

· Establish Master Service Agreements (MSA) with designated OEM vendors with defined response times, service levels and deliverables per the requirements below

· Work with OEM vendors to develop detailed engagement plans (including scope of work, schedule, milestones, deliverables, and resource allocation) in response to task orders from the Government Task Manager

· Secure Subject Matter Expertise for specialized consulting to the NOS Infrastructure Management Team personnel for a relatively short duration (several hours to several weeks)

· Manage each engagement, ensuring tasks are resourced appropriately and are being executed on schedule, within budget, and in accordance with the technical requirements

· Perform quality assurance/quality control consistent with the pre-determined Service Level Agreements (SLAs) defined in the MSAs

1.03 Scope/High-level Description

This PWS describes the scope of work, objectives, tasks and resources needed to bring in OEM vendor professional services and subject matter expertise in the products and technologies used support NOS enterprise IT infrastructure services. OEM professional services and subject matter expertise are required on an infrequent basis and at short, irregular intervals. NOS must establish these capabilities in order to better support and more efficiently and effectively operate its growing IT services portfolio.

In order to meet the needs of a complex enterprise infrastructure, NOS requires just-in-time support for OEM professional services to respond to IT requirements in a timely (as-needed), efficient and cost-effective manner. OEM professional services include (but not limited to):

· Proactive systems evaluations and assessments

· Systems architecture, analysis, and design

· Systems engineering services

· Consulting services

· System installation and implementation services

The contractor will work with the NOS Task Manager to identify the required kills for a specific engagement project based on NOS needs, define the scope of work, develop engagement plans, and select appropriate OEM SMEs.

1.04 Requirements

1.041 Establish OEM Support Program

The contractor will work with the government Task Manager to establish the support program:

Evaluate and inventory the technologies in use within NOS IT infrastructure to identify appropriate OEM vendors for support. This includes, but is not limited to, the following vendors: Cisco, Microsoft, NetApp, Dell, McAfee, Alemba, ESRI, Polycom, IBM, Nessus, SolarWinds, and ArcSight.

The contractor shall establish Master Service Agreements with each of the OEM vendors identified.

MSAs must define:

· Vendor response times

· Service Level Agreements

· Standard engagement deliverables

· Hourly rates

· Additional terms and conditions required to meet government objectives and requirements

The contractor will develop processes and procedures to support task order requests for OEM support services. Processes and procedures must support the entire life-cycle of an OEM vendor engagement and include:

· Requirements gathering

· Engagement planning

· Engagement management

· Reporting

· Engagement closeout

1.042 Manage OEM Vendor Engagements

The contractor is expected to respond to task order requests within three weeks (fifteen business days) with detailed Engagement Plans identifying the following:

· Scope of work

· Schedule w/Milestones

· Engagement deliverables/report format

· Resource allocation

· Points of contact

· Cost

Upon approval of the Engagement Plan by the Government Task Manager, the contractor shall coordinate an engagement start date with the Government Task Manager and the OEM vendor not to exceed three weeks (fifteen business days) from engagement plan approval.

The contractor will monitor the engagement schedule and ensure all engagement deliverables are accurate and delivered on time.

1.05 Deliverables

Award

Each Engagement Plan needs to include, as a minimum, the following elements:

· Scope of work

· Schedule w/Milestones

· Engagement deliverables/report format

· Resource allocation

· Points of contact

· Cost

The Engagement Report must include all elements identified and agreed to in the Engagement Plan – in addition to the following mandatory elements:

· Description of the work performed

· Findings

· Corrective actions, if any, needed to address findings

1.06 Constraints

None identified.

1.07 Period of Performance

The period of performance shall be September 15, 2017, to September 14, 2018

1.08 Hours of Operation/Place of Performance

The contractor is responsible for performing between the hours of 8 AM and 5 PM Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this statement of work when the Government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

Work will normally be performed at the National Oceanic and Atmospheric Administration, 1305 East West Highway, Silver Spring, MD 20910. Remote work is authorized and will be scheduled and monitored at the discretion of the TM and must comply with the Department of Commerce Information Technology Requirement (CITR) 0008: Remote Access.

Travel under this task award may be necessary in order to accomplish certain task(s) contained in this task award. Travel must be deemed necessary and authorized by the TM in order to be paid for by the Government. Except for exceptional circumstances, travel will not be reimbursed at more than applicable rates cited in the Federal Travel Regulations, prescribed by the General Services Administration, for travel in the conterminous 48 United States or the Standardized Regulations (Government Civilians, Foreign Areas), Section 925, "Maximum Travel Per Diem Allowances for Foreign Areas," prescribed by the Department of State, for travel in areas not covered above.

1.09 Special Qualifications

The contractor is expected to provide a fully trained, certified, and experienced workforce to the government; therefore, personal development training costs and hours are not billable to the government.

The contractor is responsible for ensuring all employees possess at least one industry recognized certification related to the activities being performing. For example, Microsoft Certified Solutions Associate (MCSA) certified in server, database, and developer; Cisco Certified Network Professional (CCNP); NetApp Certified Implementation Engineer (NCIE); Certified McAfee Security Professional (CMSP) among others.

1.010 Recognized Holidays

In addition to the days designated as holidays, the Government observes the following days:

Any other day designated by Federal Statute Any other day designated by Executive Order Any other day designated by a President's Proclamation

It is understood and agreed between the Government and the contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement to compensation except as set forth within the contract. If a contractor believes that an unplanned absence has an impact on the price or period of performance, it should notify the contracting officer (CO) of the changed condition and submit a claim for equitable adjustment (see FAR 52.233-1).

1.011 Security Requirements

1.0110 The systems supported under this task are designated FISMA Moderate Impact systems.

1.0111 Suitability/Risk Level - The suitability or risk level for this work has been determined to be: High. As such, the contractor shall pre-screen their employees to eliminate anyone who does not meet the following criteria: The prospective employees must be U.S. Citizens.

48 CFR 1352.237-70 - Security Processing Requirements—High or Moderate Risk Contracts (APR 2010)

(a) Investigative Requirements for High and Moderate Risk Contracts. All contractor (and subcontractor) personnel proposed to be employed under a High or Moderate Risk contract shall undergo security processing by the Department's Office of Security before being eligible to work on the premises of any Department of Commerce owned, leased, or controlled facility in the United States or overseas, or to obtain access to a Department of Commerce IT system. All Department of Commerce security processing pertinent to this contract will be conducted at no cost to the contractor. The level of contract risk will determine the type and scope of such processing, as noted below.

(1) Investigative requirements for Non-IT Service Contracts are:

(i) High Risk—Background Investigation (BI).

(ii) Moderate Risk—Moderate Background Investigation (MBI).

(2) Investigative requirements for IT Service Contracts are:

(i) High Risk IT—Background Investigation (BI).

(ii) Moderate Risk IT—Background Investigation (BI).

(b) In addition to the investigations noted above, non-U.S. citizens must have a pre-appointment check that includes an Immigration and Customs Enforcement agency check.

(c) Additional Requirements for Foreign Nationals (Non-U.S. Citizens). To be employed under this contract within the United States, non-U.S. citizens must have:

(1) Official legal status in the United States;

(2) Continuously resided in the United States for the last two years; and

(3) Obtained advance approval from the servicing Security Officer of the contracting operating unit in consultation with the DOC Office of Security (OSY) headquarters. (OSY routinely consults with appropriate agencies regarding the use of non-U.S. citizens on contracts and can provide up-to-date information concerning this matter.)

(d) Security Processing Requirement. Processing requirements for High and Moderate Risk Contracts are as follows:

(1) The contractor must complete and submit the following forms to the Contracting Officer's Representative (COR):

(i) Standard Form 85P (SF-85P), Questionnaire for Public Trust Positions;

(ii) FD-258, Fingerprint Chart with OPM's designation in the ORI Block; and

(iii) Credit Release Authorization.

(2) The Sponsor will ensure that these forms have been properly completed, initiate the CD-254, Contract Security Classification Specification, and forward the documents to the cognizant Security Officer.

(3) Upon completion of security processing, the Office of Security, through the servicing Security Officer and the Sponsor, will notify the contractor in writing of an individual's eligibility to be provided access to a Department of Commerce facility or Department of Commerce IT system.

(4) Security processing shall consist of limited personal background inquiries pertaining to verification of name, physical description, marital status, present and former residences, education, employment history, criminal record, personal references, medical fitness, fingerprint classification, and other pertinent information. For non-U.S. citizens, the Sponsor must request an Immigration and Customs Enforcement agency check. It is the option of the Office of Security to repeat the security processing on any contract employee at its discretion.

(e) Notification of Disqualifying Information. If the Office of Security receives disqualifying information on a contract employee, the COR will be notified. The Sponsor, in coordination with the Contracting Officer, will immediately remove the contract employee from duties requiring access to Departmental facilities or IT systems. Contract employees may be barred from working on the premises of a facility for any of the following:

(1) Conviction of a felony crime of violence or of a misdemeanor involving moral turpitude;

(2) Falsification of information entered on security screening forms or on other documents submitted to the Department;

(3) Improper conduct once performing on the contract, including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct prejudicial to the Government, regardless of whether the conduct was directly related to the contract;

(4) Any behavior judged to pose a potential threat to Departmental information systems, personnel, property, or other assets.

(f) Failure to comply with security processing requirements may result in termination of the contract or removal of contract employees from Department of Commerce facilities or denial of access to IT systems.

(g) Access to National Security Information. Compliance with these requirements shall not be construed as providing a contract employee clearance to have access to national security information.

(h) The contractor shall include the substance of this clause, including this paragraph, in all subcontracts.

1.0112 Physical Security. The contractor shall be responsible for safeguarding all government property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.0113 IT Security Requirements.

The contractor is required to meet the DOC IT Security Program Policy (http://home.commerce.gov/CIO/ITSITnew/IT_Security_Program_Documentation.html).

The government will provide the necessary computer equipment and information to perform this contract. The government will provide the necessary office space when performing working on Government locations. All work must be performed upon government furnished equipment and if additional hardware is/are needed, the contractor must request the additional requirements from the Contracting Officer Representative (COR).

The contractor must use government furnished equipment (GFE), which is currently covered by an existing government Certification and Accreditation (C&A) or Assessment and Authentication (A&A) package. The contractor will have administrative control over the systems performing penetration assessment activities and will be permitted the installation of any open source and/or Contractor licensed software for performing the penetration assessment services. The government will not be purchasing software or software licensing for any Contractor specialty software used for this acquisition.

The Contractor must return the equipment with all provided and obtained government information on the GFE. The Contractor is only permitted to remove Contractor licensed software prior to returning the GFE. The Contractor must describe the techniques/strategies being employed to protect the GFE including the information at rest.

The Certification and Accreditation (C&A) or Assessment and Authentication (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required. The contractor will not be processing, transmitting and/or storing any personally identifiable information (PII) in carrying out this contract. The contractor will be processing, transmitting and/or storing government privileged access information (i.e., non-public) in carrying out the tasks of this contract. The contractor must work with the COR prior to sending the information to establish a secure method for transfer. One option could be a file encrypted with a password using a product like WinZip or use the DOC secure file transfer service which encrypts data at rest and in transit. The contractor must encrypt any unclassified but sensitive information that will be sent electronically (i.e., email), which includes:

· Proprietary configuration information,

· IT security incident related information,

· Internet Protocol (IP) addresses,

· Fully Qualified Domain Name (FQDN),

· Media Access Control (MAC) addresses,

· Vulnerability information (including vulnerabilities detected or unpatched systems and techniques used to attack and/or compromise component services and/or operating system),

· Network diagrams,

· IT component inventory,

· Any obtained user, application, service and/or operating system credential(s)

The contractor must consider IT Security controls throughout the lifecycle of this contract as outlined in NIST Special Publication 800-64 (http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf).

The contractor shall guarantee strict confidentiality of the information/data that it is provided by the Government or obtained during the performance of the acquisition. The Government has determined that the information/data that the contractor will be provided during the performance of the task order is of a unclassified but sensitive nature. The contractor also agree not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work provided herein, i.e., on a “need to know” basis. The contractor agrees to immediately notify the Contracting Officer in writing in the event that the contractor determines or has reason to suspect a breach of this requirement. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

Upon completion of the work, the contractor shall certify in writing to the contracting officer that all government information in hard copy and electronic form has been either returned to the government, if appropriate, or destroyed using one of the methods for destruction of unclassified but sensitive information recommended by the National Security Agency in the Media Destruction Guidance available online at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml.

1.1 General PWS Information

1.10 Conservation of Utilities. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

1.11 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), Task Manager (TM), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.12 Contract Manager: The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the Contracting Officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.13 Processing and Identification of Contractor Employees: Prior to commencing work under this contract, the contractor shall submit or have their employee submit the required security forms and number of copies as informed by the Task Manager. The contractor, when notified that the Government rejected the suitability assessment forms shall either have the rejected forms made compliant and resubmitted or withdraw the employee from consideration from working under this contract.

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will not be required to obtain and wear badges in the performance of this service since it is anticipated that tasks will be of short duration (typically less than 10 days). Contractor personnel will be escorted by government personnel for access into government facilities.

1.14 Quality Assurance: The contractor shall ensure quality assurance in accordance with the approved QAP as applicable to the services performed in accordance with this PWS. The contractor shall develop and implement procedures specific to this requirement to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality assurance program is the means by which he assures himself that his work complies with the requirement of the task order. At a minimum, the contractor shall develop quality assurance procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary.”

Quality Assurance Surveillance: The government shall evaluate the contractor’s performance under this task order in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Government Remedies: The contracting officer shall pursue remedies for the contractor’s failure to perform satisfactory services or failure to correct non-conforming services in accordance with the terms and conditions of the contract.

PART 2

DEFINITIONS & ACRONYMS

· PWS – Performance Work Statement

· Contracting Officer’s Representative (COR): A representative from the requiring activity assigned by the Contracting Officer to perform surveillance and to act as liaison to the contractor.

· Defective Service. A service output that does not meet the standard of performance associated with it in the Performance Work Statement.

· Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance to assure services meets the requirements of the Performance Work Statement.

· Quality Assurance. Those actions taken by a contractor to control the performance of services so that they meet the requirements of the PWS.

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.01 General: The government shall provide, the facilities, equipment, materials, and/or services listed below.

3.02 Equipment: The Government will provide: government furnished equipment (GFE) laptops/desktops for performing all aspects of this task order. The Government will not be providing GFE cell phones.

3.03 Services:

3.031 Utilities. All utilities in the facility will be available for the contractor’s use in performance of duties outlined in this PWS. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities. Utilities will be provided for internal penetration assessment activities only while residing within government facilities.

3.032 Facilities: The Government will furnish the necessary workspace for the contractor staff to provide the support outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

image1.png