H98210-11-R-0008.pdf

DEFENSE HUMAN RESOURCES ACTIVITY

SUITE 120

4040 N. FAIRFAX DR

ARLINGTON VA 22203

703-696-8671

UNDER DPAS (15 CFR 700)

11. DELIVERY FOR FOB

RFQ

SEE SCHEDULE

14. METHOD OF SOLICITATION

IFB RFP

CODE

SEE ADDENDUM

BLOCK IS MARKED

DESTINATION UNLESS

12. DISCOUNT TERMS

(No Collect Calls)

$12M

13b. RATING

13a. THIS CONTRACT IS A RATED ORDER

X

CODE

H98210-11-R-0008 01-Feb-2011

b. TELEPHONE NUMBER

703-696-8649

8. OFFER DUE DATE/LOCAL TIME

02:00 PM 02 Mar 2011

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV 3/2005)

Prescribed by GSA

FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER) 31c. DATE SIGNED

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

22. UNIT 23. UNIT PRICE 24. AMOUNT21. QUANTITY

CODE 10. THIS ACQUISITION IS

UNRESTRICTED

FAX: NAICS:

TEL:

CODE 18a. PAYMENT WILL BE MADE BYOFFEROR

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TEL.

H98210

SIZE STD:

9. ISSUED BY

FACILITY

CODE

17a.CONTRACTOR/

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

MELANIE THORNSBURY

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES

SEE SCHEDULE

541380

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS

SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

SB

HUBZONE SB

SET ASIDE: % FOR

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

H98259102920001

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

TEL: EMAIL:

1 COPIES

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

.OFFER DATED YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

X

8(A)

SVC-DISABLED VET-OWNED SB

EMERGING SB

X

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

SEE SCHEDULE

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES 21. QUANTITY 22. UNIT 24. AMOUNT

PAGE 2 OF

23. UNIT PRICE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV 3/2005) BACK

Prescribed by GSA

FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

H98210-11-R-0008

Section SF 1449 - CONTINUATION SHEET

DEFENSE HUMAN RESOURCES ACTIVITY (DHRA)

CARD FAILURE ANALYSIS

FOR THE

DEFENSE MANPOWER DATA CENTER (DMDC)

ALL PRODUCTS AND SERVICES TO BE IN ACCORDANCE

WITH THE ATTACHED PERFORMANCE WORK STATEMENT (PWS)

BASE YEAR:

June 1, 2011 – May 31, 2012

ITEM NO SUPPLIES/SERVICES ESTIMATED

QUANTITY

UNIT UNIT PRICE ESTIMATED AMOUNT

0001 12 Months Cardstock Quality Assurance

FFP

FOB: Destination

PURCHASE REQUEST NUMBER: H98259102920001

ESTIMATED

NET AMT

UNIT UNIT PRICE ESTIMATED AMOUNT

Special Assignments/Consultation Support

FFP

This CLIN will be negotiated at the individual task order level. (Do NOT Propose Price).

UNIT UNIT PRICE ESTIMATED AMOUNT

0003 12 Months Reports

FFP

ITEM NO SUPPLIES/SERVICES EST .

UNIT UNIT PRICE AMOUNT

0004 Dollars, U.S.

Travel and Related Expenses

COST

(Do Not Propose Cost)

ESTIMATED COST

OPTION YEAR 1:

June 1, 2012 – May 31, 2013

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1001 12 Months OPTION Cardstock Quality Assurance

FFP

UNIT UNIT PRICE ESTIMATED AMOUNT

OPTION Special Assignments/Consultation Support

FFP

This CLIN will be negotiated at the individual task order level. (Do NOT Propose Price).

1003 12 Months OPTION Reports

FFP

1004 Dollars, OPTION Travel and Related Expenses

(Do Not Propose Cost)

OPTION YEAR 2:

June 1, 2013 – May 31, 2014

2001 12 Months OPTION Cardstock Quality Assurance

FFP

UNIT UNIT PRICE ESTIMATED AMOUNT

OPTION Special Assignments/Consultation Support

FFP

This CLIN will be negotiated at the individual task order level. (Do NOT Propose Price).

2003 12 Months OPTION Reports

FFP

2004 Dollars, OPTION Travel and Related Expenses

(Do Not Propose Cost)

ADDENDUM TO SF1449

ADMINISTRATION INFORMATION

A. POINTS OF CONTACT:

Contracting Officer: TBA at contract award

4040 N. Fairfax Drive, Ste. 120 Arlington, VA 22203 Telephone: TBA Email: TBA

Contract Specialist: Melanie Thornsbury 4040 N. Fairfax Drive, Ste. 120 Arlington VA 22203 Telephone: 703-696-8649 Email: melanie.thornsbury@osd.pentagon.mil

Contracting Officer's Representative: TBA at contract award (COR) Address: TBA Telephone: TBA Email: TBA

The COR is not authorized to make any commitments or changes that will affect price, quality, quantity, delivery or any other terms and conditions of the contract. Reference DFARS clause 252.201-7000 (Contracting Officer’s Representative).

B. ADMINISTRATION, ACCOUNTING, AND APPROPRIATION DATA

The Administration Office and Accounting & Appropriation Data will be specified on each individual delivery/task order issued against the contract. Payment will be made by Government Purchase Card

(GPC).

C. INVOICE SUBMISSION

1. Payment shall be based on receipt of a proper invoice and satisfactory contract performance (as indicated on the respective Receiving Report completed by the COR). The Contractor shall comply with the content of invoice requirements specified at FAR Clause 52.212-4, paragraph (g) "Invoices." Failure to provide a proper invoice may result in return of invoice for correction and delay of payment.

2. The Contractor shall submit an original invoice to:

Mail: DHRA PSO

ATTN: INVOICE PROCESSING – GPC

4040 N. FAIRFAX DRIVE, STE. 120

ARLINGTON VA 22203

Fax: 703-588-1489

D. COMMERCIAL PROVISION - SECTION 508 – IT REQUIREMENT

All electronic hardware and software procured under this contract/purchase order must comply with Section 508 of the Rehabilitation Act of 1973, as amended, (29 U.S.C. 794d) and the Architectural and Transportation Barriers Compliance Board Electronic Information Technology (EIT) Accessibility Standards (36 CFR part 1194). Further information is available via the Internet at http://www.section508.gov.

E. CONTRACT TYPE AND DURATION

Contract award type shall be a Firm-Fixed Price, Requirements Contract. The Period of Performance shall be from June 1, 2011 – May 31, 2012 with two twelve month Option Periods.

F. PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s site; however, this effort requires that contractor personnel meet with Government points-of-contact on an as needed basis. The contractor shall be available for staff interaction with the DMDC, at mutually agreed upon dates, times and locations. In addition to DMDC offices in California and Virginia, other possible travel locations include France, England, Canada, and Germany.

G. COMMON ACCESS CARDS (CACS) FOR CONTRACTOR PERSONNEL

The contractor shall obtain CACs for all personnel requiring access to Government facilities in accordance with the following :

(a) For installation(s)/location(s) cited in the contract, contractors shall ensure Common Access Cards (CACs) are obtained by all contract or subcontract personnel who meet one or both of the following criteria:

(1) Require logical access to Department of Defense computer networks and systems in either:

(i) the unclassified environment; or

(ii) the classified environment where authorized by governing security directives.

(2) Perform work which requires the use of a CAC for installation entry control or physical access to facilities and buildings.

(b) Contractors and their personnel shall use the following procedures to obtain CACs:

(1) Contractors shall provide a listing of personnel authorized a CAC to the contracting officer.

The contracting officer will provide a copy of the listing to the government representative in the local organization designated to authorize issuance of contractor CACs (i.e., “authorizing official”).

(2) Contractor personnel on the listing shall each complete and submit a DD Form 1172-2 or other authorized DoD electronic form to the authorizing official. The authorizing official will verify the applicant’s name against the contractor’s listing and return the DD Form 1172-2 to the contractor personnel.

(3) Contractor personnel will proceed to the nearest CAC issuance workstation with the DD Form 1172-2 and appropriate documentation to support their identification and/or citizenship. The CAC issuance workstation will then issue the CAC.

http://www.section508.gov/�

(c) While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy.

(d) During the performance period of the contract, the contractor shall:

(1) Within 7 working days of any changes to the listing of the contract personnel authorized a CAC, provide an updated listing to the contracting officer who will provide the updated listing to the authorizing official;

(2) Return CACs in accordance with local policy/directives within 7 working days of a change in status for contractor personnel who no longer require logical or physical access;

(3) Return CACs in accordance with local policy/directives within 7 working days following a CACs expiration date; and

(4) Report lost or stolen CACs in accordance with local policy/directives.

(e) Within 7 working days following completion/termination of the contract, the contractor shall return all CACs issued to their personnel to the issuing office or the location specified by local policy/directives.

(f) Failure to comply with these requirements may result in withholding of final payment.

Performance Work Statement Card Failure Analysis

1.0 INTRODUCTION

1.1 Defense Manpower Data Center (DMDC) is part of a Department of Defense (DoD) Field Activity called the Defense Human Resources Activity (DHRA) which supports major programs and initiatives within the DoD. DMDC maintains the central and authoritative store of personnel, manpower, training, and security data for the DoD.

DMDC programs improve the effectiveness, efficiency, and productivity of personnel operations throughout DoD.

1.2 DMDC is the proponent organization within the DoD for the implementation of smartcard technology. The Deputy Secretary of Defense directed that the Department’s initial implementation be effected as a Department-wide Common Access Card (CAC).

In response to this directive, the Department issues CACs to military and civilian personnel throughout its Service branches. Since initial implementation, the Department has expanded the smartcard supported population to include other Federal and State affiliated personnel. The DMDC has a requirement for both ongoing and special assignment Card Failure Analysis, Durability Analysis, and CAC Program Support.

2.0 BACKGROUND

2.1 The DoD CAC solution has been accepted by more than 20 agencies in compliance with Homeland Security Presidential Directive (HSPD) -12. With approximately four million cards in circulation and an additional 300,000 issued monthly, the DoD CAC solution is used across several federal government agencies. In order to successfully implement the program for the Department and its customers, it is necessary to ensure that the smartcards provided comply with applicable standards. To that end, the Department has a requirement to ensure that the DoD CAC solution remains robust within the federal marketplace, the smartcards provided meet the standards prior to distribution and implementation; and that issuance failures are identified and troubleshooted.

2.2 Since physical access to federal facilities and logical access to protected information are generally maintained through use of the CAC solution at federal agencies, it is imperative that the DMDC obtain independent analysis services to help understand and reduce failure rates of the CAC solution.

2.3 Approximately 23.2 million CACs have been issued since the program began in 2002 with 3.8M cards currently in circulation. Approximately 8%, however, are being returned due to problems that occur during issuance or post-issuance field use. While many of these problems are currently being addressed by capable representatives within and outside the Department, there is a need for independent analysis services that will help understand and thus reduce the currently observed CAC failure rates.

2.4 The ongoing support typically includes the following for both DoD and other Government agencies, as required:

2.4.1 Cardstock Quality Assurance, Standards Compliance and Government

2.4.2 Procurement Specification Evaluation

2.4.3 Card Analysis

2.4.4 Statistical Analysis

2.4.5 Equipment analysis

2.4.6 Site Analysis

2.4.7 Industry and Cutting Edge Technology Appraisal

2.4.8 Special Assignment/Consultation Support

3.0 SCOPE

The contractor shall provide all personnel, management, equipment, and materials necessary to provide required support in performing quality assurance, standards compliance, and analysis services to maintain the integrity of the DoD CAC solution.

This includes providing DMDC with ongoing and special assignment Card Failure Analysis, Durability Analysis, and CAC Program Support as detailed within this PWS.

4.0 REQUIREMENT

4.1 Cardstock Quality Assurance, Standards Compliance and

Specification Evaluation

4.1.1 The contractor shall complete a series of tests to ensure that the cardstock provided to the Government meets required specifications and standards. A minimum of two card manufacturers’ products are fielded for each type of card provided. This includes current operational cardstock and proposed new card stock. The contractor shall perform supplemental tests to evaluate card durability characteristics to help assess whether the provided cards will meet or exceed a desired life span of three years. Based on these test results, the contractor shall make recommendations and suggest modifications to future versions of the current DoD CAC procurement specifications to help ensure that the Government continues to receive products of the highest available quality.

4.1.2 The contractor shall provide analysis, testing, and guidance regarding procurement specifications for next generation Smartcards. The contractor shall evaluate card performance against current DMDC procurement specifications and previously evaluated cardstock including the applicable international standards referenced in Appendix A. Whenever possible, all testing shall be performed according to and evaluated against the most current version of the International Standards. The contractor shall provide a detailed description of the approach intended to perform the testing and analysis and document the results. The contractor shall complete testing of the cards within 15 days of cardstock receipt, and an Independent Verification and Validation (IV&V) report outlining test methods and results shall be provided within 10 working days of test completion. Overall, compliance or non-compliance of the cards with standards shall be indicated on the report. The Contractor shall support additional tests which may be required by the Government.

4.1.3 The contractor shall perform and report on durability and artificial aging tests of vendor cardstock. The contractor shall plan durability and accelerated aging testing of at least two evaluations of vendor cardstock per year. Each evaluation may require multiple iterations of tests to ensure compliance.

4.2 Card Analysis

4.2.1 The Contractor shall analyze card failures and recommend ways to reduce the current card failure rate. The contractor shall protect all tested cards from unauthorized release by ensuring the cards are maintained in a secure storage area for subsequent analysis or review until tested cards are periodically released for destruction or returned to DMDC. In coordination with the Government, cards will be released for destruction when no longer needed for analysis. Cards shall always be transported via a traceable, accountable method.

4.2.2 Card Analysis – Issuance Failures. In order to investigate and address the high failure rates occurring during card issuance, the contractor shall perform and report on in-depth analysis of the cards that fail prematurely at the time of issuance and provide a report. Findings and recommendations to decrease the card issuance rates shall be presented monthly either at Senior Management Reviews or in separate reports as requested by the Government. DMDC may provide a Defense Enrollment Eligibility Reporting System (DEERS) sweep and documentation of return codes. The contractor shall extract a statistically significant sample of the cards that fail at the time of issuance.

4.2.3 Card Analysis – Field Failures. As requested, approved by, or at the initiation of, the Government, the Contractor shall perform analysis of cards that have failed prematurely while in field use 3-5 times per year in order to help ensure that the CAC will meet its three-year life expectancy. An example may include de-encapsulation of chip to determine root cause of failure. The contractor shall present findings to DMDC and outline recommendations to increase card durability and life.

4.3 Statistical Analysis

4.3.1 Contractor shall perform a statistical analysis of card failures to determine and assess trends. Contractor shall utilize data gathered by the Government monthly for field and card issuance failures and perform statistical analyses over time to determine descriptive and demographic variances. The Contractor shall provide a report with analysis of the cumulative data in the monthly Senior Management Review.

4.4 Equipment Analysis

4.4.1 Subject to approval, at the initiation of the Government, the contractor shall perform equipment analysis and evaluation of smartcard-related equipment, proposed or incorporated in the DoD CAC program or other DMDC-related programs. The contractor shall analyze equipment to ensure compatibility with the card and/or impact of equipment on card functionality. Examples of equipment which the contractor may evaluate include printers (direct-to-card printers and reverse image transfer printers), printer ribbons and other supplies, printer components, central issuance station equipment, linear and two dimensional barcode scanners, magnetic stripe readers, IC chip readers, and any other equipment related to card issuance and use. For example, in FY10, analysis/evaluation was performed on hand geometry units, card readers, keyboards with integrated card readers, and printers.

4.4.2 The contractor shall perform and report on technical analysis on equipment currently in use by the DoD. The contractor shall identify equipment problems and make recommendations for increased equipment reliability, compatibility, and durability to help ensure smooth program operation.

4.4.3 In addition, the contractor shall analyze equipment that is emerging in the marketplace for future implementation by DMDC. The contractor shall evaluate the integrity, reliability, durability, and cost effectiveness of the equipment under consideration. The contractor shall offer alternate equipment recommendations if more appropriate, reliable equipment is available. The contractor shall provide report updates in the monthly Senior Management Review or in scheduled meetings with

DMDC.

4.5 Site Analysis

4.5.1 At the initiation of the Government, the contractor shall provide field service teams to visit sites with an abnormally high rate of failure; or new CAC issuance sites.

Estimated number of site visits is 5 – 10 per year. At each site, the contractor shall be responsible for evaluating/troubleshooting equipment and cardstock, as well as the issuance processes and site activities.

4.5.2 The contractor teams shall identify problems that exist and actions to be taken to fix the problems. Site visit reports will summarize site visit findings and provide explicit instructions explaining required actions necessary to resolve CAC failure problems.

Card failure rates shall be tracked after the fixes are in place to determine whether the implemented recommendations had the desired impact.

4.6 Industry and Cutting Edge Technology

The contractor shall ensure that the Government is apprised of new developments in card technologies as they arise in the industry. Contractor shall plan on attendance at approximately 10 conference/meetings per year, subject to advanced approval by the Contracting Officer’s Representative (COR). Sample meetings include CARTES, Smartcard Alliance Annual Meetings, ANSI NCITS B10 Standards Development meetings. The contractor shall prepare a trip report that addresses findings pertaining to DMDC-specific interests in the smartcard market or technologies that may be of interest and support the DMDC mission. The contractor shall provide report updates to the DMDC either in monthly Senior Management Reviews or in scheduled meetings with DMDC representatives.

4.7 Special Assignments / Consultation Support

4.7.1 Other Government Agency Support. On occasion, the contractor may need to provide assistance to DMDC in providing support to other Government agencies with the documentation, planning and/or implementation of a Smartcard program similar to the DoD program.

4.7.2 Other/Special Assignments/Consultation. The contractor shall support special DMDC operational technical CAC program challenges and requirements. The contractor shall provide these services to help DMDC ensure smooth implementation of the CAC program including card issuance, interoperability, and daily use. The contractor shall assist DMDC in overseeing the management system for the production and fielding of smartcards to help ensure appropriate analysis, testing, production to specifications, and quality assurance/control are in place so that each technology meets its endurance specifications so as not to fail during the expected three-year life of the card.

4.7.2.1 The Contractor shall provide technical analysis and assist in the development of the Generic Identity Command Set (GICS) standard and its testing requirement. The GICS smart card standard will specify the capabilities of secure contactless communication and card management. The GICS standard is on track to become an ANSI standard that will encompasses existing Personal Identity Verification (PIV) cards.

GICS extends the FIPS 201 specification and allows additional non-PIV data objects, a standardized card issuance and management interface and support for middleware integration through ISO 24727. The ultimate goal is to lower card procurement costs and produce a broader platform base. The contractor assistance includes writing and developing future GICS testing to enhance cardholder capabilities and reduce development costs through GICS efficiencies. The Contractor shall provide report updates to the DMDC either in monthly Senior Management Reviews or in scheduled meetings with DMDC representatives.

4.8 Monthly Status Reports and Senior Management Reviews

4.8.1 The contractor shall participate in a monthly Senior Management Review (SMR) on the last Tuesday of the month or on a date specified by the Government. The purpose of the SMR is to provide monthly program and financial review. SMR documentation shall be provided five business days before the scheduled SMR and shall report on previous month activities. The SMR documentation shall include a discussion on the contractor’s progress, any issues identified by the contractor or the Government impeding progress, and a review of reports.

4.8.2 Contractor shall provide a copy of the SMR meeting minutes five business days after the monthly meeting.

4.8.3 All reports shall be provided in the format at Appendix B.

5.0 EXPERIENCE AND KNOWLEDGE REQUIREMENT

5.1 The contractor shall provide DMDC with subject matter expertise in the use of the newest technologies, systems and application software. It is the Contractor’s responsibility to ensure that all personnel assigned to this task maintain technical currency associated with their labor category and specialty. All costs associated with maintaining technical currency shall be at the Contractor’s expense. Extensive experience and knowledge is required to include the following:

5.1.1 ISO 7810:2003 Identification Cards – Physical Characteristics

5.1.2 ISO 7811-6:2008, Identification Cards – Recording Technique – Part 6 – Magnetic Stripe – High Coercivity

5.1.3 ISO 7816-1:1998, Identification Cards—Integrated Circuit(s) Cards with

Contacts—Physical Characteristics.

5.1.4 ISO 14443-1:2008 Identification Cards – Contactless Integrated Circuit

Cards – Proximity Cards

5.1.5 ISO 10373-2:2006 Test Methods

Note: The details of the tests including test methods and test equipment for all compliance tests can be found in the ISO 10373 standards.

5.1.6 NCITS 322 2008 Information Technology - Card Durability Test Methods

5.1.7 FIPS 201 Card Test Methods

5.2 Training unique to DMDC will be provided by DMDC.

6.0 DELIVERABLES AND REPORTS

6.1 On-going deliverable requirements for the base and both option years shall be delivered to the COR as detailed below.

Deliverable Paragraph Delivery Date Senior Management Review (SMR) documents including a copy of the corresponding invoice

4.8 5 business days before the SMR meeting

SMR Minutes 4.8.2 5th business day after SMR meeting Independent Verification and Validation (IV&V) Report of New Cards

4.1.1 10th business day after completion of new card stock analysis

Durability and Artificial Aging Test Evaluation Report

4.1.3 15th business day after test completion

Returned Card Stock Report – Issuance

4.2.2 Included in the SMR

Field Failure Analysis Update 4.2.3 included in the SMR, when analysis is completed

Statistical Analysis Report 4.3.1 included in the SMR Equipment Analysis Report 4.4.2 included in the SMR, when analysis is completed Site Analysis Report 4.5.2 included in the SMR, when analysis is completed Industry and Cutting Edge Technology Reports

4.6 included in the SMR

Quality Control Plan 11.0 30th calendar day after contract award and 5th business day after changes are required

7.0 CONTRACTOR TRAVEL

Contractor costs for Government authorized travel are included in this contract. All travel shall be in accordance with FAR 31.205-46 and applicable travel regulations (Joint, Federal or Standardized). Contractor payment claims shall include applicable documentation to support actual costs incurred (e.g. airfare and hotel/lodging receipts) as well as any receipts valued at or above $75.00. Failure to provide appropriate documentation may result in loss of reimbursement of travel expenses.

8.0 SECURITY

8.1 Personnel Security Clearance and Vetting Requirements

8.1.1 DoD 5200.2-R, DoD Personnel Security Program, assigns DoD contractor personnel who perform work on IT systems to one of three ADP position categories (ADP-I, ADP-II, ADP-III) that equate to Critical Sensitive, Non-Critical Sensitive, and Non-Critical, respectively. DoDI 8500.2, Information Assurance Implementation renamed the ADP position categories as IT Level I (IT-I) (Privileged), IT-II (Limited Privileged), and IT-III (Non-Privileged), respectively. Contractor personnel must be vetted to the IT level, as determined/specified by DMDC, in accordance with DoD Regulation 5200.1-R. Personnel who are charged with security as a duty should be professionally certified to the IT level-1 category as specified in 8570.01-M.

8.1.2 Contractor personnel may have access to sensitive but unclassified information.

In the event the contractor is given access to sensitive Government data, the contractor hereby agrees to protect such data from unauthorized use or disclosure as long as such data remains sensitive. In order to protect this sensitive information, the contractor shall comply with DoD Regulation 5200.1-R, Information Security Program and DoD Regulation 5200.2-R, Personnel Security Program.

8.1.3 All contractor personnel under this contract shall comply with DMDC Information Systems Security Group (DISSG) procedures to obtain proper security clearance or vetting prior to beginning work under the contract. Based upon the work to be performed under the contract, the DMDC DISSG will determine the proper vetting or security clearance requirement. Due to varying access requirements, information and data to which each contractor person may have access, personnel security clearance and vetting requirements will vary. However, all contractor personnel must meet, obtain or maintain, at a minimum, the following requirements to perform work under this contract:

8.1.3.1 Execute Non-Disclosure Agreements prior to being provided access to any DMDC application or administrator passwords. The contractor should refer to DoD Regulation 5200.2-R, Personnel Security Program for details;

8.1.3.2 Wear Government-issued access badges (Common Access Card) with coloration that distinguishes contractors from Government employees;

8.1.3.3 Obtain/Maintain a favorably adjudicated Criminal Background Investigation (CBI) prior to beginning work under this contract; and, submit a completed National Agency Check with Inquiries (NACI) package for processing prior to beginning work under this contract. If at any time, any contractor person is unable to obtain/maintain an adjudicated CBI or NACI, the contractor person shall be immediately removed from work under this contract and the government site;

8.1.3.4 Be a natural born or naturalized citizen of the United States; the contractor may request relief from this requirement in unique or compelling circumstances where only non-US citizens are capable of performing the requirement or providing specific areas of expertise. In such extremely limited and unusual circumstances, the contractor shall submit a request for relief from this requirement to the Contracting Officer.

8.1.3.5 Execute a DD Form 2841, Department of Defense (DoD) Public Key Infrastructure (PKI) Certificate of Acceptance and Acknowledgement of Responsibilities, and adhere to the acknowledged responsibilities there under (required for CAC issuance); and,

8.1.3.6 Attend and complete (annually) DMDC Information Assurance/Security Awareness training and other security related training provided by DMDC to ensure users understands all DMDC and DoD protocols.

8.1.4 Selected tasks under this contract shall require contractor personnel to obtain/maintain personnel security clearances at a minimum of SECRET or TOP SECRET level, depending upon the classification of the materials to be accessed. This requirement is identified in the tasks, accordingly.

8.1.5 The contractor shall designate personnel who either possess or will need to obtain the proper security clearances not later than 10 business days after contract award. In the event of personnel turnover after contract award, the contractor shall submit revised personnel designations within five business days of being made aware of pending personnel turn over action or within two business days of actual personnel turn over. Thereafter, the contractor shall compel its designated personnel who will need to obtain the proper security clearances to submit personnel security clearance packages as defined by the DMDC DISSG within ten (10) business days. Contractors are cautioned to keep personnel requiring clearances to only those numbers of personnel required to execute the work.

8.2 Protection of Personally Identifiable Information (PII)

8.2.1 To the extent that the work under this contract requires the contractor to have access to personally identifiable information about an individual (hereinafter referred to as “PII”), the contractor shall after receipt thereof, treat such PII as confidential and safeguard such information from unauthorized use and disclosure. The contractor agrees not to appropriate such PII for its own use or to disclose such information to third parties unless specifically authorized by the Government, in writing.

8.2.2 The contractor shall allow access only to those employees who need the PII to perform services under this contract and shall ensure that PII is used solely for the purpose of performing services under this contract. The contractor shall ensure that its employees will not discuss, divulge or disclose any such PII to any person or entity except those persons within the contractor’s organization directly concerned with the performance of the contract.

8.2.3 Contractor shall administer a monitoring process to ensure compliance. Any discrepancies or issues should be discussed immediately with the Contracting Officer Representative (COR) and corrective actions will be implemented immediately.

8.2.4 The contractor shall report immediately to the DMDC CIO / Privacy Office and secondly to the COR discovery of any Privacy breach. Protected PII is an individual’s first name or first initial and last name in combination with any one or more of the following data elements including, but not limited to: social security number; biometrics;

date and place of birth; mother’s maiden name; criminal, medical and financial records;

educational transcripts, etc.

8.2.5 The Contractor shall include this section in all appropriate subcontracts.

8.2.6 Applicable Documents

8.2.6.1 DoD Directive 5400.11, May 8, 2007. Subject: DoD Privacy Program.

8.2.6.2 DoD Regulation 5400.11-R, May 14, 2007. Subject: Department of Defense Privacy Program.

8.3 Physical Security

The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

8.4 Government Facility Access

Upon contract start, the contractor shall request and obtain Common Access Cards (CAC) and badges required for personnel access to work locations. The Contracting Officer’s Representative (COR) shall notify the contractor of any increased security requirements, if they occur, and the contractor shall submit adequate clearance packages within 10 calendar days of identification of increased security requirements.

9.0 ORGANIZATIONAL CONFLICTS OF INTEREST

9.1 Notice of organizational conflicts of interest (OCI): The contractor’s performance under this contract may create an OCI for other DMDC CAC related acquisitions.

Pursuant to FAR 2.101, "Organizational conflict of interest" means that because of other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the Government, or the person's objectivity in performing the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage." By the nature of work to be performed under this contract, the contractor is hereby notified that pursuant to FAR 9.505-2(b), the contractor may be prohibited from supplying the DoD with CACs due to an impermissible OCI. Prior to offering under a DMDC CAC related acquisition, the contractor shall notify the contracting officer of any potential OCIs.

9.2 Contractor personnel shall be required to sign a Non-disclosure statement.

10.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT

10.1 The Government will provide manuals on hardware and software as needed, as well as Standard Operating Procedures, briefs and other materials associated with the project as needed.

10.2 The Government will provide a suite of hardware as needed to mirror a RAPIDS card-issuance site in the field.

10.3 NOTE: The Government will not provide hardware to the lab for testing.

11.0 QUALITY CONTROL

The Quality Control Plan (QCP) is the Contractor’s internal plan to ensure delivery of quality products and services under the terms of this contract. The draft QCP shall be submitted with the Contractor’s proposal and the final QCP shall be delivered 30 days after contract award. If updates to the QCP are required, changes to the QCP shall be delivered by the 5th business day after the updates are identified.

12.0 QUALITY ASSURANCE

12.1 The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS. The Government will make every effort to ensure that the surveillance methods described at paragraphs 11.2-5 below are conducted in an objective, fair, and consistent manner.

12.2 Periodic Surveillance. This action occurs when the COR or other Government official observes a deficiency. Examples include evidence from accidents, incidents, or delays. Regardless of where in the line-of-duty the COR observes contractual procedures not being followed, he/she has an obligation to document and report the deficiency to the Contracting Officer.

12.3 Customer Complaint Surveillance. This action is instituted when the COR receives a complaint from a stakeholder (stakeholders include: All U.S. Uniformed Military Services) regarding contractor service. The COR will obtain the complaint in writing and then conduct an investigation to determine its validity. If the complaint is deemed valid, the COR will immediately notify the contracting Officer for action. The COR will notify both the Contract Manager and the complainant of the Government’s response to their complaint.

12.4 100 % Inspection. This action will be performed on all deliverables as stated in the PWS. Deliverables are reviewed and measured using the “Deliverable Evaluation Checklist” found in Technical Exhibit 1. The results of these reviews shall be discussed at the monthly Senior Management Review. The Acceptable Quality Levels for performance is shown in the table below:

Performance Requirement Performance Standard

Acceptable Quality Level

Deliverables (as stated in PWS, Section 6.0) including the SMRs and its associated documents

100% on time and complete

95% on time and complete

Work Product/Delivery Quality Review 5.00/5.00 3.50/5.00

SMR minutes 100% on time and complete

91% on time and complete

12.5 Contract Discrepancy Report (CDR) (Technical Exhibit 2). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR. The CDR will explain the circumstances and findings concerning the incomplete or unsatisfactory service.

12.6 The Government will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

13.0 TRANSITION

13.1 In order to ensure a smooth phase-in of contractor performance and to prevent possible decreases in service quality, the Contractor will have a sixty day phase-in period from the date of contract award prior to full performance of the contract (e.g., Contract Award Date / Phase-in Period / Full Contract Performance). A smooth transition between the incumbent contractor and the successor contractor is necessary to ensure there is no disruption to vital Government business. The contractor shall cooperate fully in the transition.

13.2 Phase-In

13.2.1 During the phase-in period, the government will make available a DMDC representative familiar with the committees, their current operations, workload status, and outstanding functions or orders pending completion.

13.2.2 The contractor shall submit a Transition Phase-In Plan within 30 days after award of the contract addressing the following, at a minimum:

• Plan to ensure a smooth transition to full contract performance;

• Plan as to how the contractor will properly vet contractor personnel in accordance with the security requirements laid out in the PWS;

• Proposed process for GFE/GFP/GFI acceptance;

• Identification of associated risks and issues; and

• Risk mitigation strategies to address any risk issues or anticipated problems.

13.3 Phase-Out

13.3.1 In the event that a follow-on contract is awarded to a new contractor, DMDC wants to ensure a smooth phase-in and phase-out of the contractors to prevent a possible decrease in productivity or service quality. The incumbent Contractor shall be provided a 30 calendar-day phase-out period prior to the designated contract completion date. During this period, the incumbent contractor shall make available to key incoming Contractor personnel, a representative who is versed in the operation and the functions to be performed. Inventories of DMDC supplied material shall be conducted jointly with the COR or designated representative, the incumbent Contractor and the incoming Contractor. Within thirty calendar days of the expiration or termination of this contract, the Contractor shall conduct an inventory, in conjunction with the COR and the successor Contractor; of all remaining product in the Contractor's inventory. The Contractor shall provide additional inventories as specified by the COR. Any discrepancies identified during these inventories shall be noted in writing to the COR for resolution. The Contractor shall prepare, certify, and submit a detailed final inventory report to the COR.

13.3.2 The contractor shall submit a Transition Phase-Out Plan no less than 30 days before the end of the contract addressing the following, at a minimum:

• Proposed sequence of transition tasks, which should be accomplished to progress from start of transition to successor contractor control of tasks, as specified in the PWS;

• Maintaining DMDC schedule, specifically transition of existing, on-going efforts and concurrently working with the successor contractor on existing efforts;

• Proposed transfer of GFE/GFP/GFI, based on inventories conducted in 13.3.1, to the successor contractor;

• Identification of associated risks and issues;

• Risk mitigation strategies to address any risk issues or anticipated problems;

• Additional resources, if any, required for the transition.

14.0 APPENDICES

The Government has provided appendices applicable to this effort:

Appendix A: International Standards Appendix B: Senior Management Review (SMR) Template

15.0 TECHNICAL EXHIBITS

The Government has provided technical exhibits applicable to this effort:

Technical Exhibit 1: Deliverable Evaluation Checklist Technical Exhibit 2: Contract Discrepancy Report (CDR) Template

Appendix A

International Standards

Magnetic Stripe For any plastic card buy, whether for the CAC or another program, a magnetic stripe may be required. If required, it will be:

• Three track magnetic stripe.

• Flush mounted on the back of the card in accordance with ISO7811.

• Standards compliance: ISO 7810:2003, ISO 7811-6:2008, and ISO 10373-

2:2006.

• The magnetic stripe shall be high gloss calendered high-coercivity type (nominal

4,000 oersteds).

• Protective coating: If the magnetic stripe is coated with polytetrafluoroethylene

(PTFE), or equivalent fluorocarbon inert high slip coating, the combined thickness of the PTFE coating and magnetic stripe shall not exceed 0.0015 inches and shall be in accordance with ISO 7811.

• The magnetic stripe shall have a minimum usable life of 25,000 swipes or head passes while performing its intended function. Preference shall be given to those proposals that show proof that they will exceed the stated minimum.

• The data signal level, as specified in ISO7811, must not be degraded by more than 10 percent by the repeated application (i.e., 20 times) of any magnetic field of less than 3000 oersteds at the surface of the magnetic stripe.

• Silk-screening or liquid coating is prohibited.

• Using a magnetic stripe with holographic-like images may be requested for security purposes.

• Durability: The magnetic stripe must be resistant to abrasion, wear, and delamination.

Physical Characteristics

• Standards compliance: ISO 7816, ISO 7810:2003, ISO 10373-1:2006 and ISO14443-1:2008 (for cards with contactless interfaces). Any manufacturing process required to meet the requirements in this specification will meet the ISO standards and result in a flat card.

• Card material: Card body shall be polyvinyl chloride (PVC) in the laminate construction as described below:

• Minimum requirement of card material is that it consist of a PVC core, with polyethylene terephthalate (PET) layers that comprise at least 40% of the overall card thickness placed between the outer PVC layers and the inner PVC core.

• Alternate cardstock material that is equivalent or superior to PVC with a 40% PET content as described above, may be considered, if the contractor’s proposal provides sufficient evidence and proof that it will perform equally or better for ink adhesion, lack of curling after lamination, and card longevity.

• Preference shall be given to cards with longer life capabilities as determined by testing in accordance with (IAW) ANSI NCITS 322-2008, Card Durability Test Methods.

• For cards with or without contactless interfaces, the card body must accept Dye Diffusion Thermal Transfer (D2T2) and resin thermal transfer imaging on front and back of card body. The card body shall also accept reverse transfer print imaging on front and back of card body. Card surface deformations shall not induce any print loss. Cards shall remain flat after printing, lamination and other personalization processes.

• Card thickness prior to lamination of 0.027 to 0.033 inches in accordance with

ISO 7810:2003.

• In addition to the ISO and other tests specified in the Cardstock Specification, cards will be subjected to the ANSI NCITS 322-2008, Card Durability Test Methods. While the NCITS 322-2008 test methods do not currently specify compliance requirements, the tests will be used to compare the performance of cards from different manufacturers. Thus, preference will be given to cards that demonstrate greater durability based on these test results. Examples of the NCITS 322-2008 tests include card flexure, static stress, plasticizer exposure, impact resistance, card structural integrity, surface abrasion, magnetic stripe abrasion, temperature and humidity induced dye migration, ultraviolet light exposure, and a laundry test. These tests will be performed on cards with and without contactless interfaces.

• Cards intended as PIV credentials must comply with the durability and quality requirements outlined in the most current version of the FIPS201 PIV Card Approval Procedures currently managed by GSA.

• Resistance to Chemicals: The card shall be resistant to chemical effects arising from use in a flight line environment. The reagents called out in ISO/IEC 10373- 1:2006 shall be modified to include gasoline (87 Octane), Jet A, Hydraulic fluid (ISO 46 or equivalent), and mineral spirits (ASTM D235 or equivalent).

Immersion time shall be 1 minute.

• Cleaning: Cards shall not malfunction or delaminate after hand cleaning with a mild soap and water. The reagents called out in ISO/IEC 10373-1:2006 shall be modified to include a 2% soap solution. A card shall be deemed acceptable if it meets these cleaning requirements.

• Ultraviolet light: The card shall be subjected to concentrated sunlight exposure and shall resist deterioration and cracking. Concentrated sunlight exposure will be performed IAW ASTM G90-10, and accelerated exposure IAW ASTM G155- 05a. The card shall be subjected to the ANSI NCITS 322-2008 tests for UV and daylight fading resistance. The irradiance set point shall be 0.72 W/m2 with a chamber temperature of 50 C. After exposure, the card shall be subjected to the ISO 10373-1:2006 dynamic bending test and shall have no visible cracks or failures. The card shall not malfunction after the dynamic bending evaluation.

• Lamination: The cardstock shall withstand the effects of high temperatures required by the application of a polyester laminate on one or both sides of the card by COTS equipment. The cardstock provided shall allow production of a flat card IAW ISO 7810:2003 after lamination of one or both sides of the card. The Government will specify single sided, dual-sided, or no lamination at time of order.

• The Government understands that application of heat during the printing and lamination processes may result in very small amounts of card shrinkage. The dimensions of blank cards provided to the Government shall be ISO compliant prior to printing personalization. Following personalization (printing and lamination), the card height shall remain no less than 85.27 mm and the card width shall remain no less than 53.92 mm while continuing to meet the other appropriate ISO requirements. Personalized cards shall continue to remain interoperable with COTS and Government provided card readers and equipment.

• Peel Strength: Due to the tamper-resistant features of some embedded Optically Variable Devices (OVDs) or similar security features, in the case of a manufacturer using an OVD rather than an OVI, the Government accepts that the minimum peel strength requirement in ISO 7810:2003 may not be met for the OVD patch in the layer of the cardstock that contains it. The minimum peel strength requirement will be addressed on a case-by-case basis. However, the remainder of the cardstock layer with the OVD and the remainder of the card body shall meet all requirements of ISO 7810:2003.

Printed Material

• DoD requires that the card manufacturer, card manufacturing lot number, and ICC serial number be laser engraved/etched in a manner that cannot be…