HC1028-14-R-0025_0001.doc

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION B - SUPPLIES OR SERVICES AND PRICES

CLIN 0001

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2014 through September 30, 2015.All invoices for production software will be paid monthly in arears. to Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2014 through November 30, 2015.All invoices for production software will be paid monthly in arears..

CLIN 0002

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2014 through September 30, 2015.Total SUPS shall not exceed 18,332,397. to Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2014 through November 30, 2015.Total SUPS shall not exceed 18,332,397..

CLIN 0003

The CLIN extended description has changed from Managed Services Metered SUPS exceeding 18,332,397.The period of performance is December 1, 2014 through September 30, 2015.The contractor is authorized to invoice monthly when SUPS are exceeded. to Managed Services Metered SUPS exceeding 18,332,397.The period of performance is December 1, 2014 through November 30, 2015.The contractor is authorized to invoice monthly when SUPS are exceeded..

CLIN 0005

The CLIN extended description has changed from Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is December 1, 2014 through September 30, 2015. to Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is December 1, 2014 through November 30, 2015..

CLIN 0006

The CLIN extended description has changed from Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is December 1, 2014 through September 30, 2015. to Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is December 1, 2014 through November 30, 2015..

CLIN 0007

The CLIN extended description has changed from Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is December 1, 2014 through September 30, 2015. to Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is December 1, 2014 through November 30, 2015..

CLIN 1001

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2015 through September 30, 2016.All invoices for production software will be paid monthly in arears. to Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2015 through November 30, 2016.All invoices for production software will be paid monthly in arears..

CLIN 1002

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2015 through September 30, 2016.Total SUPS shall not exceed 18,332,397. to Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2015 through November 30, 2016.Total SUPS shall not exceed 18,332,397..

CLIN 1003

The CLIN extended description has changed from Managed Services Metered SUPS exceeding 18,332,397.The period of performance is October 1, 2015 through September 30, 2016.The contractor is authorized to invoice monthly when SUPS are exceeded. to Managed Services Metered SUPS exceeding 18,332,397.The period of performance is December 1, 2015 through November 30, 2016.The contractor is authorized to invoice monthly when SUPS are exceeded..

CLIN 1005

The CLIN extended description has changed from Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is October 1, 2015 through September 30, 2016. to Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is December 1, 2015 through November 30, 2016..

CLIN 1006

The CLIN extended description has changed from Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is October 1, 2015 through September 30, 2016. to Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is December 1, 2015 through November 30, 2016..

CLIN 1007

The CLIN extended description has changed from Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is October 1, 2015 through September 30, 2016. to Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is December 1, 2015 through November 30, 2016..

CLIN 2001

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2016 through September 30, 2017.All invoices for production software will be paid monthly in arears. to Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2016 through November 30, 2017.All invoices for production software will be paid monthly in arears..

CLIN 2002

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2017 through September 30, 2017.Total SUPS shall not exceed 18,332,397. to Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2016 through November 30, 2017.Total SUPS shall not exceed 18,332,397..

CLIN 2003

The CLIN extended description has changed from Managed Services Metered SUPS exceeding 18,332,397.The period of performance is October 1, 2016 through September 30, 2017.The contractor is authorized to invoice monthly when SUPS are exceeded. to Managed Services Metered SUPS exceeding 18,332,397.The period of performance is December 1, 2016 through November 30, 2017.The contractor is authorized to invoice monthly when SUPS are exceeded..

CLIN 2005

The CLIN extended description has changed from Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is October 1, 2016 through September 30, 2017. to Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is December 1, 2016 through November 30, 2017..

CLIN 2006

The CLIN extended description has changed from Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is October 1, 2016 through September 30, 2017. to Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is December 1, 2016 through November 30, 2017..

CLIN 2007

The CLIN extended description has changed from Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is October 1, 2016 through September 30, 2017. to Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is December 1, 2016 through November 30, 2017..

CLIN 3001

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2017 through September 30, 2018.All invoices for production software will be paid monthly in arears. to Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2017 through November 30, 2018.All invoices for production software will be paid monthly in arears..

CLIN 3002

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2017 through September 30, 2018.Total SUPS shall not exceed 18,332,397. to Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2017 through November 30, 2018.Total SUPS shall not exceed 18,332,397..

CLIN 3003

The CLIN extended description has changed from Managed Services Metered SUPS exceeding 18,332,397.The period of performance is October 1, 2017 through September 30, 2018.The contractor is authorized to invoice monthly when SUPS are exceeded. to Managed Services Metered SUPS exceeding 18,332,397.The period of performance is December 1, 2017 through November 30, 2018.The contractor is authorized to invoice monthly when SUPS are exceeded..

CLIN 3005

The CLIN extended description has changed from Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is October 1, 2017 through September 30, 2018. to Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is December 1, 2017 through November 30, 2018..

CLIN 3006

The CLIN extended description has changed from Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is October 1, 2017 through September 30, 2018. to Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is December 1, 2017 through November 30, 2018..

CLIN 3007

The CLIN extended description has changed from Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is October 1, 2017 through September 30, 2018. to Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is December 1, 2017 through November 30, 2018..

CLIN 4001

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2018 through September 30, 2019.All invoices for production software will be paid monthly in arears. to Provide Unisys Operating System 2200 Environment Capacity Service - Production Software in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2018 through November 30, 2019.All invoices for production software will be paid monthly in arears..

CLIN 4002

The CLIN extended description has changed from Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is Octoberr 1, 2018 through September 30, 2019.Total SUPS shall not exceed 18,332,397. to Provide Unisys Operating System 2200 Environment Capacity Service - Managed Services Metered SUPS in accordance with the Performance Work Statement dated June 18, 2014. The period of performance is December 1, 2018 through November 30, 2019.Total SUPS shall not exceed 18,332,397..

CLIN 4003

The CLIN extended description has changed from Managed Services Metered SUPS exceeding 18,332,397.The period of performance is October 1, 2018 through September 30, 2019.The contractor is authorized to invoice monthly when SUPS are exceeded. to Managed Services Metered SUPS exceeding 18,332,397.The period of performance is December 1, 2019 through November 30, 2019.The contractor is authorized to invoice monthly when SUPS are exceeded..

CLIN 4005

The CLIN extended description has changed from Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is October 1, 2018 through September 30, 2019. to Travel in accordance with the Performance work Statement dated June 18, 2014. Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with JTR and FAR Part 31.205-46. All travel invoices shall be provided to the Government for review/certification prior to submission for payment. The period of performance is December 1, 2018 through November 30, 2019..

CLIN 4006

The CLIN extended description has changed from Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is October 1, 2018 through September 30, 2019. to Relocation Services in accordance with the Performance Work Statement 6.1.1.9, dated June 18, 2014. The contractor shall propose a fixed price per move. The period of performance is December 1, 2018 through November 30, 2019..

CLIN 4007

The CLIN extended description has changed from Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is October 1, 2018 through September 30, 2019. to Emerging Requirements in accordance with the Performance Work Statement 6.1.1.10, dated June 18, 2014. The period of performance is December 1, 2019 through November 30, 2019..

The following have been modified:

SECTION B

B.1 Contract Minimum and Maximum Value

a. This is an Indefinite-Delivery/Indefinite Quantity (ID/IQ) contract with Firm Fixed Price type delivery orders issued in accordance with Federal Acquisition Regulation Subpart 16.5 – Indefinite Delivery Contracts.

b. Maximum Contract Value: The total amount for all orders placed against the contract resulting from this solicitation shall not exceed $193.3 million over a 60 month period of performance with delivery orders to be completed on a 12 month basis.

c. The government anticipates a single contract award resulting from this sole source solicitation.

B.2 Pricing

The offeror shall propose pricing for all contract years for their technical solution in response to the Technical Requirements. All delivery orders awarded pursuant to this contract will be awarded on a Firm Fixed Price basis and will use the pricing set forth in the pricing schedule.

Pricing Notes:

1. The contractor shall provide a detailed list of all the production software being provided under CLIN X001 “Production Software”.

2. The contractor shall provide a detailed breakout of the relocation services under CLIN X006 “Relocation Services”.

3. The cost per move shall not increase throughout the year under CLIN X006 “Relocation Services”.

4. The contractor shall invoice upon delivery and acceptance of implementation/installation on CLIN 0004 “Implementation/Installation Services”.

5. The contractor shall provide a detailed breakout of CLIN 0004 “Implementation/Installation Services”.

6. The contractor shall provide a detailed breakout of on all SUPS to include associated labor hours, labor categories, and labor rates.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

UNISYS OS 2200 CAPACITY SERVICES

as of July 15, 2014

1. Contracting Officer Representative (COR).

a. Primary COR.

Department of Defense Activity

Address Code (DODAAC):

H98272

b. Alternate COR.

2. Contract. Unisys OS 2200 Capacity Services

3. Background. The Defense Information System Agency (DISA) Enterprise Services Directorate (ESD) is a provider of information technology solutions for the Department of Defense (DoD). DISA ESD must continue to have the ability to provide Unisys OS 2200 Capacity Services to the current mission partner base, in excess of 92,000 users’ worldwide, utilizing Unisys OS 2200 applications that provide critical support to the war fighter. DISA operates Unisys OS 2200 Enterprise Server series computers and related disk storage systems to provide operations, technical and application support to mission partners on a 24-hour per day, 7-day a week basis.

4. Objectives: The objectives of this contract is to obtain a reliable, responsive, and cost-effective capacity services for DISA ESD Unisys OS 2200 environments at DISA and/or DISA-approved processing locations. The objective of these capacity services is to provide flexibility and services capable to meet current and future Unisys OS 2200 workload, security, availability, scalability, and modernization requirements, while ensuring DISA mission partners receive uninterrupted, continuous access to their applications and data. DISA’s goal is to provide the necessary Unisys OS 2200 processing capacity that is dynamically scalable, utilizing an on-demand service approach that will readily adjust to changes in processing and throughput requirements, both increases and decreases, and is priced on a utility (“as used”) basis. These capacity services will:

4.1 Be responsive to mission partner requirements by providing agile, flexible, and scalable Unisys OS 2200 environments.

4.2 Require minimal time to add Unisys OS 2200 capacity.

4.3. Streamline management of the Unisys OS 2200 environments.

4.4 Provide technical upgrades and state-of-the-art hardware and software for the Unisys OS 2200 environments.

4.5 Establish long term, consistent pricing models for the Unisys OS 2200 environments.

4.6 The contractor will acquire, install, de-install, transport, configure, maintain all hardware, and provide software and software updates for all products associated with this contract. In addition, the Contractor will be responsible for data replication services, replacement, disposal and/or transfer costs. All repairs performed by the contractor will utilize OEM new or OEM Certified: “Like New” repair parts purchased from the OEM or authorized OEM reseller. The government will maintain operational control and complete oversight responsibility.

4.7 In addition to the stated objectives, the intent is to create a DISA/contractor “partnership”. Within the context of the DISA/contractor relationship, we do not use “partnership” as a legal term. The partnership will reflect the attributes of an open, collaborative, and customer-oriented professional relationship. DISA will not turn the processing environment over to the contractor.

5. Scope. The scope of this Unisys OS 2200 Capacity Services contract will encompass:

5.1 All Unisys OS 2200 environments will be located in a DISA facility and/or DISA-approved processing location as well as any DISA or DISA-approved locations worldwide in which DISA ESD may acquire operational responsibility. The supported environment will consist of all Unisys OS 2200 software, 3rd party software, and all hardware (processing, storage, and internal communications) required to run, monitor, and manage the OS 2200 environment. 5.2 All storage (physical and/or virtual) capacities supporting the Unisys OS 2200 environment and applications running in the Unisys OS 2200 environment.

5.3 All DISA-designated peripheral open system server environments that provide direct/integrated management, monitoring, or control of Unisys OS 2200 environments, and applications running in the Unisys OS 2200 environment.

5.4 All data replication capacity for processor, disk, and storage (virtual and/or physical) for the Unisys OS 2200 systems located in DECC St Louis.

5.5 Unclassified and Classified Environments. Where required under this contract, Unisys will provide engineering and maintenance support personnel with the appropriate clearance for DISA’s classified and unclassified environments Unisys will deploy separate equipment for classified and unclassified environments and will provide all assets needed for the Unisys OS 2200 infrastructure regardless of environment (classified or unclassified).

6. Performance Requirements.

6.1 Task 1 - Provide Unisys OS 2200 Capacity Services

6.1.1 Subtask 1: Production/Development/Test Capacity

The contractor shall provide the necessary processing capacity to support Unisys OS 2200 production, development and test environments. The Unisys OS 2200 processing capacity shall adhere to the following requirements:

6.1.1.1. Is highly available and readily adjusts to increases and decreases in required production capacity for processor, internal communications, and related storage.

6.1.1.2. Is priced on a utility ("as used") basis.

6.1.1.3. Integrates OS environment management and oversight solutions with DISA’s chosen enterprise systems management (ESM) architecture. The contractor will not be responsible for providing this architecture or software.

6.1.1.4. Must include advancements in technologies allowing the processing capacity to interoperate in a storage area network (SAN) environment with speeds not less than 4 Gb/s with 10 Gb/s preferred.

6.1.1.5. Must include the necessary internal communications components to enable communication over new network technologies, with no less than100 Mb/s Ethernet with Gigabit Ethernet preferred.

6.1.1.6. Provides capacity to support DISA quality assurance, integration, and security testing.

6.1.1.7. Provides 24x7x365 problem escalation/resolution support processes.

6.1.1.8. Provide technical upgrades and state-of-the-art hardware and software for the Unisys OS 2200 environments. The contractor will work with DISA to establish an implementation plan for tech refreshing all current hardware with the new equipment within 180 days of award.

6.1.1.9. Provide processing capacity that is moveable. If the location of the processing capability requires the movement of equipment, the first move of each piece of equipment shall be at no cost to Government. Movement is defined as the transfer of equipment within the same DISA site or from one DISA site to another DISA site within CONUS and OCONUS. There will be a “Relocation Services” CLIN to support this requirement. Once the free move has been used for specific hardware, subsequent moves are cost reimbursable. Contractor must provide an invoice with attached receipts and shipping documentation showing actual shipping costs for reimbursement.

6.1.1.10. Provide optionally priced “Specialty Engines” for all open operating environments. Specialty engines are processors that can help expand the use of the mainframe for new workloads, while helping to lower cost of ownership.

6.1.2. Subtask 2 - Assured Computing Reserve Capacity

The contractor shall provide the necessary reserve Unisys OS 2200 processing capacity to support the DISA Assured Computing Environment (ACE). The Unisys OS 2200 reserve capacity shall adhere to the following requirements:

6.1.2.1. Required data failover capacity for processor and related storage for the systems currently located in DECC St Louis and DECC Oklahoma City.

6.1.2.2. Immediate resumption of storage and processor capabilities at the primary site after fail-over to the alternate location is complete.

6.1.2.3. Provide capabilities to the current replication environment to include, but not limited to, bringing up replicated systems without interruption to replication or processing, replication of the virtual environment, and flexibility in the Direct Access Storage Device (DASD) configuration requirements.

6.1.2.4. Capability to test the data replication solution without interruption to the production partitions for a total of 288 (12 x 24) hours for each logical partition. As a method to track the number of hours used for testing each partition, DISA will report to Unisys, monthly or at specified points of time, the amount of hours the failover equipment actively runs an operating system.

6.1.2.5. Provides 24x7x365 problem escalation/resolution support processes.

6.1.2.6. Contractor shall provide an option and associated costs to perform test and development processing on the failover capacity versus providing dedicated Test & Development (T&D) capacity. The contractor will demonstrate the price differences between dedicated Continuity of Operations (COOP) capacities and capacities shared with a T&D.

6.1.2.7. The contractor shall demonstrate a clear understanding of the requirement to maintain multiple processing configurations to support contingency processing in the event of a failure at the primary production site utilizing the shared T&D/COOP environment/capabilities.

6.1.2.8. The contractor shall provide at least one dedicated COOP partition capable of activating any of the failed-over production environments.

6.2. Task 2. Provide Disk Storage Capacity

6.2.1. Subtask 1 – Production/Development/Test Capacity

The contractor shall provide the necessary disk storage capacity to support the Unisys OS 2200 environment. The disk storage capacity shall adhere to the following requirements:

6.2.1.1. Is highly available and readily adjusts to increases and decreases in required production capacity.

6.2.1.2. Must include advancements to allow the processing capacity to interoperate in a storage area network (SAN) environment.

6.2.1.3. Must include the capability to migrate to high-density storage capabilities via the use of virtualization technologies. The storage device behind a VTL should be at least LTO 4.0 (for encryption purposes – FIPS 140-2 certified) and devices physically attached to the host machines should be at a minimum 200 GB storage capacity.

6.2.1.4. The solution must be at least 4 GB capable from host to disk controller.

6.2.1.5. Installations or changes must have limited impact on the production environments and be ap-proved by the government.

6.2.1.6. Provides support for DISA’s quality assurance, integration, and security testing.

6.2.1.7. All configuration changes shall be completed within 72 hours of acceptance by the contractor.

6.2.1.8. Provides 24x7x365 problem escalation/resolution support processes.

6.2.2. Subtask 2 - Assured Computing Reserve Capacity

The contractor shall provide the necessary disk storage capacity to support the DISA Assured Computing environment. The reserve disk storage capacity shall adhere to the following requirements:

6.2.2.1. Must have sufficient capacity to process the primary site’s replicated production workloads at the alternate site if a failover occurs.

6.2.2.2. Immediate resumption of storage and processor capabilities at the primary site after failover to the alternate location is complete.

6.2.2.3. Must be able to replicate production data across long distances without interruption to the production workloads.

6.2.2.4. Must be able to concurrently support point in time replications and asynchronous replications.

6.2.2.5. DISA must be able to test the data replication solution on each logical Unisys OS 2200 partition for a total of 288 (12 x 24) hours per calendar year without interruption to the production partitions.

6.2.2.6. Updated data at the failover sites needs to be re-integrated to the primary site to compile an up-to-date set of data should DISA opt to do so.

6.2.2.7. The ability to bring up failover systems without interruption to replication.

6.2.2.8. The ability to replicate the Virtual Library. The data must be able to be spooled off to real tape.

6.2.2.9. Provide flexibility in the DASD configuration requirements.

6.2.2.10. Replication should be considered an array level function, and should not be tied to a level of the operating system.

6.3. Task 3 - Provide Direct Support Open System Server Environments.

The contractor shall provide the Open System Server Environment to support the Unisys OS 2200 environment. The Open System Server environment shall adhere to the following requirements:

6.3.1 The contractor shall provide all DISA designated peripheral open system server environments that provide direct/integrated management, monitoring, or control of Unisys OS 2200 environments, and applications running in the Unisys OS 2200 environment. The open system servers are typically Intel based and utilize either the Microsoft Windows operating system or the Linux operating system.

All products will be hosted on an Intel-based architecture separate from other products unless DISA agrees in writing that certain products can be co-hosted. Contractors are responsible for hosting their own product as part of the cost of that product.

6.3.2 The open system server environment will include appliance- style components that provide security Federal information Processing Standard (FIPS) 140-2 certified encryption and compression capabilities for the web-based applications in the Unisys OS 2200 environment.

6.3.3 HBA interfaces should be at least 4 gbs; preferably 10 gbs.

6.3.4 All devices must have at least three customer useable Network Interface Cards.

6.3.5 The contractor will refresh the non-Unisys OS based environments at some specified point (24 – 36 months) to be determined by the government.

6.4. Task 4 - Additional Domains

The Contractor shall make provisions to allow the government to request additional domains and to determine if these additional domains will require data replication. The contractor shall also provide separate price guidelines for systems with and without replication support.

6.5. Task 5 - Training

The contractor shall provide, at no additional cost to the government the necessary training to ensure government personnel are adequately trained in the operation and administration of the components of Unisys OS 2200 environment. The training will be recurring training as new hardware and software components are introduced to the Unisys OS 2200 environment.

6.6. Task 6 - Technical Support

The contractor shall provide a technical support structure capable of supporting all hardware and software components of the Unisys OS 2200 environment. The following subtasks detail the specific areas to be addressed by the contractor.

6.6.1 Subtask 6.1 - Unisys OS 2200 Capacity Services Help Desk Support

Provide a help desk interface (toll free number) for government personnel to report all hardware problems encountered in the Unisys OS 2200 environment. This help desk operation must be available and staffed to receive trouble calls 24 hours per day, 7 days per week. Level-1 severity problems require contractor response within one hour.

6.6.2 Subtask 6.2 - Unisys and 3rd Party Software Support

Provide technical support of all Unisys OS 2200 and 3rd party software products required to support the Unisys OS 2200 environment. This includes:

6.6.2.1 Installation and configuration of all Unisys OS 2200 and 3rd party products into the supported DISA software baselines as new versions become available.

6.6.2.2 Develop, maintain, and integrate all DISA unique code, which the contractor owns, into the off-the-shelf Unisys OS 2200 and 3rd party software products.

6.6.2.3 Develop, maintain, and integrate all DISA unique software utilities into the supported DISA baselines.

6.6.2.4 Perform unit and system level testing on all Unisys OS 2200 and 3rd party software prior to release to DISA.

6.6.2.5 Provide consultation and problem analysis support to the DISA SSO activity.

6.6.2.6 Provide 24 x 7 on-call Level 4 support for all problems reported with Unisys OS 2200 and 3rd party software products. Note: Levels 1 – 4 software support is defined in the QASP (“Note2 – Software Support Services”).

6.7 Task 7. Metering and Billing

The contractor will create the usage portion of the invoice directly from the data provided by DISA.

6.8. Task 8. Maintenance Requirements

Contractor is responsible to support and comply with all requirements of the Form 7 processes as reflected in the ESD Policy Letter of Instruction CSD 06-17 (amended) May 10, 2006. All repairs will utilize OEM new or OEM like new certified parts purchased from the OEM or authorized OEM reseller.

6.9. Task 9. Assumption of DISA Unisys Operating Systems Sustainment Responsibilities.

The contractor shall provide an optional plan for the assumption of the roles currently performed by the DISA Operating Systems Sustainment Section in support of the Unisys processing environment. The plan shall include staffing models, a Concept of Operations (CONOPs) and cost data.

6.10 Task 10 – Supply Chain Risk Management (SCRM) Plan. See Section H, clause 52.239-9002, for SCRM requirements and deliverables.

6.10.1 Subtask 6.1 - Subcontractors: The Contractor shall provide a definitive list of all known or proposed subcontractors and suppliers as part of their proposal for review and approval by the Government. The Government reserves the right to approve or disapprove the use of prospective subcontractors or suppliers. The Contractor shall notify the Government within five (5) business days whenever there is a change in subcontractors and/or suppliers at any point. The Contractor shall take steps to ensure that products purchased or obtained shall not be identified as being destined for inclusion in a Government system.

6.10.2 Subtask 6.2 - Authorized Resellers: The Contractor shall ensure all purchases are made through authorized resellers, or provide justification why authorized resellers are not able to be used. The Government reserves the right to disapprove the use of prospective subcontractors or suppliers. Requests shall include the following information:

The actual manufacturer or producer of the IT hardware or software to be leased or purchased;

The item’s national stock number (if there is one);

The item identification number used by –

(1) The actual manufacturer or producer of the item (e.g., model number); OR

(2) The full item description.

Justification for use of non- authorized resellers.

6.10.3 Subtask 6.3 - Contractor-Manufacturer Relationship: To assist the Government in assessing the security and risks associated with supply chain management, the contractor must supply the following information monthly, or with submission of quote for supplies:

· The contractor must indicate the relationship between the contractor and the manufacturer as one of the following:

· The contractor is the manufacturer (OEM)

· The contractor is an authorized reseller (i.e. the manufacturer has a direct relationship with the contractor and is officially identified as a reseller for that manufacturer) for all items produced by that manufacturer

· The contractor is an authorized reseller (i.e. the manufacturer has a direct relationship with the contractor and is officially identified as a reseller for that manufacturer) for a subset of items produced by that manufacturer. The product lines the contractor is an authorized reseller for must be identified

· The contractor obtains the manufacturer’s items through either an authorized partner or distributor. The authorized partner/distributor must be identified

· The contractor obtains the items through an unknown/unidentified source

· When the contractor states that they are an authorized reseller for a manufacturer, they must provide a point of contact (POC) at that manufacturer who will verify that statement

6.10.4 Subtask 4 - Critical Technologies (CT): The Contractor shall conduct a crosswalk of their system specifications with their critical program information (CPI) and other DoD tools in conjunction with the Government at initial planning and throughout the acquisition life cycle. The crosswalk may or may not trigger parameters which cause a technology to be designated as CPI (Critical Program Information) or Critical Technologies (CT). Should the assessment result in identification of CPI and/or CT then the Contractor will be required to assess methods of protection and, in conjunction with the Government, develop and implement an Anti Tamper (AT) Plan. If an AT is required, it will be added as an annex to the Program Protection Implementation Plan (PPIP).

6.10.5 Subtask 5 - Critical Program Information (CPI) Protection: The contractor shall do all of the following:

· Perform a criticality analysis (CA) to identify critical functions and components (hardware, software, and firmware) in accordance with both DoDI 5200.44 “Protection of Mission critical Functions to Achieve Trusted Systems and Networks (TSN)”. Criticality levels that support the CA are defined in the document “Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, “program Protection Plan Outline and Guidance,” July 18, 2011.

· Identify and disclose the detailed supply chain for all critical hardware, software components and material included in products that could potentially reduce the trustworthiness of contractor’s product’s or service’s design, configuration, provisioning, manufacture, maintenance or deployment.

· Provide the following information for critical components:

· A list of your key suppliers

· Proof of company ownership and location (on-shore or off-shore) for key suppliers

Proof of ownership and location of component manufacturers

6.10.6 Subtask 6 - Program Protection Implementation Plan (PPIP) Requirements: The Contractor shall develop, utilize, and maintain the Program PPIP based on the Government provided PPP requirements. The PPIP shall include demonstration of visibility into supply chain and Software Assurance for critical components. The information used to create this CDRL PPIP shall be available to the Government and discussed at IPT meetings as well as design reviews. The PPIP must address integration of all security disciplines, the PPP, System Security Engineering (SSE), counterintelligence, and OPSEC, and provide for no cost inspections and program protection surveys of the Contractor’s acquisition program protection. The PPIP must explain how acquisition program protection ensures coordination of systems, data, and products during the acquisition process with SSE efforts to build life-cycle security features into acquisition systems and products covered by this contract. The Contractor shall support the attainment of the objective of ensuring all personnel meet contract clearance and access requirements by defining how they will integrate security into their overall systems engineering process.

6.10.7 Subtask 7 - Program Protection Working Group (PPWG): The Contractor shall host a PPWG within three months after contract award and on an annual basis throughout period of performance of the contract. Each PPWG will be chaired by the Government security manager and co-chaired by the Contractor security manager. The co-chair shall develop the agenda. The agenda shall include critical functional analysis (CFA), and Supply Chain Risk Management (SCRM). It is expected that each of the PPWGs will be a one day event.

6.10.8 Subtask 8 - Anti-Tamper (AT) Plan: If Anti-Tamper is identified as a solution for hardware and software containing CT, the Contractor shall design, develop and integrate an AT solution to deter/prevent/detect the reverse engineering of those systems using the probability of an unplanned loss or for international sales across the program's life cycle. The Contractor shall take the AT solutions through verification and testing to include any prototypes. The Contractor shall utilize reverse engineering countermeasures that are commensurate with the exposure levels and consequence of critical program information loss using the analysis process identified within the DoD AT Guidelines.

6.10.9 Subtask 9 - AT Program: The Contractor shall develop and implement an AT Program to protect CT. The Contractor shall develop, utilize, and maintain an AT Plan Annex to address protection of CT from reverse engineering in the case of unplanned loss or international sale. The Contractor shall develop an AT Plan Annex to the PPIP for documenting countermeasure designs. The Contractor shall consider AT in system engineering activities across the program’s life cycle to include science and technology efforts, research, design, development, implementation, testing, maintenance, upgrade and disposal of the system.

6.10.10 Subtask 10 - Security Plan (Supply Chain Risk Management Security Controls): The contractor shall submit for Government approval as part of their overarching security plan, describe their strategy for implementation of Supply Chain Risk Management (SCRM) Security requirements throughout the life of the contract. The security plan shall address the security controls (at a minimum SA-12) described in National Institute of Standards & Technology (NIST) Special Publication 800-53, Revision 4 (current version), Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.mist.gov/publications/PubsSPs.html), and should be tailored in scope and depth appropriate to the effort and the specific unclassified DOD information.

6.10.11 Subtask 11 - Law Enforcement/Counterintelligence: In the event of a known or potential intrusion, the contractor shall consent to responding counterintelligence or law enforcement investigative agency requests to apply forensic analysis tools to contractor information systems affected by the intrusion, including monitoring tools, imaging tools, and any other techniques that the agency seeks to apply to effectively analyze the intrusion. The contractor shall allow the responding counterintelligence and/or law enforcement investigative agency to image affected systems, including systems containing proprietary information. Nothing in this contract shall limit the ability to conduct law enforcement or counterintelligence activities, or other activities in the interest of the Government.

6.10.12 Subtask 12 - Information Sharing: The Government may use and disclose reported information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) that does not include attribution information at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

6.10.13 Subtask 13 – Malicious Code Warranty: The contractor represents and warrants that the software shall be free from all computer viruses, worms, time-outs, time bombs, back doors, disabling devices and other harmful or malicious code intended to or which may damage, disrupt, inconvenience or permit access to the software user's or another's software, hardware, networks, data or information.

6.10.14 Subtask 14 – Source Code Configuration Control (Versioning): The contractor shall utilize a strict version control process for software development and provide two copies of source code for all software versions developed under this contract. The source code will be provided on optical removable media (burned for read only) or another mutually agreed type of media.

6.10.15 Subtask 15 – Source Code Analysis: To minimize both SCRM and IA related threats, the contractor shall use appropriate automated vulnerability analysis tools capable of analyzing the computer software code during the entire lifecycle of a covered system; including during development (source code analysis), operational testing (run-time analysis/vulnerability testing), and ongoing operations and sustainment phase (vulnerability testing). The actions will be used to identify and prioritize security vulnerabilities and, based on risk, determine appropriate remediation strategies for identified vulnerabilities.

6.10.16 Subtask 16 – Non-Secure Software: If the Government determines, after a security audit (e.g. ST&E), that software delivered under this task order is non-secure, the Government will provide written notice to the contractor of each non-conformity. Software shall be "non-secure" under this task order if it contains a programming error listed on the current approved version of the CWE/SANS TOP 25 (which can be located at http://www.sans.org/top25-programming-errors) or a web application security flaw listed on the current approved version of the OWASP Top Ten (which can be located at http: //www.owasp.org/index.php/Category: OWASP Top_Ten_Project). The contractor shall have thirty (30) days after receipt of such notice (Remedy Period) to remedy each non-conformity by modifying/replacing and redelivering the software to the Government; or shall notify the Government within 15 days as to why the remedy cannot be implemented in 30 days, and propose a timeline for correction. If the Government determines, after a security audit following a Remedy Period, that the redelivered software is non-secure, and thus non-conforming, the Government may reject the delivery, provide notice of the non-conformance, and document the contractor's performance record. Alternatively, the Government may accept non-conforming software, receive appropriate consideration (equitable price reduction on a fixed price contract, reimbursement for costs of security audit, reimbursement for costs to correct the non-compliances, etc.), and document the contractor's performance record

6.10.17 Subtask 17 – Periodic Government Inspections: The contractor shall authorize Government inspections and reviews to assure compliance with both DISA and DoD Supply Chain Risk Management (SCRM) requirements throughout the contract performance period. The contractor shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

Supply Chain Risk and Basic Protections Development:…