HC102817R0047_AMD03.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

a. This amendment revises the PWS, CLIN descriptions and Pricing template to correlate w ith the answ ers provided in Attachment J-3 and J-4.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 65

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 30-May-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HC102817R0047

X 9B. DATED (SEE ITEM 11)

11-Apr-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

30-May-2017

CODE

DISA/DITCO-SCOTT-PL83

2300 EAST DRIVE

SCOTT AFB IL 62225-5406

HC1028 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HC102817R0047

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION B - SUPPLIES OR SERVICES AND PRICES

CLIN 0002

The CLIN extended description has changed from:

Non-Personal, Cost Plus Fixed Fee (CPFF). The Contractor shall provide services to support labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, and 6.12. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

(Estimated July 31, 2017 - July 30, 2018).

To:

Non-Personal, Cost Plus Fixed Fee (CPFF). The Contractor shall provide services to support labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, 6.12.1 and 6.12.2. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

CLIN 0010

The contract type has changed from FFP to CPFF.

The CLIN description has changed from Reserved to Optional Labor (Task 6.12.3).

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks 6.12.3. The contractor is authorized to invoice monthly for actual cost incurred.

All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0010 1 Lot OPTION Optional Labor (Task 6.12.3)

CPFF

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks 6.12.3.

The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.

The contractor is also reminded of the reporting requirement under FAR 52.232- 20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit.

Period of Performance: To be determined at award. (Estimated July 31, 2017 - July 30, 2018).

FOB: Destination

ESTIMATED COST

FIXED FEE

TOTAL EST COST + FEE

CLIN 1002

Non-Personal, Cost Plus Fixed Fee (CPFF). The Contractor shall provide services to support labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, and 6.12. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost

(Estimated July 31, 2018 - July 30, 2019).

labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, 6.12.1 and 6.12.2. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

CLIN 1009

The contract type has changed from CPFF to FFP.

1009 1 Lot OPTION Optional Labor (Task 6.17)

FFP

OPTIONAL Non-Personal, FFP. The Contractor shall provide services to support labor IAW the PWS tasks 6.17.

Contractor shall invoice IAW the payment schedule.

Period of Performance: To be determined at award. (Estimated July 31, 2018 - July 30, 2019).

NET AMT

CLIN 1010

the PWS tasks 6.12.3. The contractor is authorized to invoice monthly for actual cost incurred.

All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

(Estimated July 31, 2018 - July 30, 2019).

1010 1 Lot OPTION Optional Labor (Task 6.12.3)

CPFF

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks 6.12.3.

The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.

The contractor is also reminded of the reporting requirement under FAR 52.232- 20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit.

Period of Performance: To be determined at award. (Estimated July 31, 2018 - July 30, 2019).

CLIN 2002

Non-Personal, Cost Plus Fixed Fee (CPFF). The Contractor shall provide services to support labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, and 6.12. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under

(Estimated July 31, 2019 - July 30, 2020).

labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, 6.12.1 and 6.12.2. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

CLIN 2010

the PWS tasks 6.12.3. The contractor is authorized to invoice monthly for actual cost incurred.

All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost

(Estimated July 31, 2019 - July 30, 2020).

2010 1 Lot OPTION Optional Labor (Task 6.12.3)

CPFF

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks 6.12.3.

The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.

The contractor is also reminded of the reporting requirement under FAR 52.232- 20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit.

Period of Performance: To be determined at award. (Estimated July 31, 2019 - July 30, 2020).

CLIN 3002

Non-Personal, Cost Plus Fixed Fee (CPFF). The Contractor shall provide services to support labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, and 6.12. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under

(Estimated July 31, 2020 - July 30, 2021).

labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, 6.12.1 and 6.12.2. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

CLIN 3010

the PWS tasks 6.12.3. The contractor is authorized to invoice monthly for actual cost incurred.

All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and

(Estimated July 31, 2020 - July 30, 2021).

3010 1 Lot OPTION Optional Labor (Task 6.12.3)

CPFF

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks 6.12.3.

The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.

The contractor is also reminded of the reporting requirement under FAR 52.232- 20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit.

Period of Performance: To be determined at award. (Estimated July 31, 2020 - July 30, 2021).

CLIN 4002

Non-Personal, Cost Plus Fixed Fee (CPFF). The Contractor shall provide services to support labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, and 6.12. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and

FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost

(Estimated July 31, 2021 - July 30, 2022).

labor in accordance with (IAW) the Performance Work Statement (PWS) tasks 6.2, 6.3, 6.5, 6.8, 6.9, 6.10, 6.12.1 and 6.12.2. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award.

CLIN 4010

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks

6.12.3. The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.The contractor is also reminded of the reporting requirement under FAR 52.232-20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit. Period of Performance: To be determined at award. (Estimated July 31, 2021 - July 30, 2022).

4010 1 Lot OPTION Optional Labor (Task 6.12.3)

CPFF

OPTIONAL Non-Personal, CPFF. The Contractor shall provide services to support labor IAW the PWS tasks 6.12.3.

The contractor is authorized to invoice monthly for actual cost incurred. All invoices shall be provided to the Contracting Officer's Representative (COR) for review/certification prior to submission for payment. Fixed fee shall be billed and paid in accordance with FAR 52.216-8(b). In addition, a monthly payment schedule for fixed fee is established at (TBD AT AWARD). Notwithstanding the terms of FAR 52.216-8(b), upon submission of a certified final indirect cost rate proposal covering the year of physical completion of this contract, the contractor may bill for 75% ($TBD) of the withholding. The balance of the withholding ($TBD) may be billed upon settlement of the final indirect rates and submission of a final invoice.

The contractor is also reminded of the reporting requirement under FAR 52.232- 20(b) and (c), which requires notification to the KO when task order cost approaches the prescribed limit.

Period of Performance: To be determined at award. (Estimated July 31, 2021 - July 30, 2022).

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been added by full text:

PWS AMD02

PERFORMANCE WORK STATEMENT (PWS)

as of May 30, 2017

Contract Number: To be determined Task Order (TO) Number: To be determined Tracking Number: HC1028-17-R-0047 Follow-on to Previous Contract and TO Number:

HC1028-15-F-0282

1 Contracting Officer’s Representative (COR)

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Organization:

c. Alternate COR

Organization:

2 Contract or TO Title

Department of Defense (DoD) Public Key Infrastructure (PKI) and Common Service Provider (CSP) Engineering and Technical Support

3 Background The Net Centric Assurance capabilities includes the Department of Defense (DoD) PKI as the mechanism for providing Public Key (PK) certificates that support mission critical DoD applications. PKI satisfies the DoD’s Information Assurance (IA) requirement for confidentiality and authentication of network transactions, identification and verification of data integrity, and non-repudiation of communications or transactions. Since 1998, the PKI program has evolved into an operational program consolidated under a single Program Management Office (PMO), which oversees the DoD-wide effort to identify and PK enable applications to take advantage of the PKI security services by providing guidance and a capability for interoperability testing.

As PKI capabilities have expanded and become more ubiquitous, requirements for its security benefits and systems enhancements have increased in order to better meet the reliability and availability requirements of the DoD community. As a result, there is now an increased demand for high assurance operation of the DoD PKI systems, requiring the infrastructure to be modernized and secured against evolving threats.

4 Objectives To specify the system engineering and technical support necessary to strengthen the security postures and technical capability for the DoD PKI.

5 Scope The scope of this TO requires support in the form of subject matter experts responsible for reviewing system engineering documentation and developing software to support PKI. This TO will be executed in accordance with the current DoD X.509 Certificate Policy and the appropriate DoD approved architectures, program standards and guidelines such as Defense Information Infrastructure (DII), Defense Information Systems Network (DISN), and Global Information Grid (GIG). The scope of this effort includes the following areas:

Task Area 1 - Task Management and Support Task Area 2 - Combination of Token Management System (TMS) and Common Service

Provider (CSP) Task Area 3 - Develop issuance interface for SIPR REL DMZ delegated identity Task Area 4 - Dogtag Certificate System development Task Area 5 - Dogtag Certificate System New Development activities Task Area 6 - Support Security enhancements Task Area 7 - Review and patch the Red Hat Certificate System source code for defects Task Area 8 - Notification of issuance events to users Task Area 9 - Research and Deploy an Alternate Certificate Management products Task Area 10 - Mobile Device Derived Credential Issuance Support Task Area 11 - Procure Hardware and Software Task Area 12 - CSP design and implementation Task Area 13 - Development Lab Support Task Area 14 - Web Based Bulk Revoker (WBBR) Reengineering (Optional) Task Area 15 - PKE Engineering Support (Optional) Task Area 16 - PKE Engineering Policy and Guidance Development and Review – Technical and

Strategic (Optional) Task Area 17 - Transition Task (Optional) Task Area 18 - Supply Chain Risk Management (SCRM)

6 Performance Requirements

6.1 Task Management and Support (FFP)

6.1.1 Task Management Control and Planning (FFP)

The contractor shall hold monthly In-Process Reviews (IPRs). The contractor shall conduct each IPR with a coordinated agenda, briefing materials, document minutes of the IPRs and provide information regarding TO status, e.g., work progress, price and/or cost of travel/materials, schedule data, projected tasks with completion status and areas of concern. IPRs shall provide for interchanges between the Government and the contractor. The IPRs shall provide a forum to address technical and programmatic topics of the TO.

The contractor shall develop a single initial Integrated Master Schedule (IMS) to include each exercised task area that contains all of the technical and functional activities required to complete the tasking and deliver the IMS within 30 days of contract award.

The contractor shall update the IMS monthly to include updated tasking, current progress and any recently exercised task areas, and deliver the updated IMS to the Government.

The contractor shall submit an initial organizational report to include an overarching organization personnel hierarchy, and a subsequent page with an employee/personnel listing to show name, email and phone number within 30 days of contract award. The contractor shall submit an updated organizational report within 30 days of an employee gain.

The contractor shall provide a monthly financial and cost based reports and activity based cost report which covers all tasks under this effort. These monthly reports will record the progress, issues and cost expenditures for the reporting period.

Deliverables:

IPR Report (Monthly, Power Point (PPT) Slides or Portable Document Format (PDF) document) Initial IMS (Delivered within 30 days of award, Microsoft (MS) Project) Updated IMS (Monthly, MS Project) Organizational Report (Delivered within 30 days of award, Quarterly after initial delivery, MS Word) Monthly Financial, Cost Based and Activity Based Cost Report (Monthly, Contractor Format)

6.1.2 Task Reporting (FFP)

The contractor shall provide a monthly status report (MSR) that describes the status and progress of the efforts on each of the exercised task areas against the IMS.

The information in the MSR shall include the following information:

Description of activities completed and deliverables provided during the current month for the TO.

Brief description of issues, challenges, or problems identified during the reporting period.

Description of the outcome of any trips, technical visit, and related results for the reporting period.

Contractor’s MSR (Monthly, PDF)

6.1.3 Meeting Support (FFP)

The contractor shall host, prepare the meeting agenda and briefing materials, conduct, and be an active participant in meetings to include Weekly PKI Status meetings, Weekly PKE status meetings, and an informal daily 30 minute call to support PKI engineering activities. The contractor shall produce minutes for all meetings including synopses of technical discussions, and lists of open/closed action items.

Deliverables:

Briefing materials (Weekly, various formats) Meeting Minutes (Within seven days after meeting, PDF)

6.2 Combination of TMS and CSP (CPFF)

The contractor shall analyze the existing CSP and TMS hardware and software architecture and develop a Combination Plan that meets the existing technical and functional requirements while striving for maximum economies of scale through the combination of the systems.

The contractor shall develop a new Database Design Description in accordance with DID DI- IPSC-81437A based on the Combination Plan that details the proposed hardware and software configurations.

Once the new design is approved by the Government, the contractor shall decommission the old CSP and TMS equipment that will not be used in the combined system and return it to the Government. The contractor shall purchase new servers to support the combined system to be placed in existing Government owned labs.

Once the new design is approved by the Government, the contractor shall develop and document CRs needed to modify the new and existing software baselines and hardware configurations to support the combined system.

The contractor shall develop System Integration Tests for the combined system in accordance with DID DI-IPSC-41438A to be delivered to the Government according to the IMS.

The contractor shall configure the new and existing network appliances, software, and systems to host the combined system.

The contractor shall execute the System Integration Tests, document the results and deliver a test report to the Government in accordance with DID DI-IPSC81440A within 15 days after test execution.

The contractor shall provide documentation to support the IA accreditation to include the STIG checklists and CR documentation for DoD PKI ATO.

The contractor shall support the transition of the combined CSP and TMS system from development to operational sustainment for up to 60 days to correct any errors identified during the transition and provide system design documents and user manuals.

Deliverables:

Combined Database Design Documentation (Once according to IMS, MS Word) Combined System Integration Tests (Once according to IMS, Contractor Format) Combined Software Test Report (15 days after test execution, MS Word) List of new CRs with all attachments (Once according to IMS, MS Word) Combined User Documentation (Once, MS Word) STIG Checklist (Once according to IMS, STIG Checklist Viewer format)

6.3 Develop issuance interface for SIPR REL DMZ delegated identity (CPFF) The contractor shall analyze SIPR REL DMZ delegated identity infrastructure and develop a Database Design Description in accordance with DID DI-IPSC-81437A based on the Combination Plan that details the proposed hardware and software configurations. This infrastructure is a new development activity for DoD PKI. The delegated identity infrastructure issues a delegated identity credential to the SIPR REL DMZ proxy. The contractor shall design and implement the interface between the proxy and DoD PKI Certificate Authorities (CAs) on the PKI infrastructure.

Once the new design is approved by the Government, the contractor shall develop and document CRs needed to modify the new and existing software baselines and hardware configurations to support the SIPR REL DMZ capability.

The contractor shall develop System Integration Tests for the SIPR REL DMZ capability in accordance with DID DI-IPSC-41438A to be delivered to the Government according to the IMS.

The contractor shall configure existing network appliances, software, and systems to host the SIPR REL DMZ capability. The contractor shall execute the System Integration Tests, document the results and deliver a test report to the Government in accordance with DID DI- IPSC81440A within 15 days after test execution.

The contractor shall provide documentation to support the IA accreditation to include the STIG checklists and CR documentation for DoD PKI ATO.

The contractor shall support the transition of the SIPR REL DMZ capability from development to operational sustainment for up to 60 days to correct any errors identified during the transition and provide system design documents and user manuals.

SIPR REL DMZ Database Design Documentation (Once according to IMS, MS Word) SIPR REL DMZ System Integration Tests (Once according to IMS, Contractor Format) SIPR REL DMZ Software Test Report (15 days after test execution, MS Word) List of new change requests with all attachments (Once according to IMS, MS Word) SIPR REL DMZ User Documentation (Once, MS Word)

STIG Checklist (Once according to IMS, STIG Checklist Viewer format)

6.4 Dogtag Certificate System development (FFP)

6.4.1 Deploy a development repository (FFP)

The contractor shall assist the Government in identifying the Dogtag PKI revisions that provides functionality matching the version of Red Hat Certificate System 8 and 9 in use by DoD PKI at task execution. These revisions will serve as a baseline for the Government’s repository. If an exact revision cannot be identified for CS 8 or CS 9, then the corresponding source Red Hat Package Manager (rpms) available from the Red Hat File Transfer Protocol (FTP) site will be used as a baseline version.

The contractor shall assist the Government in identifying feature differences between the Dogtag repository’s most current commit and the source code baseline. The contractor shall document the differences and categorize them as either security enhancements, bug fixes, or functional enhancements and deliver a report delineating such within 15 days after completion of this effort.

The contractor shall assist the Government in deploying a version control system (VCS) to maintain the source code baseline. The server hardware for the VCS will be provided by the Government. The hosting location of the server hardware will be at the Government’s facility in Ft. Meade, MD.

The VCS shall be Internet accessible and comply with all DoD STIGs for running an Internet accessible VCS. The contractor shall provide the Government a quarterly set of applicable STIG checklists for the VCS and justification for any open findings. The contractor shall track information assurance vulnerability alerts (IAVAs) against the VCS and update to the latest version of VCS provided by the vendor within 10 days after its release by the vendor. The contractor shall implement a web accessible interface, protected by Transport Layer Security (TLS) for the VCS and apply access control methods for web resources. The contractor shall utilize mutually authenticated TLS for authentication and certificate mapping for authorization on the VCS as appropriate.

The VCS shall have a bug tracking mechanism where the Government or contractor can register or review bug reports. The tracking mechanism shall permit various access methods and restrict information based on the authorizations afforded for the access method.

The VCS shall have a feature enhancement tracking mechanism where the Government or contractor can register or review feature enhancement requests. The tracking mechanism shall permit various access methods and restrict information based on the authorizations afforded for the access method.

The VCS shall have a task tracking mechanism for assigning and monitoring contractor or Government resources progress in resolving a bug or a feature. The tracking mechanism shall permit various access methods and restrict information based on the authorizations afforded for the access method.

The contractor shall use the VCS to track all code changes created by the development team.

The contractor shall not create a separate contractor internal VCS for this task.

Deliverables:

Dogtag Feature Report (15 days after task completion, MS Word) STIG Checklists (Quarterly, STIG Checklist Viewer format)

6.4.2 National Information Assurance Partnership (NIAP) validation (FFP) The contractor shall assist the Government in creating the necessary Security Target documentation based on the Protection Profiles applicable to the Certificate System. The Government will identify an authorized NIAP lab that will be conducting the evaluation of the Security Target documentation. If the lab is located outside of the Washington local commuting area, travel will be authorized. The contractor shall provide telephone support to the Government and the NIAP lab to complete evaluation process. During this process, the contractor may be required to supply additional test harnesses to the lab in support of the evaluation. The contractor shall update the Security Target documents to complete the NIAP evaluation and provide a final revision to the government once the certification is received. The contractor shall track lab progress, reporting issues to the Government within 2 business days.

Deliverables:

Initial Security Target documents (Once prior to NIAP testing, Government approved format) Final Security Target documents (Once 7 days after NIAP testing completed, Government approved format)

6.5 Dogtag Certificate System New Development activities (CPFF) The contractor shall identify, track and maintain a list of software defects that were discovered by the contractor or the Government. The defects are expected to fall into two categories:

security vulnerabilities and operational issues. The contractor shall identify if an IAVA, CVE, or government reported security vulnerability impacts an existing system within 24 hours of notification, with all reasonable efforts to complete a patch that corrects the security vulnerability within 5 business days. The contractor shall complete operational issue patches within 10 business days. The Government will prioritize the operational issue patches to be completed.

Patches for security vulnerabilities have priority over patches for operational issues. The Government anticipates that there could be as many as three vulnerabilities or patches to be completed each month. The contractor shall record all open and completed software defects and document the results in the IPR Report.

The contractor shall use industry best practices to create source code comments in a format extractible by Doxygen to develop Applicate Programmable Interface (API) documents, user manuals, and security evaluation documents as required by the development schedule. For example, different types of comments may be related to method invocation, TODO activities marked in the source tree, and specific cryptographic operations, constants, or configurations.

The contractor shall implement new capabilities through development activities for the following categories – 1) developing new support for other data source providers, 2) developing new support for smartcards that conform to the current Global Platform version at task execution, 3) implementing support for new cryptographic algorithms or PKI standards, 4) developing new support for emerging web technologies, and 5) new development to support future server operating systems, such as RHEL 8, that the CS product would need to migrate to.It is expected that there will be a total of 1 enhancement per quarter from any of the above categories.

The contractor shall develop a suite of regression test cases or procedures for the existing and updated software baseline and deliver a ZIP file within 10 days of the start of testing, containing the source tree of generated tests. The tests shall include code unit tests (i.e. Junit) and functional tests (i.e. JMeter) for library and application interfaces. The contractor shall execute the regression test cases, record the results, and deliver the results within 15 days after the completion of the testing.

Deliverables:

IPR Report (Monthly, PPT Slides or PDF document) API documents (After each major enhancement, Doxygen generated document) User Manuals (After each major enhancement, Doxygen generated document) Security Evaluation documents (After each major enhancement, Doxygen generated document) Regression Test Cases/Procedures (within 10 days after the start of testing, ZIP file containing all source tree files) Regression Test Report (15 days after completion of testing, MS Word)

6.6 Support Security enhancements (FFP)

The contractor shall reconfigure the rules and settings for the Web Application Firewall (WAF) to protect against new threats and to support CA deployments. The goal of this task is to reach a set of application protocol whitelists which constrain client traffic to the permissible set of client input. The protections are supplied using an Apache Hyper Text Transfer Protocol Daemon (HTTPD) instance and mod_security. The contractor shall provide an initial User Guide detailing the start and stop procedures for the WAF, and update the procedures annually. The contractor shall provide documentation to support the IA accreditation to include the STIG checklists and CR documentation for DoD PKI ATO.

The goal for user restriction is to use SELinux targeted policy as a technical control and enforce separation of duties as defined in DoD PKI policy. The contractor shall modify the text and configuration target files for SELinux to constrain permissions for users and processes on PKI systems. The contractor shall perform the initial effort to isolate user groups to restrict users to only the necessary portions of the file systems and system resources to perform their duties. The contractor shall perform a follow up effort to constrain processes to only the necessary portions of the file systems and system resources for correct functionality. Annually, the contractor shall update the SELinux target files to account for any changes that were made to DoD PKI Policy.

After the completion of each effort, the contractor shall deliver the SELinux target file documentation.

WAF User Guide (Annually, MS Word) WAF STIG Checklist (After SELinux targeted policy development, STIG Checklist Viewer format) SELinux target file documentation (Initial then Annually, MS Word)

6.7 Review and patch the Red Hat Certificate System source code for defects (FFP) The contractor shall review the Red Hat Certificate System 8 and 9 source code, as released officially by Red Hat and as available from the Dogtag open source project, for defects related to functionality and security. The contractor shall provide a report with a summary of components and files reviewed along with the issues identified and proposed patches.

Deliverables:

Code Review Report (After each official Red Hat Certificate System release, MS Word)

6.8 Notification of issuance events to users (CPFF)

The contractor shall analyze the existing DoD PKI Infrastructure and develop a new Database Design Description capability in accordance with DID DI-IPSC-81437A that will notify PKI subscribers and Registration Authorities (RAs) of issuance events. For PKI subscribers, notification occurs using available contact data already registered with DoD PKI or obtained from DoD Enterprise Global Address List servers. The capability will provide the subscriber with notifications for all credentials issued asserting the subscribers name, with date and time of issuance and responsible issuer. For RAs, notification occurs on a monthly basis of all certificates issued during the month by the identified RA.

Once the new design is approved by the Government, the contractor shall develop and document CRs needed to modify the new and existing software baselines and hardware configurations to support the combined system.

The contractor shall develop System Integration Tests for the combined system in accordance with DID DI-IPSC-41438A to be delivered to the Government according to the IMS.

The contractor shall configure the new and existing network appliances, software, and systems to initiate the capability on the DoD PKI Infrastructure.

The contractor shall execute the System Integration Tests, document the results and deliver a test report to the Government in accordance with DID DI-IPSC81440A within 15 days after test execution.

The contractor shall support the transition of the PKI subscribers and RA notification capability from development to operational sustainment for up to 60 days to correct any errors identified during the transition and provides system design documents and user manuals.

Notification Database Design Documentation (Once according to IMS, MS Word) Notification System Integration Tests (Once according to IMS, Contractor Format) Notification Software Test Report (15 days after test execution, MS Word) List of new change requests with all attachments (Once according to IMS, MS Word) Notification User Documentation (Once, MS Word) STIG Checklist (Once according to IMS, STIG Checklist Viewer format)

6.9 Research and Deploy an Alternate Certificate Management products (CPFF) The contractor shall conduct an Analysis of Alternatives for Certificate Management products available from commercial off the shelf (COTS) vendors as identified by the Government. The contractor shall include the vendor incorporation information, hardware and software requirements, standards supported by the product (e.g. Simple Certificate Enrollment Protocol, PKCS10, Global Platform etc.) and certifications obtained by the product (e.g. NIAP Common Criteria status, Federal Information Processing Standard (FIPS) validation), supported Hardware Security Modules and internal data storage techniques and requirements.