Attachment 1 - PWS - ICIDS Security Suite R1.docx

PERFORMANCE WORK STATEMENT (PWS)

Award

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Integrated Commercial Intrusion Detection System (ICIDS) Security Suite

3. Background. ICIDS Security Suite is used by Fort Huachuca Garrison. Per Security Technical Implementation Guides (STIG) V-245809, inadequate physical protection of Intrusion Detection System (IDS) or Automated Entry Control System (AECS) servers, data base storage drives, or monitoring workstations could result in unauthorized access to core system devices providing protection for classified vaults, secure rooms and collateral classified open storage areas. This could result in the loss of confidentiality, integrity or availability of system functionality or data. The impact of this would be possible undetected and unauthorized access to classified processing spaces; resulting in the loss or compromise of classified information or sensitive information such as personally identifiable information (PII) of persons issued access control cards or badges. The Joint Interoperability Test Command (JITC) as a Fort Huachuca tenant must integrate into the Garrison system to ensure functionality and access.

4. Objectives: The objective is for the vendor to provide an ICIDS security suite solution to include procurement of system components, installation, training, and one year maintenance service.

5. Scope. . The ICIDS Security Suite ensures JITC can seamlessly integrate with Fort Huachuca Garrison physical security requirements. Procurement and installation of this security suite allows JITC to comply with Garrison specifications and secure the compound. The IDS will provide protection for a small general office suite to include a server room used specifically for communications.

6. Performance Requirements.

6.1 Task 1 – Intrusion Detection System (IDS). The contractor shall install:

Vendor furnished (brand name or equal):

Two (2) new Bosch ISC-PPR1-W16 PIMS, Volumetric Indoor (Above Ceiling) One (1) Ditek DTK-120SR Surge Protection, 120VAC, Hybrid Series for AC Power One (1) Ditek DTK-1LVLPLV Surge Protection, 1 Pair, 24V, Terminal Strip for Communications Government furnished:

One (1) DAQ ACU-07581-002 Interior Remote Area Data Collector (RADC) Two (2) Balanced Magnetic Switches (BMS) Four (4) Passive Infrared Motion Sensors (PIMS) Omni-Directional, 360 Two (2) 12 Volt 12.0 Amp Hr. PS-12120 F2 batteries

Materials and workmanship hereinafter specified and furnished shall be fully guaranteed by the Contractor for one year from transfer of title against any defects. Defects which may occur as the result of faulty materials or workmanship within one year after installation by the contractor and acceptance by the Government. Any discrepancies of the installation from the PWS, found during the review and acceptance phase, shall be corrected by the contractor at no additional cost to the contractor or the Government. The Contractor shall promptly correct or re-perform (including modifications or additions as necessary) any nonconforming or defective work within one year after completion of the project of which the work is a part. The Contractor’s warranties shall commence with acceptance of/or payment for the work in full.

Contractor shall pass along to the Government any additional warranties offered by the manufacturers, at no additional costs to the Government, should said warranties extend beyond the one-year period specified herein. If the Contractor procures equipment or materials under subcontract, the Contractor shall obtain for the benefit of the Government equipment and materials warranties against defects in materials and workmanship to the extent such warranties are reasonably obtainable.

This warranty shall in no manner cover equipment that has been damaged or rendered unserviceable due to negligence, misuse, acts of vandalism, or tampering by the Government or anyone other than employees or agents of the Contractor. The Contractor obligation under its warranty is limited to the cost of repair of the warranted item or replacement thereof, at the Contractor’s option. Insurance covering said equipment from damage or loss is to be borne by the contractor until full acceptance of equipment and services.

The Contractor must provide information regarding available Extended Warranty or Service Agreement plans for workmanship of this. Information shall include the warranty/service plan, associated pricing, and plan duration.

The contractor shall utilize certified, qualified ICIDS technicians to provide, install, and test a turn-key ICDIS security suite solution. The contractor shall provide a proposal for all material, labor, and equipment necessary to perform all tasks required and shall complete all tasks during the Period of Performance. The Contractor proposal shall include equipment, shipping, delivery, assembly, installation, and testing of the solution(s) installed. Where available, onsite utilities will be provided at no cost to the Contractor. These utilities will be used only in the performance and support of the project.

The Contractor shall configure, program and download the RADC CallistoView and update the DAQ SMS Master Database and graphics/mimics, as well as test system operation to ensure system communications are operational, all alarm points annunciate correctly and security equipment functions properly. Installation effort will include pulling necessary wire, mounting components and completing final terminations while complying with all OSHA requirements and guidelines. Upon installation completion the Contractor shall conduct a quality assurance inspection and provide a report itemizing the inspection results and identifying any issues. The Contractor shall also test the new security equipment providing a report of results. Finally, the Contractor shall provide an updated as-built drawing showing locations of all newly installed equipment and signed approval documentation to the JITC Physical Security office. The contractor shall coordinate all task-related requests and communicate daily status of the installation with the designated point of contact. The contractor shall provide a one (1)-year warranty for labor which will start at completion of testing by contractor.

The contractor shall ensure all off-site labor (Project Management, Logistics, Drafting-CAD), Travel, Per-Diem, Lodging, Fuel, etc.) is included in the proposal. If travel is expected to be over 500 miles, travel expenses shall include costs for two technicians to travel to Ft. Huachuca, AZ to perform the installation.

Constraints (Area 2): Work schedule 5x8

Deliverables: N/A

Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

100% inspection

100% inspection

8. Incentives. None

9. Place of Performance.

Mission Location: Joint Interoperability Test Command, 2001 Brainard Rd., Bldg 57305, Fort Huachuca, AZ 85613

Place of Performance: Work will be performed on-site at a Government Facility Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The period of performance will be 180 days after receipt of award..

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements.

11. Security Requirements. The work will be UNCLASSIFIED. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared Defense Information Systems Agency (DISA) personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-2 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. Security Executive Agent Directive 4, National Security Adjudicative Guidelines, 8 June 2017

m. DoDM 5400.07, Freedom of Information Act Program

n. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

o. DoD Instruction 8510.01, “Risk Management Framework for DoD Systems,” July 19, 2022

11.1 Background Investigation. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final background investigation eligibility delineated in the table below when performance starts.

NOTE: 11.2 Justification for Access must be listed in Section 6.

11.2 Investigation Requirements. Not Applicable

11.3 Visit Authorization . Visit requests shall be processed and verified through Defense Information System for Security (DISS) to the Security Management Office (SMO) DKARAA. DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in PWS/SOW Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.3.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DISS verification of Visit Authorization by Security Manager (if available)

3. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO) or Program Manager.

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE (if available)

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel background investigation authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e., Start date / End date)

11.3.2 VTN Package. The Contractor FSO or PM will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.3.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE (if available)

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

· Date contractor CAC was collected

· Name of COR/Alt COR

· Termination Date

· Reason for Termination: <insert reason from the 13 adjudicative guidelines, other actions, or type “No longer working on contract”>

*Any VAL/VAR submitted without the above information will be denied.*

11.4 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-4039 or via mail at:

Defense Information Systems Agency

Defense Information Systems Agency

ATTN: J-16, Industrial Security

ATTN: J-16, Personnel Security

Command Building

Command Building

6910 Cooper Ave.

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

11.5 Information Security and other miscellaneous requirements.

11.5.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.5.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.5.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.5.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.5.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.5.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.5.5.2 DISA retains the right to revoke contractor personnel access to DISA facilities and networks, who violates one or more of Security Personnel Adjudicative guidelines, harassment or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.5.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.5.6 Not Applicable

11.5.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI). N/A

13. Other Pertinent Information or Special Considerations. N/A

a. Identification of Possible Follow-on Work. N/A

b. Identification of Potential Conflicts of Interest (COI). N/A

c. Identification of Non-Disclosure Requirements. The contractor shall obtain and maintain Non-Disclosure Agreements (NDA) for each employee assigned to the contract. Initial NDAs shall be signed within one week of contract award, and NDAs shall be kept current through the entirety of the period of performance as employee turnover occurs. The contractor shall ensure that all employees assigned to the contract have executed NDAs on file as of the date of the Monthly NDA Status Report, which shall include names and NDA status of all current employees assigned to the contract.

d. Packaging, Packing and Shipping Instructions. N/A

e. Inspection and Acceptance Criteria. The Government will inspect the installation and functional capability of the ICIDS Security Suite for final acceptance prior to contractor departure from Government location.

f. Property Accountability. N/A

g. Transitioning.

1. Transition-In (Phase In). N/A

2. Transition-Out (Phase Out). N/A

h. Supply Chain Risk Management (SCRM). N/A

i. Training. N/A Enclosure 4a, PWS Page 1 of 11 Pages 2015/Version 9

Page 21 of 9 Pages