Attachment 01b1 PWS Task Order 1 Amend 0003.pdf

PERFORMANCE WORK STATEMENT (PWS)

Pentagon Force Protection Agency (PFPA)

Integrated Security Services Contract 4 (ISSC)

Task Order 1

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide Integrated Security Services. The Government shall not exercise any supervision or control over contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Prime Contractor who, in turn is responsible to the

Government.

1.1 Description of Services/Introduction: The Pentagon Force Protection Agency (PFPA) Integrated Security

Services Contract (ISSC) is a total system approach for providing integrated electronic and physical security systems for the Pentagon Reservation, Mark Center, Defense Health Headquarters (DHHQ), DoD leased facilities, and Raven Rock Mountain Complex (RRMC) in Adams County, PA and Washington County, MD.

1.2 Background: Previous contracts for this requirement, awarded in 2007, 2012, and 2016 provided comprehensive security integrator services to PFPA. Since inception, contract scope has expanded to include additional facilities, new systems, and increased security capabilities.

1.3 Objectives: The Government’s four, interrelated high-level objectives for the ISSC are:

a) Scalability and Interoperability – Systems shall be capable of scaling to accommodate additional users, sensors, capabilities, and facilities. Similarly, systems shall be able to adjust down as facilities are closed, suites are decommissioned, or requirements adjusted. Systems and their components shall to the maximum extent possible, utilize open standards and commercial-off-the-shelf (COTS) technology. Standard network protocols shall be used to traverse the Government’s network. Wherever computers are required, they shall be widely available models based on open systems architecture. Standard operating systems shall be used, such as but not limited to Microsoft Windows, Linux, and UNIX for the computer-based systems provided under ISSC.

b) Availability and Resiliency – The Government has a goal of operating ISSC systems at or near a 100% operational level. Systems shall be designed and implemented to be resilient to failure such that a failure of a single component should not incapacitate the entire system. To achieve this goal, the Contractor shall leverage industry best practices for assuring resiliency and availability, including but not limited to:

Built-in redundancy

Automatic failover

Fault tolerance

Virtual environments

Data backup

Data archiving

Automatic updates of operating systems (OS) and applications

Existing and future cloud management services

Notification of software/hardware approaching end of life

Power-on replacement i.e. hot swapping components or peripherals

Continuous Power i.e., uninterruptible power supplies (UPSs)

Backup power i.e. batteries and generators

Surge suppressors

For the purposes of this contract, system reliability is defined as the probability that a system or subsystem, including all hardware, firmware, and software will satisfactorily perform the intended function(s) for which it was designed, duration for which it is in operation, and in the operational environment. The Contractor shall maintain system reliability at a level equal to, or higher than, the systems documented percentage or failure rate provided by the manufacture and/or as required by regulatory requirements for classified areas.

For the purposes of this contract, system availability is defined as the ratio of time a system, subsystem, or component is functional to the total time it is required or expected to function.

For the purposes of this contract, system serviceability is defined as the ease with which a component, device, or system can be maintained and repaired. All precautions should be taken to maintain and repair systems to cause as little downtime or disruption as possible and within the expected reliability and availability standards stated in this contract. The Contractor shall notify the government of any potential problems or recommended actions critical to systems operations that can be addressed by maintenance and repair, as far in advance as possible to minimize downtime or failure.

Factors that do not impact contractual requirements for system reliability, availability, or serviceability are where root cause of problems are as a result of network, power, or other external factors outside the scope of this contract and maintained by Other Government Agencies (OGAs) or Other Government Contractors (OGCs). Outages caused by external factors shall not count against the availability or reliability statistic until the network, power, or other external factor has been restored, but may require support for the application or equipment impacted.

c) Reliability and Cost Sustainability – Systems and services shall be affordable across the full lifecycle while meeting the Government’s requirements, minimize the use of custom and proprietary solutions, and remove systems, hardware, and software before they incur excessive sustainment costs or reach end of service.

d) Accountability and Customer Satisfaction – Systems and services shall be designed and implemented, and quality checked (i.e. QA/QC) to be user friendly, mindful of the impact and sensitivities of the customer workspace, high performing, and to meet contractual service requirements.

1.4 Scope: The ISSC consists of four main capabilities: Electronic Security systems, Physical Security, Passive and

Active Barriers, and Infrastructure Support. Systems and services under each capability include but not limited to the following:

a) Electronic security systems, access control; intrusion detection; visual surveillance and intelligent video analytics; physical security information management; license plate recognition; gunshot detection; under vehicle inspection; identity, credential, and access management; mass notification; biometric and multi-modal authentication; computer aided dispatch and other law enforcement mission applications; chemical, biological, radiological detection and mitigation; and operations center collaboration visualization systems.

b) Physical security, personnel, vehicle, cargo, and parcel screening systems; passive and active barriers, turnstiles, fencing, bollards, gates, traffic control; ballistic rated glass, booths, kiosks, and mobile shields; blast-resistant waste receptacles, doors (sound-rated and force protection), window film, locks, and door hardware. Software applications in support of Electronic Security, Physical Security, Law Enforcement, and Emergency

Management.

c) Infrastructure supporting the above systems, software configuration, custom code, cabling for electrical and information technology; trenching, grading, utilities, conduit placement, and other civil types of work.

To deliver these capabilities, the Contractor shall provide the services listed below:

a) Full Lifecycle Systems Engineering: The Contractor shall be responsible for providing full lifecycle systems engineering services for upgrades or new electronic and physical security systems. The full lifecycle shall include requirements elicitation and analysis, design, development, testing, installation, configuration, integration, verification and validation, transition, sustainment, and decommissioning.

b) System Support, Sustainment, and Administration: The Contractor shall be responsible for sustainment support of electronic security systems. This support includes system monitoring, troubleshooting, patching and software updates, configuration, and administration.

c) 3rd Party Software and OGC Support: The Contractor shall provide support to 3rd party software integrations and the OGC installing and maintaining it. This support includes software upgrades, existing or new connections/integrations to ISSC systems, testing, troubleshooting and other areas impacting either ISSC supported systems or those maintained by OGCs.

d) Preventative Maintenance: The Contractor shall be responsible for performing periodic preventative maintenance on all electronic and physical security systems identified in this PWS as well as any components installed during this contract. An estimated amount of components installed per year is included in Appendix-

A Table 15. Periodic preventative maintenance shall be performed at minimum in accordance with manufacturer recommendations and may require additional preventative maintenance work due to amount of use or ambient conditions.

e) Repair and Sustain: The Contractor shall be responsible for responding to and repairing damaged, malfunctioning, or inoperable systems and their components as described in this PWS as well as any components installed during this contract. An estimated amount of components installed per year is included in

Appendix- A Table 15

f) Configuration Management: The Contractor shall maintain a database of all ISSC electronic and physical security systems characteristics.

g) Logistics Management: The Contractor shall be responsible for procuring, storing, and inventory of materials and supplies to deliver services under this contract.

h) Quality Management: The Contractor shall be responsible for tracking, baselining, and identifying deviations from ISSC and manufacturers standards for quality and performance.

i) Hardware Alterations: The Contractor shall be responsible for hardware alterations of electronic and physical security systems per ISSC and manufacturer standards.

j) Design and Technical Evaluation: The Contractor shall be responsible for performing technical evaluations of new and existing electronic and physical security systems to assess their capacity to meet requirements, maturity, and their continued use.

k) Training: The Contractor shall be responsible for delivering initial and reoccurring training on electronic and physical security systems to Government and Contractor personnel.

The Contractor shall be responsible for:

a) Service, maintenance, and performance of existing systems and applications at the time of award of this contract.

b) Service, maintenance, and performance of new systems and applications installed and/or upgraded while this contract is in place. These systems may be installed by the ISSC Contractor, or OGCs as part of other non-

ISSC construction projects.

The work to be performed under this task order is divided into four major categories, which are:

a) System Support

b) Logistics

c) Repair

d) Maintenance

The specific systems and subsystems are defined in Section 5.0 and Appendix A.

1.4.2 Site Conditions and Work Environment: The Contractor shall anticipate the need to access confined spaces, which Occupational Safety and Health Administration requires appropriate permits/certifications and defines as roofs, roof hatches and access points; telecommunications closets and high voltage rooms; and areas of high traffic or criticality that may not be interrupted during peak access periods as part of installation, preventative maintenance, and repair activities. The Contractor shall provide installation, preventative maintenance, and repair activities throughout the year, in all weather conditions. The Contractor shall provide the appropriate tools, safety measures, and qualified personnel to accommodate the unique nature of these environments and ambient conditions.

The Contractor shall apply for and obtain any required building permits, including space use, confined space entry, hot work, excavation, electrical, above ceiling, and utility permits from the Building Manager’s Office or appropriate authority having jurisdiction prior to performing the required work.

The Government shall provide the Contractor with limited parking based on availability at the Pentagon

Reservation, Mark Center, and Raven Rock Mountain Complex. There is no Government provided parking at leased facilities. The Contractor shall be fully responsible for procuring parking at all locations to perform work required under this Contract.

1.4.3 Support for On-Going Initiatives: This section describes ongoing ISSC and ISSC related efforts spanning from 2020 until the anticipated award of this contract. Support of these new projects shall be performed under this task order. This section is provided for informational and planning purposes.

1.4.3.1 Privileged Management Program (PMP): PFPA’s PMP is an enterprise solution designed to provide

Identity, Credential and Access Management (ICAM) services across the PFPA protected facilities and was developed to achieve compliance with the Homeland Security Presidential Directive 12 (HSPD-12) federal mandate referenced in Appendix B. PMP capabilities include tenant enrollment, identity, credential and access management, and provisioning to PFPA PACS, continuous vetting via Identity Management Engine for Security Analysis

(IMESA), tenant security manager self-service control of PACS for their offices, and all aspects of visitor registration, vetting, check-in, escort binding, and checkout.

1.4.3.2 Physical Security Information Management System (PSIM): PFPA’s PSIM system is a commercial-off-the-shelf (COTS), enterprise security management solution that enhances overall situation awareness, surveillance, alarm and incident management for its security operations centers. The PSIM system serves as an integration platform to integrate various, disparate electronic security systems so they function as collective and to automate the application of business rules and operational procedures to assist security operators with alarm and incident management across the Pentagon and the NCR facilities. PFPA is in the process of replacing existing PSIM, which is Proximex Surveillint, with CNL IPSecurityCenter (IPSC) with an estimated completion date in 2021. PFPA anticipates opening CNL IPSC to additional user populations beyond the Security Operations Centers during the life of this contract.

1.4.3.3 Alarm Reduction Efforts: PFPA has made significant progress since 2013 in reducing nuisance alarms throughout its systems through aggressive maintenance, lifecycle replacement, configuration changes, and PSIM business logic. PFPA continues to make concerted efforts to reduce nuisance alarms through system/hardware/sensor replacement. PFPA places primacy on fixing causes of alarms at the source, as close to the problem as possible

1.4.4 System Support: The Contractor shall provide baseline system administration support of all systems identified in Section 5.5 as well as any new components of these systems installed under this contract.

1.4.4.1 Baseline System Support: System support shall include the following services:

System Monitoring: The Contractor shall be responsible for continuous monitoring and oversight of ESS. The

Contractor shall establish an automated, continuous method to electronically track the status of ISSC systems, devices, and end points and record statistics on uptime and availability. The Contractor shall provide monthly reports on system and endpoint uptime and reliability. The Contractor shall report to the Government unplanned infrastructure, network, power, or ISSC system interruptions that impact or degrade ISSC Systems. The Contractor shall fully participate in planned and unplanned network outages, including participation in outage teleconferences, servers in coordination with the IT Service

Provider.

specified orders or IAVA notifications prior to suspense date.

The IT Service Provider performs vulnerability compliance scans of all services and network devices at least weekly.

Security Technical

Implementation Guides

(STIG)

Automatic and manual DISA STIG implementation and documentation for all servers and devices. These STIG remediations and documentation include but are not limited to the following when they are on ISSC servers:

IIS and Web Server STIG

Application STIG

Microsoft SQL Server STIG

Redhat Server STIG

Continuously maintained IAW individual STIG frequency.

Plans of Objectives and

Milestones (or similar)

Narrative description of cybersecurity requirement, operational impact, cybersecurity risk, and plan/schedule for compliance

As needed to document required patch or STIG deviations for continued compliance/accreditation

Cybersecurity

Documentation Ports, Protocols, and Services

Hardware/Software Lists

System Design Documentation

System Architecture

System Security Categorization

Privacy Impact Assessment

System Security Plan

Compelling body of evidence (e.g., screenshots, logs, scan results) that empirically demonstrate cybersecurity compliance

As needed for periodic cybersecurity compliance inspection and re-accreditation

Authority to Operate Collection of STIG, POAM, and cybersecurity compliance documentation necessary for Authorizing Official approval

Every one to three years dependent on system type and accreditation

ATO documentation shall be submitted at least 100 calendar days prior to ATO termination date

Cybersecurity of Security Devices: Security end-point devices, including but not limited to PACS panels, video surveillance cameras, and similar IP enabled devices, pose unique cybersecurity risks as these devices are not typically monitored or managed for cybersecurity vulnerabilities as normal servers and workstations are. The

Contractor is responsible for being aware of cybersecurity vulnerabilities through either direct vendor communications, monitoring of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure

Security Agency (CISA) National Vulnerability Database, and open source disclosure channels for all IP enabled security devices under this contract. Within two (2) business days of any reported disclosure via the above channels, the Contractor shall provide a report that describes the vulnerability, the impact and risk, and the Contractor’s remediation plan to the Government.

1.4.4.3 Technical Solutions Identification: At the request of the Government, the Contractor shall provide written technical solutions identification on up to 24 separate topics per contractual year. Technical solutions identification shall be aimed at improving system performance, reducing vulnerabilities, closing gaps associated with current security measures, or identifying new or replacement materiel solutions. These technical solution identification submissions are typically in a 5-15 page white paper format that describes the issue/requirement and the proposed solution also provides a rough cost estimate for solution.

The Contractor may submit unsolicited technical solutions identifications based on their identification of emerging trends in the security industry or capability and performance gaps. If the Government accepts the Contractor’s suggestions, the Contractor-initiated technical solutions identification shall count towards the 24 separate solutions required per year.

1.4.4.4 Lab Support: The Contractor shall provide and maintain an ISSC laboratory environment located in the

NCR. This laboratory environment shall be used for multiple purposes, including, but not limited to, evaluation of new solutions; design, stress, and integration testing; testing of system patches and upgrades; diagnostic testing of issues experienced in the production environment, and OGC software for pre-installation testing. The Contractor’s laboratory shall mimic the Government’s production environment to the maximum extent feasible to provide empirical evidence of the performance of the system and reduce risk of changes performed in the production environment. The Contractor shall maintain all laboratory facilities and systems with appropriate physical and logical controls to protect systems from unauthorized access. The Contractor shall also accommodate training on changes to existing ISSC Systems and maintenance and logistics software.

1.4.5 Logistics:

Configuration Management: The Contractor shall deliver a Configuration Management Plan as a contract deliverable (see Section 3.2.5) in accordance with the following timelines:

a. Draft Plan is due within 15 calendar days of contract award

b. Baseline Plan is due within 45 calendar days of contract award

c. Final Plan is due within 90 calendar days of contract award

d. Revised Plan is due within 30 calendar days of any option year award

The Contractor shall implement, document, and continuously provide configuration management services of all

ISSC Systems commensurate with the standards of American National Standards Institute/Electronic Industries

Alliance (ANSI/EIA)-649-1998 National Consensus Standard for Configuration Management. The Contractor’s

Configuration Management Plan shall address standard system programming and configuration values (to include functional logic and timing) for the full range of systems and devices being installed. These configurations shall be confirmed through operational testing to meet the performance specifications identified in Section 5.1.1. The

Contractor shall propose a standardized list of naming conventions and device labeling. The Contractor shall develop, update, and maintain initial software and hardware baseline. ESS drawings with point-to-point design currently exist and will be provided at time of award; however, the Contractor shall be responsible for validation of received designs/drawings. Additionally, any remediation of discrepancies is a responsibility of the Contractor.

ESS drawings of all ISSC systems shall be maintained and updated by the ISSC Contractor and provided to the

Government upon request.

The Plan shall address a change and configuration control system and periodic audits by both Government and

Contractor personnel, to include verification and validation of subcontractor work.

The Contractor shall transfer data and information to the Government electronically to the maximum extent possible to facilitate more rapid communications between Government and Contractor organizations.

1.4.5.1 Maintenance Management System (MMS): The Contractor shall provide a commercial off-the-shelf (COTS)

MMS. The MMS shall consist of a web based front end and a structured query language database.

The MMS shall capture the following data for all systems and their sub-components under ISSC. The Contractor shall be responsible for assuring the below data is captured and updated within three (3) business days following any procurement, testing, installation, preventative maintenance, configuration change, or repair activity. The Contractor shall adhere to government requirements, guidance, and industry best practices to ensure secure connectivity and storage of the sensitive data contained in the MMS.

Device type

ISSC details:

o ISSC barcode number o Project procured under o Projects under which the device was moved, adjusted, or removed.

Manufacturer details:

o Manufacturer o Device model o Value of component o Manufacturer serial number o Date of manufacture o Useful life o Predicted end of service date

Device location:

o Building or storage site o Floor o Suite or room number o Geospatial coordinates

Pertinent configuration details, including but not limited to:

o Media Access Control (MAC) and Internet Protocol (IP) addresses o Software or firmware version o Device logical naming o Alarm priority o Parent and child device physical and logical connections o Device specific configuration parameters, such as home position

Licensing, warranty, service, and support agreement information, including terms and expiration and renewal dates

A complete cradle to grave chronological history of:

o Device procurement, warehousing, pre-installation testing, installation, and placement in service o Preventative maintenance schedule and activities, history of preventive maintenances (PMs), and date of next scheduled PM o Break-fix repair history and corrective measures o System patch / hot-fix history o Time down and time returned to service per incident o Configuration changes o Removal, relocation, decommissioning, and final disposal

The MMS web based front end shall allow for the following capabilities for the Contractor and authorized

Government personnel to:

Submitting repair tickets and getting ticket status

Tracking repair ticket lifecycle

Searching for a device by salient characteristic above

Printing standard reports for system metrics

Natural language, free form database querying

Export all or portions of the database in a file format compatible with Defense Property Accountability

System to enable effective audit readiness

The Contractor shall provide training on the Contractor’s MMS solution to Government personnel.

1.4.5.2 Replacement and Spare Parts Equipment: The Contractor shall maintain a sufficient bench stock of spare parts and replacement components for equipment on the program to ensure quick reaction to emergencies and to ensure timely repairs are made to all the equipment on the program, as well as being able to fulfill service requests within contractual requirements.

The Contractor shall provide a warehouse for GFE and spare parts needed as identified in this contract. The

Contractor shall arrange for the transferred Government Furnished Equipment (GFE) received from the outgoing

Every two hours thereafter until resolved

Repair/Recovery Time

Time from customer service call submission until system parameters are restored within threshold

4 hours (Normal Duty Hours)

8 hours (Outside Normal Duty Hours)

After Action Review

Written summary of service degradation, operational impact to the Government, proximate cause, and short and long term corrective actions. AAR are required for some Tier 2 severity system degradations.

No preliminary report necessary

Final report within five (5) business days if service degradation impacts high level personnel or increases in scope

Outage or repair issues not falling into either Tier 1 or 2 shall be responded to within 60 minutes and the

Government Lead or COR shall be notified. Based on the issue and impact on security, time for repair will be provided at that time.

Occasionally ISSC system service degradations are caused by a higher-level service disruption. These higher-level disruptions include interruption of electrical service by building management or IT/network disruptions. The

Contractor is responsible for identifying when a higher-level service degradation is potentially causing the ISSC system disruption and opening a ticket with the responsible organization. The Contractor shall update any service interruption notification that the issue has been referred to others for resolution. The Contractor shall capture the ticket number and lifecycle within their MMS.

The Contractor’s Repair/Recovery Time SLAs are placed on hold while the higher-level service disruption is resolved. Once the higher-level service disruption is resolved, the Contractor’s Repair/Recovery SLA resumes. The

Contractor’s MMS shall track the complete ticket lifecycle including time “off the clock” waiting for resolution from another organization.

A service call is a verbal or written request by telephone or e-mail from the COR, PFPA Operations Center personnel, or other authorized representative reporting a malfunction or maintenance problem. The information shall be entered by the Contractor into the MMS and tracked until completion. The Contractor shall commit the appropriate resources necessary to accomplish the repair, to include, but not limited to, system administrator for system issues as well as electronics technician for equipment repairs.

1.4.6.2 Completion of Service Calls: A service call shall be completed per the Table 1 in Section 1.4.6.1 from the time the service call is issued to the Contractor. If a service call cannot be resolved within the specified time period, the Contractor must notify the COR or one of his designated representatives. The Contractor shall submit a written notification that gives:

(1) an explanation of the delay

(2) the estimated time for completion of the service call

(3) evidence showing an effort to comply with the time requirement

(4) corrective measures to avoid repeated failures to meet response and repair time objectives

If immediate repairs cannot be made, the Contractor will coordinate with the tenant occupant/security manager to take all necessary actions or measures to protect the safety of the public and/or Government property.

1.4.6.3 ISSC Service Desk: The Contractor shall provide an on-site ISSC Service Desk services as the focal point for system monitoring, preemptive identification of system failures and degradations, technical support and inquiries, repair coordination and dispatch of technicians, making system configuration changes, system administration, and receiving customer service requests. The ISSC Service Desk shall be primary location for

System Support activities described in Section 1.4.4 and the entry point for Repair activities under Section 1.4.6.

Operating Hours: The ISSC Service Desk shall be manned on-site 24 hours per day, 365 days per year, including

Government holidays and during Government closures due to inclement weather and other incidents.

a. The Contractor shall maintain and monitor an e-mail account, MMS, and a telephonic answering service for receiving technical inquiries and service requests. The Contractor shall maintain a log of all inquiries and their content. The log will be incorporated into a Repairs Report and delivered to the COR on a monthly basis.

b. The Contractor shall enter and track all service requests in to the MMS. The Contractor shall record at minimum the date and time of the request, their organization, location, and system or component issue.

The Contractor shall track the resolution of the issue in the MMS.

c. The Contractor shall proactively monitor ISSC systems and their components through electronic means.

The Contractor shall preemptively take action to repair or restore system degradations and failures. The

Contractor shall notify the servicing IT infrastructure provider of network outages affecting ISSC systems.

d. The Contractor shall implement Government approved configuration changes in the ISSC systems. All changes shall be documented in the MMS.

e. The Contractor shall provide notification of system changes, degradations, and outages to System Owners, Operations Centers, and PFPA Leadership.

f. The Contractor shall receive access change requests from the tenant Security Managers and implement those changes in the identity, credential, and access management system of record within two business days of receipt. The Contractor shall process tenant requests for personal identification numbers (PINs) for suite access within two (2) business days of receipt. The Contractor shall respond to access inquiries from tenants and Security Managers on access to spaces within two (2) business days of receipt. All access change requests and requests for PINs shall be tracked and reported monthly to the Government.

g. The Contractor’s Access Control Center (ACC) staff shall abide by approved ACC Standard Operating

Procedure (SOP), to include all future updates. ACC SOP is listed as Appendix C.

1.4.7 Preventative Maintenance:

1.4.7.1 Preventative Maintenance Plan: The Contractor shall deliver and maintain a comprehensive, risk-based

Preventative Maintenance Plan. The Plan shall document at a minimum, the frequency and type of preventative maintenance activity to system/component levels. The minimum maintenance frequency shall be in line with OEM recommendations. The Contractor’s plan shall identify systems and devices requiring maintenance above the OEM recommended minimum, due to the austere placement of devices, their criticality, high amount of use, and impact to security posture/coverage if the device/system capability is degraded/off-line. The Plan shall propose phasing/scheduling of preventative maintenance that minimizes impact to tenant space. The Plan shall also include verification of updates and device data in the MMS. The Preventative Maintenance Plan is subject to approval by the government and shall be submitted as a deliverable in accordance with the timelines set forth below:

a. Draft Plan is due within 15 calendar days of contract award

b. Baseline Plan is due within 30 calendar days of contract award

c. Final Plan is due within three months of contract award

d. Revised Plan is due within 30 calendar days of any option year award

Preventative maintenance shall also be performed on new systems installed during the life of this contract unless noted otherwise in the individual task orders.

1.4.7.2 Hardware Maintenance: The Contractor shall provide all parts, services required, and equipment necessary to maintain the ISSC equipment to manufactures specifications at an operational site as requested by the

Government. Preventative maintenance shall be performed on all systems listed in Section 5.5 of this PWS

Statement down to the lowest serviceable level identified by the vendor. The Contractor shall maintain a spare parts inventory and active logistics program to support the fielded equipment for the term of the contract.

1.4.7.3 Software Maintenance: The Contractor shall procure and manage required software agreements with OEM vendors to receive software updates/patches for systems maintained under ISSC. Software shall not include the operating system or relational database management system, unless specified in an individual task order. Within 30 calendar days of OEM update release, the Contractor shall provide the following deliverables:

a. Patch/Update overview, identifying features, capabilities, and bug-fixes. The Contractor shall specifically identify new features that are responsive to Government identified needs or capability gaps.

b. Milestone schedule that identifies laboratory and production environment implementation.

c. Patch/Update dependencies needing coordination with operational and technical system stakeholders.

d. Documented testing of update in laboratory environment.

e. Integrator recommendation on whether to deploy patch/update.

All licensing issues shall be routed to the Government COR.

1.5 Period of Performance (Pop): The period of performance shall be for one (1) Base Year of 12 months with a four (4) 12-month option periods and a six (6)-month extension in accordance with FAR 52.217-8.

1.6 General Information:

1.6.1 Quality Assurance/Quality Control (QA/QC) Program: The Contractor shall develop a QA/QC Plan identified for all systems and subsystems maintained under this contract. QA/QC standards shall be based on applicable DoD

Regulations or industry best practices, whichever is the higher standard. This plan is considered a contract deliverable and shall be delivered in accordance with the timelines established in the deliverables table in the

Technical Exhibit 2.

The Contractor shall deliver and execute a QA/QC program that meets DoD regulations and International

Organization of Standards (ISO) 9001:2000 identified in Appendix B. The QA/QC Plan should address all aspects of the ISSC to include the approach for installation task orders. This plan is considered a contract deliverable and shall be delivered in accordance with the following timelines:

Draft Plan is due within 15 calendar days of contract award

Baseline Plan is due within 45 calendar days of contract award

Final Plan is due within 90 calendar days of contract award

Revised Plan is due within 30 calendar days of any option year award

Deliverable(s): Quality Control Plan

1.6.2 Recognized Holidays: The Contractor is responsible for completing System Support and Repair work required under this contract irrespective of Federal holidays to include any other day designated by Federal Statute, Executive

Order or a Presidential proclamation. When the government grants administrative leave to government employees, or is closed as a result of inclement weather, potentially hazardous conditions, or other special circumstances, contractor personnel working at the specific facility/location granted administrative leave may also be dismissed at the discretion of the On-site Manager to the extent that the overall performance is not adversely impacted. The contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons. All other work, including

Installation and Preventative Maintenance, shall be scheduled appropriately to meet required delivery dates.

Federal holidays listed below are for informational purposes only:

New Year’s Day Independence Day

Martin Luther King Jr.’s Birthday Labor Day

President’s Day Veterans Day

Memorial Day Thanksgiving Day

Juneteenth Independence Day Christmas Day

Columbus Day Inauguration Day

1.6.3 Hours of Operation:

The Contractor is required to provide all services in this PWS regardless of the day or hour to meet service level agreements as described in section 1.4 of this PWS. Normal Pentagon operation hours are defined as 0500-2000, Monday through Friday, with the exception of the Federal holidays listed above.

The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. The Contractor shall provide an on-site person(s) who shall be physically present during normal duty hours to act as site supervisor(s), conduct total management coordination, and furnish liaison with the

Government during system installation, maintenance, and repair. The supervisor(s) shall be the point of contact with the Government. The supervisor(s) shall have the authority to make technical decisions on-site on behalf of the

Contractor. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the mission is essential.

1.6.4 Place of Performance: The PFPA currently provides protection for DoD facilities in the National Capital

Region (NCR) and RRMC as listed in Appendix A, Table 1. This list is for informational purpose and is not intended to be definitive or binding. Facilities occupied by the Government change based on multiple factors and may increase or decrease throughout the duration of this contract. The Contractor is fully responsible for performing work at all facilities protected by PFPA.

1.6.5 Type of Contract: The Government will award a Firm Fixed Price (FFP) Task Order.

1.6.6 Conduct of Personnel: The Contractor’s personnel must comply with the rules and regulations of individual sites where work is performed. Failure to do so will result in the Government requiring the Contractor to remove the employee from the job site. The reasons for removal are misconduct; security violations; or being under the influence of alcohol, drugs, or other incapacitating agents. Inappropriate conduct or actions as determined by the

Government shall be subject to dismissal of Contractor’s personnel from the premises. Such action is necessary in the interests of the Government. The removal from the job site or dismissal from the premises shall not relieve the

Contractor of the requirement to provide sufficient personnel to perform the on-going work being performed by the person or persons as required by the work statement. The Contractor shall comply with all applicable security rules and regulations to protect government and proprietary information. Government approval is required for all public release or release to third parties of government information.

1.6.7 Security Requirements: The security requirements are in accordance with the attached DD254.

1.6.7.1 Personnel Security Clearances: All contract personnel must possess, at minimum, a SECRET security clearance and meet the additional security requirements established in the Office of Director of National

Intelligence, ICD 704 and ICD 705. The Contractor shall identify appropriate individual’s performing work under this contract that will require access to classified information and shall submit them for "SECRET or TOP

SECRET" security clearances within 10 business days after receipt of facility clearance or 10 business days after contract award.

Application for personnel security clearances shall be made in accordance with DoD 5220.22M, Section 2.

Applications for new personnel requiring security clearances shall be submitted within 10 business days of hire by the Contractor. The Government reserves the right to have the Contractor provide documentation to verify compliance with these security requirements. All Contractor personnel assigned under this contract must possess a clearance consistent with PFPA Personnel Security Clearance Policy and position sensitivity requirements. PFPA

Security Service Directorate (SSD) will provide security classification guidance for the performance of this contract.

1.6.8 Administrative Functions: The Contractor shall ensure that badge requests, parking requests, access requests for contractor and subcontractor personnel are submitted to the COR. An organization chart and list of all contractor and subcontractor personnel shall be provided and updated when changes are made or when requested by the government.

1.6.9 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are

Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All Contractor personnel shall display Common Access Card or Pentagon Facilities Alternate Credential while performing work at the

Government site.

1.6.11 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCI as defined in FAR Subpart 9.5.

The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI.

The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.12 Contractor Manpower Reporting:

(a) The Contractor shall report all Contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to completely fill in all required data fields using the System for Award Management (SAM): http://www.sam.gov.

(b) The Contractor shall use the “All Other Defense Components” tool unless otherwise directed by the Contracting

Officer’s Representative or Contracting Officer.

(c) Reporting inputs will be for the labor executed during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than

October 31 of each calendar year. The Contractor shall completely fill in all required data fields. The Contractor shall enter initial data into SAM to establish the basic contract record no later than 15 business days after receipt of contract award or contract modification incorporating this clause. The Contractor shall notify the Contracting

Officer when the basic contract record has been established in SAM.

(d) Contractors may direct technical questions to the help desk at: http://www.sam.gov.

[Reference: SECDEF memorandum of 16 October 2019, “Revised Department of Defense Contractor Manpower

Reporting”]

1.6.13.1 Telework:

1.6.13.1 The Government may permit telecommuting (telework) by contractor employees when determined to be in the best interest of the Government in meeting work requirements (e.g., COOP). The contractor must have an established program subject to review by the Government. All telecommuting agreements must be authorized and approved by the COR and include date, time, and description of the work to be performed.

1.6.13.1.2 The contractor must identify to the COR any task/work requirements that may be performed at an alternate worksite. Telework will be at no additional cost to the Government. Upon approval:

1.6.13.1.3 The Government may provide as Government Furnished Equipment (GFE): Secure laptop with access to the required portals, networks, and business application. Internet connection will not be furnished, therefore, Internet access shall be provided by the Contractor.

1.6.13.1.4 Individual Contractor Personnel shall provide services from their authorized telework worksite location

IAW Department of Defense Instructions (DoDI) 1035.01, Telework

Policy: http://www.dtic mil/whs/directives/corres/pdf/103501p

1.7 Transition Support:

1.7.1 Phase In: A smooth and orderly transition between the Contractor and the predecessor Contractor is necessary to assure minimum disruption to vital services and Government activities. The Contractor shall provide a plan for a

30-calendar day incoming transition from the outgoing contractor. The Contractor shall address a transition point of contact who will oversee the entire transition period and all deliverables outlined below and in the deliverables table in Technical Exhibit 2. The Transition Plan shall include, but is not limited to:

Day-by-day transition schedule with key milestones identified.

Review and evaluation of current supported systems/services.

Transition of historic data to new contractor systems.

Recruitment, onboarding, training, and identification of key personnel and contractor employees.

Transfer of hardware/software warranties, license information, and service maintenance agreements

(SMAs). New licenses and SMAs shall be procured by the Contractor.

Transfer of all necessary business and/or technical documentation.

Transfer of compiled and un-compiled source code, to include all versions, maintenance updates, and patches.

Orientation phase and program to introduce government stakeholders, programs, and users to the contractor team, tools, methodologies, and business processes.

Transfer of GFE, GFI, and GFE inventory management assistance, to include obtaining, storing, and updating inventory within contractor’s maintenance management system.

On-boarding coordination with Government to account for badging of immediate personnel, system access, ID/access cards, and security codes.

Deliverable(s): Phase In Plan

1.7.2 Phase Out Plan and Continuity of Services: In accordance with this contract, the Contractor shall provide an

Outgoing Transition Plan for a 30-calendar day outgoing transition for transitioning work from an active contract to a follow-on contract/order or Government entity. This transition may be to a Government entity, another Contractor or to the awardee Contractor under a new contract/order. In accordance with the Government-approved plan, the

Contractor shall assist the Government in planning and implementing a complete transition from this Contract and/or orders issued under this Contract to a successful provider. This shall include formal coordination with

Government staff and successor staff and management. It shall also include delivery of copies of existing policies and procedures, and delivery of required metrics and statistics. This transition plan shall include, but is not limited to:

Coordination with Government representatives, Review, evaluation and transition of current support services, Transition of historic data to new Contractor system, to include maintenance and logistical data

Government-approved training and certification process, Transfer of hardware warranties and software licenses (if applicable)

Transfer of all necessary business and/or technical documentation, to include all drawings, Transfer of compiled and un-compiled source code, to include all versions, maintenance updates and patches (if applicable), Orientation phase and program to introduce Government personnel, programs, and users to the Contractor’s team, tools, methodologies, and business processes, Disposition of Contractor purchased Government owned assets, including facilities, equipment, furniture, phone lines, computer equipment, etc., Transfer of GFE, GFI, and GFE inventory management assistance, Applicable TMA debriefing and personnel out-processing procedures, and

Turn-in of all government keys, ID/access cards, and security codes.

Deliverable(s): Phase Out Plan

1.8 Management:

1.8.1 Program Management: The Contractor shall implement a Program Management structure to efficiently and effectively administer and oversee the ISSC program. This structure includes a central point of contact responsible

Contractor personnel supporting Information Assurance (IA) functions shall be appropriately certified in accordance with DoD Manual 8570.01-M prior to being assigned to this contract work or to perform any work on the ISSC systems. Contractor personnel who fail to maintain certification shall be removed from the contract. The Contractor shall be responsible for any retraining expenses required by the individual to meet certification requirements. All applicable certifications must be submitted at award and kept up to date.

1.8.6 Contractor Representatives: The Contractor shall provide an on-site person(s) who shall be physically present during normal duty hours to act as site supervisor(s), conduct total management coordination, and furnish liaison with the Government during system installation, maintenance, and repair.