Solicitation_M6700119Q1241_ICS_Cyber_Security.docx

M6700119Q1241

Section SF 1449 - CONTINUATION SHEET

ADP BACKUP & SECURITY SERVICES

FFP

Contractor shall provide Cybersecurity engineering support to assist the ICS/OT ISSM with the review and integration of Camp Lejeune's Wastewater/Water Treatment Plant and High Voltage SCADA Systems into the Marine Corps Compliance and Authorization Support Tool (MCCAST) package for the purpose of maintaining an Authority to Operate (ATO) in accordance with the Performance Statement of Work.

FOB: Destination

MILSTRIP: MMP10019SSFM051

PURCHASE REQUEST NUMBER: MMP10019SSFM051

PSC CD: D310

NET AMT

FFP

Contractor shall provide Cybersecurity engineering support to assist the ICS/OT ISSM with the review and integration of Camp Lejeune's Wastewater/Water Treatment Plant and High Voltage SCADA Systems into the Marine Corps Compliance and Authorization Support Tool (MCCAST) package for the purpose of maintaining an Authority to Operate (ATO) in accordance with the Performance Statement of Work.

FOB: Destination

NET AMT

FFP

Contractor shall provide Cybersecurity engineering support to assist the ICS/OT ISSM with the review and integration of Camp Lejeune's Wastewater/Water Treatment Plant and High Voltage SCADA Systems into the Marine Corps Compliance and Authorization Support Tool (MCCAST) package for the purpose of maintaining an Authority to Operate (ATO) in accordance with the Performance Statement of Work.

FOB: Destination

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

DELIVERY INFORMATION

31-AUG-2020

CLINTON THOMPSON

BLDG 1005 MICHEAL RD

G-F DEPT

CAMP LEJEUNE NC 28542

910-451-0867 FOB: Destination M67001

31-AUG-2021

M67001

31-AUG-2022

M67001

PERFORMANCE WORK STATEMENT

PUBLIC WORKS DIVISION

INDUSTRIAL CONTROLS SYSTEMS (ICS) SUPPORT SERVICES

1.0 INTRODUCTION

The G-F Dept., Public Works Division (PWD), has a requirement for non-personal support services to assist the PWD Industrial Controls Systems (ICS) program in the operation, management, cybersecurity, optimization, and maintaining accreditation of the ICS including the information technology (IT) assets required for these tasks.

2.0 PERIOD OF PERFORMANCE

The period of performance is a base year, 01 September 2019-31 August 2020 plus two 12-month option periods.

3.0 PLACE OF PERFORMANCE

Marine Corps Base Camp Lejeune, NC, other government satellite activities, and contractor facilities

4.0 CONTRACTOR RESPONSIBILITIES

The Contractor shall manage the total work effort associated with ICS cybersecurity and management support services and all other functions required for satisfactory and timely completion of these services. The Contractor shall provide personnel with the necessary technical and management expertise, training, and certifications to ensure the performance of the work in accordance with this statement of work. The contractor shall also provide Cybersecurity engineering support to assist the ICS/OT ISSM with the review and integration of Camp Lejeune's Wastewater/Water Treatment Plant and High Voltage SCADA Systems into the Marine Corps Compliance and Authorization Support Tool (MCCAST) Package for the purpose of maintaining an Authority to Operate (ATO).

Due to the continuous nature of this requirement, the government requires the contractor to maintain the proposed workforce at 100% manning. As such, the contractor is expected to develop a manning plan to fill any planned or unplanned vacancies on an expedited basis. Any vacancies that occur in the contractor’s proposed manning should be filled within 30 calendar days. Any manning vacancies that remain unfilled after 30 days will have an invoice offset calculated using the total proposed daily cost (including profit and overhead) for the position left vacant (based on a 30 day month) times the number of vacant days in the billing cycle plus an additional 10% of the cost calculated.

The contractor shall provide properly equipped personnel to complete the requirements below.

4.1 Provide Cybersecurity and USMC Assessment and Authorization (A&A) expertise including:

· Provide MCCAST 2.0 support in the creation and management of the “Type” accreditation package for Industrial Control Systems/Operational Technology (ICS/OT) in the USMC.

· Provide technical assistance with the Risk Management Framework (RMF) for DoD Information Technology (IT) and the MCCAST 2.0 for maintaining Authorization to Operate (ATO) for ICS. Information available at Http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf .

· Provide expertise with all facets of the Certification and Accreditation / Assessment & Authorization (C&A/A&A) process to include supporting the Designating Approval Authority/Authorizing Official (DAA/AO), Certifying Authority (CA), and guiding customers thorough the A&A process.

· Provide expertise in the USMC A&A process to include MCCAST 2.0, RMF, Defense-in-Depth Functional Implementation Architecture (DFIA), and CNSSI 1253.

· Develop and update policies required for the PWD ICS/OT accreditation package.

· Develop and maintain all required procedures for the cybersecurity of all hardware and software required for accreditation and continued operations.

4.2 Inspect and verify functionality and performance of building controls installations including:

· Verify all details of the installation to meet project requirements, Direct Digital Control (DDC) specifications and manufacturer’s recommendations and requirements. Communicate deficiencies and corrective actions to all necessary parties.

· Provide the ability to program and reverse engineer field controllers of most major control’s manufacturers at multiple software/firmware revisions.

· Provide support for JACE and NxE Supervisory controllers including the ability to program both types at multiple software/firmware revisions.

· Provide personnel with knowledge of electrical and mechanical trades and code requirements.

· Provide personnel with a thorough understanding of the federal government 23-09-23.13 DDC Specifications, an ability to interpret and explain all sections of the specification, knowledgeable of installation and operation requirements, and understanding of when to recommend modifications to the specifications.

· Assist in troubleshooting and investigation of ICS-related events, equipment issues, or system performance issues.

· Assist in commissioning and re-commissioning of existing and new facilities.

· Directly support Camp Lejeune Public Works Operations, Design Branch, ROICC office and NAVFAC as required.

· Provide personnel with the ability to write repair scopes, sequence of operations, and requirements for repair of building controls systems and who can assist with managing projects, coordination of the trades, and all that is involved in executing the work.

· Provide personnel with knowledge of building controls performance verification testing, commissioning procedures, performance indexing and analytics used to verify and ensure specifications and requirements are met.

· Attend and prepare necessary materials for PWD’s Monthly Energy Meetings and other periodic ICS related meetings as required.

4.3 Provide expertise in CLNC secure networking architecture and design including:

· Provide expertise in the installation and set-up of multiple Nutanix Hyper-Converged Technology Platforms for the USMC.

· Maintain the master ICS Network Data spreadsheet, which includes BBMD addressing, network IP assignments, and BACnet instance numbers.

· Support the configuration management of the accreditation package including the Change Control Board (CCB).

4.4 Maintain the ICS/OT test bed including:

· Verify the integrity of all new patches and updates and test them in the testbed prior to updating the operational equipment.

· Maintain the Nutanix Hyperconverged Virtualized environment.

4.5 Support Data Center operations including:

· Host Based Security System (HBSS) and Common Access Card (CAC) integration of the servers

· Provide configuration/patch management of all PWD ICS/OT and IT Microsoft Windows components

· Manage administration and security of SQL server

· Process automation with PowerShell

5.0 DELIVERABLES

5.1. Develop and deliver a bi-monthly ICS Status Report. The ICS Status Report shall include details on the work performed during the period of performance such as: number of buildings integrated into ICS, status of on-going integration efforts, commissioning and re-commissioning efforts, load shedding efforts, ICS software and technological news, necessary training, and other pertinent information.

5.2. Provide reports and alarms automatically generated through the ICS and monthly reports of identified issues/corrections through the commissioning and re-commissioning process to PWD Operations and Design staff. The support personnel shall assist in the development of work request and project documentation and assist in the identification of ICS/HVAC maintenance priorities from these reports.

5.3. Steward and provide their expertise/ assistance with system integration during the design process, prior to Beneficial Occupancy Date (BOD), and during the BOD process.

5.4. Test and inspect the building DDC/ HVAC system for proper interoperability of data sharing, alarm and event management, trending, scheduling, and device naming into the ICS system. Provide the government a list of discrepancies for corrective action required by installing contractor prior to BOD.

6.0 PERSONNEL QUALIFICATIONS AND CERTIFICATIONS FOR CONTRACTOR SUPPORT PERSONNEL:

6.1 The contractor shall be capable of communicating (oral and written) fluently in English.

6.2 Contractor employees that operate motor vehicles shall maintain a valid state driver’s license with all class and commodity endorsements required by Public Law 99-570 and state law for the type of vehicle operated.

6.3 A Secret Security Eligibility is required for this position. The individual contractor must be able to have a favorable adjudicated T3 background investigation. The contractor is responsible to ensure the personnel furnish documentation reflecting favorable adjudication of background investigations for all personnel supporting the Industrial Control System (ICS). The ICS resides on the Marine Corps MRAN and work performed on this system requires occasional access to workstations located in the MITSC area located in Building 24. The MITSC area has restricted access and the work performed on the ICS in this area by the contractor is designated Low Risk Non-Critical Sensitive. This designation requires a national security background investigation designated as T3. Final DD254 will be included separately via email.

6.4 Personnel minimum education/experience/ credentials/qualifications.

6.4.1 Key Billets:

ICS/OT Inspector/Integrator

· Experience installing Metasys on servers and building graphics/trends/alarms/scheduling.

· Experience in ICS control systems -Metasys, Niagara AX platform, Alerton, Honeywell, Trend, KMC, and American Automatrix and Loytec.

· Experience in BACnet/MSTP, BACnet over IP, N2 and LON.

· Experience in preforming software security updates, system patches, software patches, and version upgrades on Metasys, Niagara, Itron, and Honeywell software products.

· Experience installing software and maintaining Itron Fixed-Network meter data collection systems.

Cybersecurity Architect

· Master’s Degree or 15 years C&A/A&A experience.

· Certified USMC Validator.

· Expert in the USMC A&A process (USMC/DoN/DoD Cybersecurity RMF/A&A experience) to include MCCAST 2.0, RMF, DFIA, and CNSSI 1253.

· CNSS 4011, 4012, 4015, 4016A (Required). IAM Level 3 (CISSP Desired),

· Experience creating/managing POAMs.

· Experience with DISA STIGs.

· Experience interpreting/implementing standards and policies in accordance with NIST 800-53/DoDI 8510.01

· Experience with vulnerability/risk analysis.

· Experience conducting compliance assessments/validations as well as conceptualizing and implementing security systems and architectures.

· Professional Certifications (Required):

· CompTIA Security+ or

· CompTIA CASP or

· Certified Information System Security Professional (CISSP)

· ICS CERT Training (Desired):

· Introduction to Control Systems Cybersecurity (101)

· Intermediate Cybersecurity for Industrial Control Systems (201)

· Intermediate Cybersecurity for Industrial Control Systems (202) - ICS Cybersecurity (301)

6.4.2 Non-Key Billets. Collectively, the other team (non-key billets) members will meet the following requirements:

· Experience in the use of SQL and Microsoft Sever software (current versions).

· Experienced in the use and administration of Nutanix Hyperconverged virtualized environments.

· Experience in Marine Corps Certification and Accreditation Support Tool (MCCAST V2).

· Electronic and electrical background experience is a plus.

· Knowledgeable of electrical and mechanical trades and code requirements.

· Knowledge of TCP/IP, information security/authorization profiles, or security administration of Unix or Windows network/systems

· Experience with HBSS

· ICS CERT Cybersecurity Training

0. The contractor shall act and dress professionally at all times. Professional dress is defined as clothing that is neat, clean, and in good repair. Clothing that exposes cleavage, midriff or undergarments is not professional dress.

0. Contract services require travel throughout Camp Lejeune and Marine Corps Air Station, New River, NC and their satellite activities located within 50 miles of the Camp Lejeune main gate. Travel between the different locations is considered inherent to the support services detailed in the PWS and will not be reimbursed.

0. The Contractor shall be responsible for obtaining all necessary licenses and certifications and for complying with all applicable Federal, State, and local laws. The Contractor shall maintain updated copies of any applicable licenses and certifications for all employees and make them available to the Government upon request.

0. Environmental, Safety, and Occupational Health (ESOH)

0. The Contractor shall formulate and maintain a written safety and health plan and make it available to the Government upon request. The written plan shall include the details of the Contractor’s responsibilities, method of program implementation, and how hazards and deficiencies shall be identified and corrected. It shall detail contractor personnel responsibilities for: protection of Government property and safety of others, personnel responsibilities for reporting all mishaps, and establish procedures for reporting to correcting unsafe conditions, hazards, or practices.

0. The Contractor shall notify the Contracting Officer Representative immediately after the occurrence of all accidents and incidents resulting in either personal injury, loss of life, impact to the environment or property damage to a government facility or equipment. The contractor shall submit a completed copy of and supplemental information within four (4) working days of the accident or incidents.

0. The Contractor shall comply with all federal, state, and local environmental laws.

0. The Contractor shall participate in emergency and recall notification and personnel accountability exercises. The Contractor shall establish emergency notification and recall and personnel accountability procedures in accordance with DoDI 3001.02, Personnel Accountability in Conjunction with Natural or Manmade Disasters, and test those procedures twice a year when directed.

0. The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 August 2004 has established criteria for contractors who require a Common Access Card (CAC) for either physical access to a U.S. Government controlled installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and/or are eligible for a public trust position.

7.0 Non-personal Service Statement. Contractor employees performing services under this order will be controlled, directed, and supervised at all times by management personnel of the contractor. Contractor management will ensure that employees properly comply with the performance work standards outlined in the statement of work. Contractor employees will perform their duties independent of, and without the supervision of, any Government official or other Defense Contractor. The purchases, duties, and responsibilities set forth in the purchase order may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work

8.0 The Contractor agrees to assign to the contract personnel as required by the RFQ, to fulfill the requirements of the contract. No substitution of personnel shall be made except in accordance with the information specified herein. The Contractor agrees that during the performance period no personnel substitutions will be permitted without approval of the CLNC PWD Technical Representatives (Director, Maintenance Operations, Public Works, G-F, MCI EAST-MCB, Camp Lejeune, NC) unless such substitutions are necessitated by an individual's sudden illness, death or termination of employment. In any of these events, the Contractor shall promptly notify the Contracting Officer’s Representative (COR) and provide the information required by the following paragraphs.

If the personnel, for whatever reason, become unavailable for work under the contract for a continuous period exceeding 14 working days the Contractor shall propose a substitution of such personnel. All proposed substitutions shall be submitted, in writing, to the COR within 15 days of identification of the need for a substitute. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute and any other information required by the Contracting Officer to approve or disapprove the proposed substitution. All proposed substitutes shall have qualifications that are equal to or higher than the qualifications of the person being replaced.

The COR shall evaluate the requests for substitution and promptly notify the Contractor, in writing, of whether the request is approved or disapproved. If the COR determines that suitable and timely replacement of personnel who have been reassigned, terminated or have otherwise become unavailable to perform under this purchase order is not reasonably forthcoming or that the resultant reduction of productive effort would impair the successful completion of the contract, the contract may be terminated by the Contracting Officer for cause or for the convenience of the Government, as appropriate. Alternatively, at the Contracting Officer's discretion, if the Contracting Officer finds the Contractor to be at fault for the condition, he may equitably adjust (downward) the contract price to compensate the Government for any delay, loss or damage as a result of the Contractor's action.

9.0 CONTRACTOR’S UNAUTHORIZED WORK PERFORMANCE

The contractor shall not perform work that deviates from contract requirements and specifications. If the contractor deviates from contract requirements and specifications without approval of the CONTRACTING OFFICER, such deviation shall be at the risk of the contractor and any cost related thereto shall be borne by the contractor.

10.0 LIABILITY, AUTOMOBILE AND WORKMAN’S COMPENSATION INSURANCE

The contractor shall comply with provisions and requirements as contained herein:

10.1 Required Insurance (IAW FAR 28.306 (b) The contractor shall maintain insurance in the minimum amount specified below and as required by FAR 52.228-5, Insurance – Work on a Government Installation”, at its own expense, procure and thereafter maintain the following kinds of insurance with respect to performance under this contract.

1. Workmen’s Compensation and Employers Liability Insurance as required by law except that if this contract is to be performed in a state which does not require or permit private insurance, then compliance with the statutory or administrative requirements in any such state will be satisfactory. The required Workmen’s Compensation insurance shall extend to cover Employer’s liability for accidental bodily injury or death and for occupational disease with a minimum liability limit of $100,000.

1. General Liability Insurance. Bodily injury liability insurance, in the minimum limits of $100,000 per person and $500,000 per occurrence shall be required on the comprehensive form of the policy.

1. Automobile Liability Insurance. This insurance shall be required on the comprehensive form of the policy and shall provide injury liability and property damage liability covering the operation of all automobiles used in the connection with the performance of the contract. At least the minimum limits of $200,000 per person and $500,000 per occurrence for bodily injury and $20,000 per occurrence for property damage shall be required.

11.0 CERTIFICATE OF INSURANCE REQUIRED

In accordance with the clause entitled “Insurance-Work on a Government Installation” (FAR 52.228-5), the contractor shall furnish to the Contracting Officer, a certificate or written statement of insurance prior to commencement of work under the contract. The contract number shall be cited on the certificate

12.0 GOVERNMENT RESPONSIBILITIES

The Government activity will provide adequate working space, all equipment as required (e.g., desk, chair, computer, printer, copier, telephone, etc.). utilities, janitorial services, and expendable operating supplies for the duration of this purchase order. The contractor shall maintain the assigned office space and work areas in a neat and orderly manner. Contractor shall not remove any government-furnished equipment or supplies from the Government compound without the express written permission. The Government will provide the contractor with all the information needed for performance including desired formats and samples.

13.0 GOVERNMENT HOURS OF OPERATION

The Government hours of performance are 0730-1600, Monday through Friday. The contractor employees’ hours of performance shall be determined by the contractor.

The Federal holiday observed by the base during this contract’s period of performance is Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day, New Year’s Day, Birthday of Martin Luther King, Jr., George Washington’s Birthday, Memorial Day, and Independence Day.

The contractor is responsible for maintaining the acceptable quality level of performance as required by the PRS during vacation periods for support personnel. The determination of how to do that is the Contractor’s responsibility.

If coordination of support services is required the Government point of contact will be with the Contracting Officer’s Representative or the Deputy, Maintenance Operations Officer.

14.0. QUALITY ASSURANCE SURVEILLANCE PLAN. The government shall monitor Contractor(s) performance in accordance with the Quality Assurance Plan (QASP).

14.1 A Quality Assurance Surveillance Plan (QASP) has been developed and will be applied in the administration of the EMCS support service contract to ensure Performance Work Statement (PWS) services meet the Government’s technical requirements for quality and completeness at the cost and within the timeframes established by the contract.

14.2 This plan outlines procedures and guidelines that will be used to monitor the Contractor’s compliance with submitting deliverables and ensure all work is in accordance with the contract requirements. The Contractor is the owner of the quality control process and is responsible for developing, implementing, and modifying procedures that will produce the desired outcomes and result in performance of work within the required standards. The intent of the QASP is to ensure that the Contractor is complying with its quality control systems.

14.3 This QASP is intended to provide the Government’s Contracting Officer’s Representative (COR) an effective and systematic method of surveillance for each service in the PWS. The Government resources shall have responsibilities for the implementation of this QASP as follows:

Contracting Officer – The Contracting Officer ensures performance of all necessary actions for effective contracting, ensures compliance with the terms of the contract, and safeguards the interests of the United States in the contractual relationship. It is the Contracting Officer that assures the Contractor receives impartial, fair, and equitable treatment under the contract. The Contracting Officer is ultimately responsible for the final determination of the adequacy of the Contractor’s performance.

Contracting Officer’s Representative (COR) – The COR is responsible for technical administration of the contract and assures proper Government technical surveillance of the Contractor’s performance. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf. Any changes that the Contractor deems may affect contract, price, terms, or conditions shall be referred to the Contracting Officer for action.

14.4 The COR will conduct an initial review of the Contractor’s quality control process to verify its adequacy. During the course of service performance, the COR will monitor the process for managing performance in a quality, timely, complete, safe, and cost-efficient manner. Level of surveillance will initially be set to assure the COR that requirements of the PWS are being met and that a process exists and is in place to ensure quality. If, during the course of this surveillance, the COR discovers the service provider is not complying with the established level of quality, the COR may increase the level of surveillance. If performance exceeds the established level of quality, the COR may decrease the level of surveillance. All documents to support methods of surveillance shall be filed in a Quality Assurance file for the contract.

The COR will act as the Contracting Officer‘s representative for technical matters, providing technical direction and discussion as necessary with respect to the specification or statement of work, and monitoring the progress and quality of contractor performance. The COR is not an Administrative Contracting Officer and does not have the authority to take any action, either directly or indirectly, that would change the pricing, quantity, quality, place of performance, delivery schedule, or any other terms and conditions of the contract, or to direct the accomplishment of effort which goes beyond the scope of the statement of work in the contract.

When, in the opinion of the contractor; the COR request effort outside the existing scope of the contract, the contractor shall promptly notify the Contracting Officer in writing. No action shall be taken by the contractor under such direction until the Contractor Officer has issued a modification to the contract (or delivery order) or has otherwise resolved the issue.

In the absence of the COR named above (due to reasons such as leave, illness, or official travel), all responsibilities and functions assigned to the COR shall be the responsibility of the Contract Specialist acting on behalf of the COR.

The name of the COR for this contract will be provided at the time of contract award via separate email.

14.5 Methods of Surveillance. The methods of surveillance identified in this QASP which will be used to monitor performance of this contract for quality, timeliness, completeness, and cost.

15.0 PERFORMANCE REQUIREMENTS SUMMARY

The performance standards for this Performance Work Statement (PWS) are stated in the Performance Requirements Summary (PRS) included in the PWS. The COR will assess the Contractor’s performance to ensure the Contractor is performing up to the specified standard.

Performance Objective

Level (AQL)/Frequency

Submittal of Monthly Reports of Identified Issues/Corrections

PWS Section 5.2

Submittal of Bi-Monthly ICS Status Report

PWS Section 5.1 100% Submitted in accordance with PWS and QASP

100%

Test and Inspection of BLDG DDC/HVAC

PWS Section 5.4 100% Submitted in accordance with PWS and QASP

100%

Termination of contract after 90 days, if any position remains unfilled.

16.0 ORGANIZATIONAL CONFLICTS OF INTERESTS

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR.

If performance of any PWS requires the contractor (to include subcontractors) to supply technical support related to systems or projects with which the contractor is already directly concerned, either by prime or subcontract, the contractor shall so immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found. The Contractor shall not undertake performance of any PWS that requires it to supply technical support regarding such systems until the notice is given, and written consent to proceed is issued by the Contracting Officer.

17.0. BASE ACCESS

17.1 Please contact the Contractor Vetting Office at 910-451-0283/0284/0285 for enrollment in DBIDS

17.2 DBIDS credentials will be valid for the duration of your contract, not to exceed three years; however, re-vetting of individuals’ information will occur each year.

17.3 Contractors requiring access for over 60 days will receive a credential valid for up to one year.

17.4 Contractors requiring access for less than 60 days will receive a temporary paper pass.

18.0 CONTRACT ADMINISTRATION OFFICE. All contract administration functions will be retained by the Contracting Department, MCB, Camp Lejeune. All inquiries and correspondence concerning the administration of the contract shall be addressed to:

19.0 INVOICES. Contractor shall use USMC Wide Area Workflow as stated in clause DFARS 252.232-7006.

CLAUSES INCORPORATED BY REFERENCE

CLAUSES INCORPORATED BY FULL TEXT

52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (JUN 2016)

(a) Definitions. As used in this clause--

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

52.212-2 EVALUATION--COMMERCIAL ITEMS (OCT 2014)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

This is a request for OPEN MARKET PRICED quotes. The proposed acquisition is 100% set-aside for Small Business. The associated North American Industrial Classification System (NAICS) Code is 541513 Computer Facilities Management Services and the associated size standard is $27.5 million.

BASIS OF AWARD: The Government will solicit and award this contract using simplified acquisition procedures, in accordance with FAR Part 12 and Subpart 13.5.

The term “offeror” or “offer” as used in FAR 52.212-1 shall be understood to mean “Quoter” and “quote,” respectively. Further, the term “award” shall be understood to describe the Government’s issuance of a purchase order in response to a request for quotes (RFQ).

Quotes shall be received by the Contracting Department by 11:00 am (EST), on 22 July 2019, to be considered for award. Vendor may send quotes, via e-mail, to Tracy.Fulks@usmc.mil, or the quotes may be mailed, shipped or faxed to (910) 451-2193. All portions of the quote, even those submitted separately via mail, fax, courier, email, or other shipment shall also be received by 11:00 am (EST), on 22 July 2019. The information submitted shall be clear and legible (Note: repetitively copied data loses its clarity and legibility). The address for submitting quotes, via United States Postal Service (USPS) is: Contracting Department, Attn: Tracy Fulks, PSC Box 8368, Camp Lejeune, NC 28547. If the method for submitting a quote is courier service, the delivery address is: Contracting Department, Attn: Tracy Fulks, Bldg. 1116, Birch Street, Marine Corps Base, Camp Lejeune, NC 28547-8368. The technical quote is to be submitted with vendor’s identifying information ONLY on the cover page of the technical quote. Failure to follow this instruction may result in rejection of the quote.

All questions shall be submitted to Tracy.Fulks@usmc.mil via email only NLT 03 July 2019.

The Government will not accept questions after 03 July 2019, 11:00 am, EST.

The basis of the award is “Best Value” to the Government. The Government will issue a single firm fixed-price purchase order on an "all or none" basis. However, the Government reserves the right to award no contract at all, depending on the quality of the quotes submitted. The Government will award a single contract resulting from this request for quotes to the responsible vendor whose quote, conforming to the RFQ; will be most advantageous to the Government, price and other factors considered. Quotes will be evaluated in an efficient and minimally burdensome fashion. The Contracting Officer reserves the right to evaluate quotes without the use of formal evaluation procedures such as establishing a competitive range, conducting discussions, scoring quotations, and to make an award to other than the lowest quote.

Evaluation Factors: (1) Technical Capability to include Management Approach, Hiring, Staffing Plan with Resumes, and ability to provide personnel on the first day of the period of performance; (2) Past Performance; and (3) Price.

Quotes will be evaluated using a price/technical tradeoff. This process is appropriate because it is in the Government’s best interest to consider award to other than the lowest price. When combined, all non-cost factors are significantly more important than the price. In evaluating the technical portion of the quote, the technical evaluators will evaluate the following factors and subfactors as described in the “Basis of Award”. The factors of Technical Capability and Past Performance are weighted equally. All technical subfactors are weighted equally. Technical Capability and Past Performance, when combined, are significantly more important than the price

EVALUATION. Vendors responding to this announcement shall submit their quote in accordance with FAR 52.212-1. Submission of quote shall include the following:

Technical Capability – Factor 1

Technical and Management Approach – The offeror’s technical and management approach shall, at a minimum, address each of the following factors separately, as they apply to the Performance Work Statement (PWS). All offerors’ quotes will be evaluated using the following criteria. The quote must include a comprehensive and expanded explanation of how each of the following factors would be satisfied. Merely restating the PWS requirement is not acceptable.

· Sub factor A: Demonstrates an acceptable work accomplishment plan to perform the work with properly qualified individuals and a thorough understanding of the PWS. This shall also include an explanation as to how the contractor will comply with the Acceptable Quality Level in the Performance Requirements Summary (PRS). Each quote will be evaluated to determine the adequacy of the contractors proposed plans, methods and procedures to accomplish the tasks contained in the PWS. Each quote will be evaluated for their completeness in addressing all areas contained in the PWS, their demonstrated understanding of the scope of the PWS, and their adequacy in proposing a work plan that will meet the Government’s requirement.

· Sub factor B: Provides an organization chart and clearly describe how proposed staffing shall fulfil the requirements and tasks stated in the PWS and how the work will be accomplished utilizing this staffing. Address all functional areas, detailing clear lines of authority and roles and responsibilities of the program manager, other key personnel. Describe interfaces among management and technical staff. Describe how you will lead, manage, and maintain visibility, quality, and control over all functional areas and levels. The Vendor shall submit an approach for structuring, staffing and retaining personnel to effectively accomplish the work under this contract.The approach shall also include the vendor’s approach for effectively hiring, utilizing key personnel to plan, control, direct the labor force, accomplish the services to meet the requirements of the performance work statement and ability to begin services by 01 September 2019.

· Sub factor C: Submit resumes and any other information for personnel, that demonstrate their experience and qualifications to perform the duties of this contract as stated in the PWS

2) Past Performance- Factor 2.

The Government will not consider nor evaluate past performance that concluded more than three years from the original solicitation release date. Relevant contracts include IT Services of similar size and scope to the requirements listed in the Statement of Work (SOW). Only the following entities will be used in the past performance evaluation: (a) the prime contractor; and (b) entities that perform at least 30% of the proposed total price for the contract, also referred to as principal subcontractors and other principal entities.

The purpose of the past performance evaluation is to assess the degree of confidence the Government has in The vendor’s ability to provide this service that meet the solicitation requirements based on The vendor’s demonstrated record of performance.

For this volume, The vendor shall identify relevant contracts, or those portions of a relevant contract, whose performance is within three years of the proposal due date and contains efforts similar to those efforts (e.g., service, type effort, contract tasks, contract type, contract dollar value, etc.), required by this solicitation. Offerors shall also identify relevant contracts within the past three years that had any show-cause notices, cure notices, corrective action reports or termination for default.

Contract Performance Assessment Reports (CPARs) and Questionnaires (Attachment 1) will be the primary customer feedback data used to evaluate The vendor’s past performance. The Past Performance Information Reporting System (PPIRS) will be the primary paperless method used to retrieve the CPARS for this source selection. For all contracts identified that do not have a CPARS, The vendor shall forward a copy of Past Performance Questionnaire (Attachment 1) to that contract’s Procuring Contracting Office (PCO), Administrative Contracting Officer (ACO), and Program Manager (PM). Please forward all questionnaires within two weeks from this solicitation’s release date to allow adequate time for the recipient to respond. Note that The vendor should not reference this solicitation’s number when distributing the past performance questionnaires to customers. The vendor shall include instructions for the customers to send completed questionnaires within two weeks of its receipt via e-mail to Ms. Tracy Fulks, at Tracy.Fulks@usmc.mil or via fax to (910) 451-2191. The vendor shall ensure that all points of contact are current and include an email address and phone number. The vendor shall not conduct follow-up actions with regard to this questionnaire, other than to confirm receipt by the recipient. The Government may contact customers identified by The vendor to obtain follow-up Past Performance Information as needed.

Vendors lacking relevant past performance history will not be evaluated favorably or unfavorably on past performance and will receive a neutral rating.

Offerors are reminded that the Government reserves the right to use information to evaluate past performance obtained from sources other than those identified by The vendor. The Government may send additional questionnaires and/or obtain information from sources identified by the Government evaluation team.

NO MORE THAN A TOTAL OF THREE (3) PAST PERFORMANCE REFERENCES WILL BE ACCEPTED

3) Price. To evaluate price, quotes will be evaluated using a price/technical tradeoff.