21R2007_Attachment 1 - PWS_Rev1.pdf

CUI

ATTACHMENT 1 – PERFORMANCE WORK STATEMENT

(PWS)

FOR

REPAIR AND MAINTENANCE SERVICES FOR DIGITAL

MEDIA SYSTEMS (DMS) EQUIPMENT

Version 1.0

14 May 2021

Controlled by: MARCORSYSCOM

Controlled by: PfM CES, PM C2S

CUI Category: PROCURE

Dissemination Control: FEDCON

POC: CWO3 Wade Spradlin, 703-432-9904, wade.spradlin@usmc.mil

1.0 GENERAL. The DMS Project Office (PO) within Program Manager, Command and

Control Systems, is pursuing Professional Services to support Canon specific components.

Services are to include Preventative Maintenance, Checks and Services (PMCS), Help Desk, and

Corrective Maintenance (CM) for Canon components of fielded systems within the DMS program portfolio. The Expeditionary Combat Photography System (ECPS), Expeditionary

Combat Videography Systems (ECVS), Visual Information Acquisition System (VIAS) Family of Systems (FoS), and Public Affairs Live Media Engagement System (PALMES) are all-in-one deployable systems that enable imagery acquisition in daylight or low-light conditions, imagery processing and storage, and production and transfer capability in support of operational information-communication requirements. The ECPS, ECVS, VIAS FoS and PALMES consist of Canon digital cameras and an assortment of Canon fixed/zoom lenses to allow overlapping coverage. The Professional Services are required to extend the service-life of DMS fielded systems containing photo and video equipment.

1.1 SCOPE. The contractor shall provide repair and maintenance services that meet Canon’s standards for the components identified in Enclosures 1 and 2. In addition, the contractor shall provide Help Desk Services to enable Marines in the field to troubleshoot and possibly fix problems rather than having to turn in equipment for repair. Performance will take place at the contractor’s facilities, with considerations for dust, liquids and other environmental factors.

1.2 OBJECTIVE. Users of this contract are Marine Corps enterprise wide, both CONUS and

OCONUS, seeking support for the systems in paragraph 1.0. The required services for

Enclosures 1 and 2 components turned in shall include, but not be limited to, determination of applicable maintenance; servicing, repairing, preventative maintenance and cleaning the equipment, and updating any applicable firmware. PMCS or corrective maintenance of components will include replacing missing items, e.g., lens/dust cap, storage bag, buttons, etc.

2.0 APPLICABLE DOCUMENTS. The documents below form a part of this PWS to the extent specified herein. The most current version of referenced documents shall be used. The requirements contained in listed documents are contractually applicable to the extent the documents are specified in the text of this PWS.

2.1 Standards

MIL-STD-2073-1E DoD Standard Practice for Military Packaging

MIL-STD-1686C Electrostatic Discharge Control Program for Protection of

Electrical and Electronic Parts, Assemblies and Equipment

(Excluding Electrically Initiated Explosive Devices)

MIL-STD-129R Military Standard Marking for Shipment and Storage

NIST SP 800-171 Rev. 1 Protecting Controlled Unclassified Information in Nonfederal

Systems and Organizations

2.2 OTHER DOCUMENTS

ISO 9001 Quality Management Systems – Requirements

ISO-10012-1 Quality Management Systems – Requirements for Measuring

Equipment

ASTM D3951-98 Standard Practice to Commercial Packaging

2.3 AVAILABILITY OF DoD DOCUMENTS

Unless otherwise indicated, copies of specifications, standards and handbooks listed above are available from the Standardization Document Order Desk, 700 Robbins Ave, Bldg. 4D, Philadelphia PA 19111-5094 or at http://assist.daps.dla.mil.

3.0 REQUIREMENTS.

3.1 GENERAL. The contractor shall use experienced camera repair personnel that meets

Canon’s standards and provide the equipment, tools, materials, supervision, and services necessary to support the objectives and system components identified in this PWS. The contractor must provide preventative and corrective maintenance for Program Office fielded equipment. All labor and service parts, including consumable parts used in the repair or servicing, shall be included in the per item cost. Applicable CDRLs are:

A001 SYSTEM SECURITY PLAN with POAM (DI-?

A002 Contractor’s Record of Tier 1 Level Suppliers

B001 CONTRACTOR’S PROGRESS AND STATUS REPORT (DI-MGMT-81928)

3.1.1 REPAIR PROCESSING. The contractor shall provide a service program to cover all requested repairs (including, but not limited to, normal wear and tear, repair due to physical damage, and cleaning/maintenance) on every model listed in Enclosures 1 and 2, for the duration of the Period of Performance (PoP). Standard repair turnaround time shall not exceed 30 calendar days from the contractor’s receipt of the device to the return of the device to the

Reparable Issue Point (RIP). When the Program Office identifies and inducts an item for repair that is urgently needed, the contractor shall repair and return that item to its respective RIP within 5 days, for a CONUS address, and 10 days, for an OCONUS address. Any Program

Office approvals required by paragraph 3.1.1(b) below are still required. The contractor service program shall include the following:

a) The contractor shall repair the items listed in Enclosures 1 and 2.

b) If the contractor estimates a repair will exceed 85% of the item’s replacement cost, the item will be identified as being Beyond Economical Repair (BER). Whenever parts are unavailable due to obsolescence, the contractor will note that fact and identify the item as

BER. The contactor shall notify the Program Office in writing of any item designated as BER within 5 working days of the item’s BER designation. The Contracting Officer

Representative (COR) shall approve all items designated as BER and provide the contractor with instructions for disposition.

c) The contractor shall replace any part requiring replacement with a new, genuine Canon part, obtained from an authorized Canon reseller. Counterfeit or refurbished Canon parts are not acceptable. After-market parts for Canon items are also not acceptable.

d) The contractor’s service program shall cover, at a minimum, cleaning and maintenance of components of cameras and lenses, replacement of missing sub-components (caps, buttons, compartment covers), and cleaning and maintenance of internal components of the camera, to include image sensor, mirror, and focus screen. The service program shall also include removing internal dust or debris, making necessary autofocus adjustments, and calibrating the body and the lens.

3.1.2 PRIORITY TELEPHONE SUPPORT. The contractor shall operate and maintain telephone support for the specific purpose of assisting United States Marine Corps (USMC) customers in isolating, troubleshooting, and resolving issues with identified Canon components.

If telephonic support does not allow the USMC customer to restore operability to the affected component, the contractor must assist the USMC customer with detailed instructions to return the non-operable component to the contractor’s facility for repair.

a) The contractor shall respond to service calls during normal working hours, 0800 thru 1700 in the time zone where the contractor’s facility is located, Monday thru Friday, excluding

Government holidays. The contractor shall provide an alternative means to receive service calls during non-working hours to support USMC customers located in all time zones. A dedicated email address and answering services (both available for all times when the normal Help Desk is not available) are considered suitable alternatives.

b) The contractor shall respond to service calls within 1 day after notification and continue to correspond with the service requester until operation is restored to the affected item. The response time on a service call starts when authorized personnel notifies the contractor via service call, answering service, or email. Authorized personnel include COMMSTRAT Marines, Program Office representatives, Marine Corps Logistics Command representatives and

Reparable Issue Point representatives.

c) The contractor shall maintain records of all service-related communications and report service to the Program Office in the monthly Contractor Status Report (CDRL B001), including:

1. Time of notification

2. Date of notification

3. Names (person receiving the notice and person seeking assistance)

4. Reason for call, (to include model, part number and serial number)

5. Functional restoration time

6. Urgently needed repair, as necessary

7. Repair outcome or cleaning service

8. IUID mark affected by repair

3.1.3 The contractor shall also provide, in the monthly Contract Status Report (CDRL B001), information necessary for the DMS Project Office to track the number of items repaired, replaced, returned, and processed for USMC users by item type, to include the following:

1. Item nomenclature

2. Date of receipt of item

3. Marine requester unit ID

4. Reason for repair (to include model, part number and serial number)

5. Functional restoration time

6. Urgently needed repair procedures, as necessary

7. BER designation and outcome, as required

8. Repair or cleaning service

9. IUID mark affected by repair

10. Date of shipment back to requester.

4.0 SECURITY REQUIREMENTS.

The information provided to the contractor will be unclassified and Controlled Unclassified

Information (CUI). The contractor is not required or expected to have a Facility Clearance, and contractor personnel supporting this effort are not required to possess Personnel Clearance

Levels. Any contractor personnel requiring access to U.S. Government CUI shall possess a completed background investigation (minimum of a NACI) for this Public Trust Position.

5.0 CYBER SECURITY

5.1 SYSTEM SECURITY PLAN AND PLANS OF ACTION AND MILESTONES

(SSP/POAM) REVIEWS

a) Within 30 days of contract award, the contractor shall make its System Security Plan(s)

(SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense

Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The contractor shall fully cooperate in the Government’s review of the SSPs at the contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the contractor of each identified deficiency. The contractor shall correct any identified deficiencies within 30 days of notification by the Government. The contracting officer may provide for a correction period longer than 30 days and, in such a case, may require the contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the contractor s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every 3 years (measured from the date of contract award) and may conduct such reviews at any time upon 30 day notice to the contractor.

The applicable CDRL is A001 SSP with POAM

5.2 COMPLIANCE WITH NIST 800-171

a) The contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1)

(NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

1) Implement Control 3.5.3 (multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

4) Audit user privileges on at least an annual basis;

5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

6) Implement Control 3.13.16 (protect the confidentiality of CUI at rest) or provide a POAM for implementation, which shall be evaluated by the Navy for risk acceptance.

7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program

A002 Contractor’s Record of Tier 1 Level Suppliers

5.3 CYBER INCIDENT RESPONSE:

a) The contractor shall, within 15 days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes

Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Me.... In delivery of the incident data, the contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the contractor subsequently identifies any such data not previously delivered to DC3, then the contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within 10 days of identification. In such a case, the contractor may request a delivery date later than 10 days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

A003 Cyber Incident Reporting

5.4 NAVAL CRIMINAL INVESTIGATIVE SERVICE (NCIS) OUTREACH

The contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5.5 NCIS/INDUSTRY MONITORING

a) In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the contractor shall cooperate with the Naval Criminal

Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the contractor's infrastructure systems; and the continuous provision of all contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the contractor's information systems or information technology assets.

The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the contractor. In the alternative, the contractor may install network sensor http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

ENCLOSURES

Enclosure 1. Identified Authorized Components, Ordering Period 1

Enclosure 2. Identified Authorized Components, Ordering Periods 2 and 3

Enclosure 1. Identified Authorized Components

Ordering Period 1

Canon Part

Number Item OEM Qty

1 5253B002 EOS 1DX Canon 248

2 9389B002 Macro Ring Lite MR-14EX II Canon 200

3 4410B002 Extender EF 2X III Canon 132

4 2515A003 EF 50 1.4 USM Canon 252

5 5175B002 EF 24-70 2.8L II USM Canon 420

6 2751B002 EF 70-200 2.8L IS II USM Canon 420

7 1056B002 EF 85 1.2 L II USM Canon 136

8 3554B002 EF 100 2.8 L MACRO IS USM Canon 136

9 4427B002 EF 8-15 4L USM (Fisheye) Canon 136

10 9322A002 EF 28-300 3.5-5.6 L IS USM Canon 136

11 0202C002 EOS C100 MK II Canon 256

12 8443B002 XA25 Canon 16

13 2217C002 XA15 Canon 16

14 3075C002AA EOS R Mirrorless Digital Camera Canon 147

15 2965C002AA RF 28-70mm F2 L USM Canon 147

16 3684C002AA RF 24-240mm F4-6.3 IS USM Canon 147

17 3666C002AA XA40 UHD 4k Camcorder Canon 147

18 2972C002AA Control Ring Mount Adapter EF-EOPS R Canon 147

19 4147C002 EOS R5 Mirrorless Digital Camera Canon 133

20 3092C002 RF 70 -200mm F2.8L IS USM Canon 133

Enclosure 2. Identified Authorized Components

Ordering Periods 2 and 3

Canon Part

Number Item OEM Qty

1 2217C002 XA15 Canon 16

2 3075C002AA EOS R Mirrorless Digital Camera Canon 147

3 2965C002AA RF 28-70mm F2 L USM Canon 147

4 3684C002AA RF 24-240mm F4-6.3 IS USM Canon 147

5 3666C002AA XA40 UHD 4k Camcorder Canon 147

6 2972C002AA Control Ring Mount Adapter EF-EOPS R Canon 147

7 4147C002 EOS R5 Mirrorless Digital Camera Canon 133

8 3092C002 RF 70 -200mm F2.8L IS USM Canon 133