M6785423R4907 Amendment 0002_20June2023.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to: 1) Update Table 1 in SOW 1.5.9; 2) Update Attachment 8 Existing Telecomm and Netw ork

Infrastructure, Attachment 12 PDO SOW MCI West, and Attachment 13 RDSD Current PON Netw ork and Expected Grow th; and 3) Provide responses to industry solicitation questions.

The Solicitation close date of 11 July 2023 has not been extended as a result of this amendment.

1. CONTRACT ID CODE PAGE OF PAGES

1 50

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 20-Jun-2023

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X M6785423R4907

X 9B. DATED (SEE ITEM 11)

10-May-2023

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

20-Jun-2023

CODE

COMMANDER MARINE CORPS SYSTEMS COMMAND

2200 LESTER STREET

QUANTICO VA 22134

M67854 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

M6785423R4907

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

Program Executive Office for

Digital & Enterprise Services (PEO Digital)

Base Area Network (BAN) Telecommunications and Network Infrastructure Modernization

Statement of Work (SOW)

Prepared By:

United States Marine Corps

Program Executive Office, Digital and Enterprise Services Infrastructure Services, Transport and

Communications

SECTION 1

GENERAL INFORMATION

1. GENERAL

This is a multiple award, Indefinite Delivery/Indefinite Quantity (IDIQ) contract for the PEO Digital Infrastructure

Services Transport and Communication (ISTC) Program Office to modernize and refresh the Marine Corps telecommunications and network infrastructure. This IDIQ contract will also provide the ability to support individual equipment procurement actions and future capabilities.

The Government will describe the specific performance requirements at the delivery order level, but all work performed will fall within the general scope described herein.

1.1 DESCRIPTION OF SERVICES/INTRODUCTION

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the refresh and/or modernization as defined in this SOW except for those items specified as Government Furnished Property (GFP) and services at the order level. The Contractor shall perform to the standards articulated in this contract.

1.2 BACKGROUND

The United States Marine Corps (USMC) Network Modernization Plan V2.2, dated June 2021 initiated and intended to transform the Marine Corps Enterprise Network (MCEN) into a converged, multi-tenant local area network to support convergence, reliable, reconfigurable, resilient Base/Post/Camps/Stations (B/P/C/S) network. ISTC is responsible for providing the transport and network infrastructure to enable communication capability and capacity from the enterprise to the tactical edge across the Marine Corps B/P/C/S. The ISTC mission has expanded to include the complete modernization/replacement of all Low Speed Time Division Multiplexing (LSTDM) technologies and the modernization of the Distribution and Access Layer Transport infrastructure to the End-user

Building (EUB). As a result, ISTC is now responsible for the modernization of the telecommunication and network infrastructure at every Marine Corps Installation.

1.3 OBJECTIVES

The objectives of this contract are to modernize and refresh the telecommunications and network infrastructure on each Marine Corps Installation by reducing the procurement acquisition lead time, creating the flexibility to support multi-awards and projects, and promoting agility to implement material solutions in support of world-wide emerging requirements and standardization. This effort will include:

a) Replacement of equipment not currently managed as a configuration item in accordance with the current baseline for refresh;

b) Refresh of network infrastructure equipment currently managed as a configuration item; and/or

c) Integration, testing, and fielding of current Technology Readiness Level 9 (TRL-9) capabilities.

1.4 SCOPE

The Contractor shall Engineer, Furnish, Install, Secure, and Test (EFIST) and make operational the refreshed and modernized capabilities for the telecommunication and network infrastructure at all required USMC B/P/C/S in accordance with (IAW) individual orders.

The Contractor shall also provide all required equipment, labor, training, software, firmware, licenses, and interfaces associated with these capabilities to deliver a complete solution. The Contractor shall provide all supporting documentation associated with the delivered solution.

1.5 GENERAL INFORMATION

1.5.1 RECOGNIZED HOLIDAYS

The Contractor is not required to perform work or provide services on the Federal Government holidays identified below.

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

Juneteenth

1.5.2 WORK HOURS

Working hours for on-site Contractors shall be within normal business hours 0700 to 1800 local time. The

Government and Contractor shall coordinate and agree to any authorized service interruptions outside of the previously stated normal business hours. No overtime will be authorized. No work shall be performed at

Government facilities when the Government is closed.

1.5.3 PLACE OF PERFORMANCE

The work to be performed under this IDIQ contract will be performed at current or future U.S. Marine Corps

Continental United States (CONUS) and Outside Continental United States (OCONUS) Installations and

Detachments that include, but are not limited to, the following:

Marine Corps Base Camp Pendleton, CA**

Marine Corps Air Station Miramar, CA

Marine Corps Air Station Yuma, AZ

Marine Corps Logistics Base Barstow, CA

Marine Corps Air Ground Combat Center Twentynine Palms, CA

Marine Corps Mountain Warfare Training Center Bridgeport, CA

Marine Corps Recruit Depot San Diego, CA

Marine Corps Base Camp Lejeune, NC**

Marine Corps Air Station Cherry Point, NC

Marine Corps Air Station Beaufort, SC

Marine Corps Logistics Base Albany, GA

Marine Corps Support Facility Blount Island, FL

Marine Corps Recruit Depot Parris Island, SC

Marine Corps Base Quantico, VA**

Marine Corps Base Camp Butler, Okinawa, Japan**

Marine Corps Air Station Iwakuni, Japan

Marine Corps Installation Camp Mujuk, South Korea**

Marine Corps Base Hawaii, HI**

Marine Corps Detachment at any other geographically separate locations to include Marine Forces Reserve (MFR)

**Denotes the Regional Centers that are identified as Component Enterprise Data Centers (CEDC) in accordance with the Joint Information Environment (JIE) Implementation Guide. All other Installations are designated as

Installation Service Nodes (ISN) or Special Purpose Processing Nodes (SPPN).

1.5.4 TYPE OF CONTRACT

The Government will award a multiple award Firm Fixed Price (FFP) IDIQ contract with Individual FFP Delivery

Orders (DOs) issued for specific work at specific Installations or locations.

1.5.4.1 PERFROMANCE ASSESSMENT

The Government will evaluate and document the Contractor’s performance within the Contractor Performance

Assessment Reporting System (CPARS). The Government will provide an assessment detailing the Contractor’s conformance to both the technical and programmatic management of the requirements outlined in the Statement of

Work (SOW) as well as awarded DOs.

1.5.5 PHYSICAL SECURITY

The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

1.5.6 SECURITY REQUIREMENTS

The information provided to the contractor will be unclassified and/or Controlled Unclassified Information (CUI).

Certain contractors will be required to perform IT-I/II duties that require favorably adjudicated Tier 5/3 Level investigations. The Defense Counterintelligence and Security Agency (DCSA) will not authorize contractors to submit the necessary Tier Level investigations, solely in support of IT level designation requirements, without a valid classified requirement as specified in a DD-254. This effort does not warrant a DD-254, therefore the

Government Contracting Activity Security Office (GCASO) is required to submit any required investigations in support of IT level designations. The Facility Security Officer (FSO) is however required to establish, populate, and own the DISS record of every contractor processed for and/or issued a Common Access Card (CAC) or submitted for IT level duties. The contractor is required to provide a roster of prospective contractor employees performing IT

Level II and/or IT Level I duties to the MCSC Contracting Officer’s Representative (COR). This roster shall include full names, Social Security Numbers, IT Level required, e-mail address, and phone number for each contractor requiring investigations in support of IT Level designations. The COR will verify the IT Level requirements and forward the roster to the GCASO. Contractors found to be lacking required investigations will be contacted by the GCASO.

In accordance with DoDI 5200.48 “Controlled Unclassified Information (CUI),” all contractors supporting MCSC who receive, store, or generate CUI are required to take the DoD Mandatory CUI Training, available on the Security

Awareness Hub at: https://securityawareness.usalearning.gov/cui/index.html. Per DoDI 5200.48 and pursuant to contractual requirements, DoD contractors require initial CUI training and annual CUI refresher training.

Additional MCSC specific CUI training and guidance can be attained by contacting the MCSC Security

Classification Management Office at 703-432-3141 / 3140 or MCSC_ACSG2_SCMO@usmc.mil.

While performing aboard NAVY/USMC sites, the contractor shall comply with the provisions of DoD Directive

5205.02E, “DoD Operations Security (OPSEC) Program,” SECNAVINST 3070.2A, “Operations Security,”

MCSCO 3070.1B, “Operations Security Program,” Marine Corps Order 3070.2A, “The Marine Corps Operations

Security (OPSEC) Program,” and the MCSC P5510.2C, “Security Manual,” at all other sites the contractor shall comply with the local command and/or program OPSEC plan. Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All Contractors (including Subcontractors) shall supplement their current security practices by requiring any personnel involved in executing this contract to complete Government-sponsored and administered OPSEC training.

The FSO’s are responsible for notifying the MCSC Personnel Security (PERSEC) Office at 703-432-

3952/3490/3374 if any contractor on this contract receives an unfavorable adjudication. Any issued CAC would need to be Revoked and Retrieved. Due to Insider Threat concerns, the FSO is also requested to notify the PERSEC

Office, within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been granted an IT designation, issued a CAC and/or a MCSC building badge. The FSO shall notify the Government (written notice) within 24 hours of any contractor personnel added or removed from the contract that have been granted IT designations, issued a CAC and/or a MCSC building badge.

1.5.6.1 DEFENSE BIOMETRIC IDENTIFICATION (DBID) CARD

Certain Contractors may require the issuance of a DBID card in order to gain access to Marine Corps bases/stations.

The Contracting Officer Representative (COR) will identify and approve only those Contractor personnel performing on this contract that require a DBID card in order to perform their job function aboard the base. All contractor personnel accessing Marine Corps Base Quantico and Marine Corps Systems Command must be in compliance Access Control policy identified within MCSCO 5530.2A Access Control Order.

1.5.6.2 MARINE CORPS BASE (MCB) INSTALLATION GATE ACCESS

Specific instructions for MCB Installations access will be provided at the Delivery Order level. Access onto MCB

Installations requires the use of an active Department of Defense Personally Identifiable Verification (PIV) credential (i.e. Common Access Card (CAC), Military Dependent Identification Card, Military Retiree Identification

Card, Transportation Worker Identification Credential) that can be scanned at all installation Gates prior to being granted access onto the installation. Contractors/vendors who require routine/reoccurring access to MCB

Installations and are not receiving a CAC in support of this contract effort (or do not already have an acceptable

PIV), are eligible for a DBID card. DBID cards may be obtained at no cost from the MCB Installations after coordination with the COR and the MCSC, AC/S G2, Physical Security Team (PHYSEC Team). To obtain a DBID card, the vendor shall submit a completed Vendor Screening Form (obtained from the COR or the PHYSEC Team) via: encrypted email to the POC or address identified for that Installation, (attn.: Physical Security). The information on the Vendor Screening Form will be used by the MCB Installation to conduct a background check. The vendor will be notified of the results of their vendor screening background check by the PHYSEC Team and/or COR.

Vendors who do not meet the eligibility standards, will not be cleared for access onto the MCB. Vendors who meet the eligibility standards and receive a favorable response to the background check will be required to complete the

DBID registration process using a website address/link that will be provided by the PHYSEC Team or COR. Once the Vendor has successfully completed the DBID registration process, a registration code will be provided. The registration code shall be printed and hand carried by the Vendor to MCB office and address identified in the

Delivery Order to be issued the DBID card. DBID cards will be issued for a period of 3 years regardless of contract expiration. For additional questions regarding submission of the Vendor screening Form or access requirements, you may contact the PHYSEC Team at mcsc_physicalsecurity@usmc.mil or by calling 703-432-3964/3909.

1.5.6.3 CONTRACTOR SCREENING

The Contractor shall return a completed Contractor Screening Form, which will be provided as, an attachment to the executed DO in order to identify all Contractor personnel requiring access to Installations/Detachments, base facilities, and/or handling Government assets. This form includes personal identification information for respective

Contractor personnel and shall be either: Hand delivered to the Installation Technical Support Officer (TSO) or sent in a password protected document. If the vendor screening form is sent via email, the password shall be provided and sent in a separate email. The Contractor shall provide a completed form to the TSO no later than two (2) weeks prior to the start of work for processing and vetting by the Installation/Detachment Security Office. The Security

Office will respond with any favorable or unfavorable screening outcomes as they are received from the Installation

PMO. Any personnel receiving an unfavorable outcome will not be authorized access to the Installation for the purpose of performing work related to this contract.

All required escorts shall be provided by local G/S-6 staff. It is the Contractor’s responsibility to secure any facility upon exiting the facility for which they are provided a key and unescorted access. The local G/S-6 will exercise security supervision over all Contractor personnel working on this project and will provide security support to the

Contractor. The Contractor shall comply with all emergency rules and procedures established for the installation or facility they are working on. All personnel aboard the installation or facility are subject to random inspections of their vehicles, personal items, and of themselves. Consent to these inspections is considered to have been given upon entrance to the installation and its facilities. Photography, videotaping, and/or audio recordings aboard any installation or facility are strictly prohibited without proper authorization by the local authorities.

1.5.6.4 COMMON ACCESS CARD (CAC)

The COR will identify and only approve those contractor employees performing on this contract that require a

CAC in order to perform their job function. In accordance with Headquarters, United States Marine Corps issued guidance relative to Homeland Security Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued a CAC. In order to meet the eligibility criteria, contractor employees requiring a CAC must obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI). Prior to authorizing a CAC, the employee’s Defense Information System for Security (DISS) record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened). The minimum acceptable investigation is a T-1 or a National Agency Check with Written Inquiries (NACI). If a contractor employee’s open mailto:mcsc_physicalsecurity@usmc.mil investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked. CACs are not issued for convenience.

Facility Security Officers (FSOs) are responsible for notifying the MCSC Personnel Security Office (PERSEC

Office) at 703-432-3490/3952 if any contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. Due to Insider Threat concerns, the Company is requested to notify the MCSC

Personnel Security Office (PERSEC Office) at 703-432-3952/3490/3374, within 24 hours, of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been issued a CAC and/or a MCSC Building Badge.

Each CAC is issued with a “ctr@usmc.mil” e-mail account that the individual contractor is responsible to maintain as active by logging in on a regular basis (at least twice a month), sending an e-mail and clearing any unneeded e-mails. Contractors issued a CAC are prohibited from “auto- forwarding” e-mail from their .mil e-mail account to their .com e-mail account. If the “ctr@usmc.mil” e-mail account is not kept active, G-6 will deactivate the account and the CAC will also lose its functionality. Contractor employees shall solely use their government furnished

“ctr@usmc.mil” e-mail accounts for work supporting the USMC, conducted in fulfillment of this contract, and shall not use a contractor supplied or personal e-mail account to conduct official U.S. government business. The use of a contractor or personal e-mail account for contractor business or personal use is allowed, but only when using cellular or a commercial internet service provider.

If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they have also lost their eligibility to perform on MCSC contracts.

1.5.6.5 MARINE CORPS ENTERPRISE NETWORK (MCEN) COMPUTER ACCESS

Contractor personnel accessing Marine Corps Systems Command Information Systems must maintain compliance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide.

Contractor personnel will submit a DD 2875 and a completion certificate for the CYBERC course located on

MarineNet located at https://www.marinenet.usmc.mil. The CYBERC course consist of the DOD Cyber

Awareness Challenge and the Department of the Navy Annual Privacy Training (PII). Contractors will have to create a MarineNet account in order to complete the required training.

MCEN IT resources, if provided, are designated for official use only and other limited authorized purposes. DOD military, civilian personnel, consultants, and contractor personnel performing duties on MCEN information systems may be assigned to one of three position sensitivity designations.

1) ADP-I (IT-1): Favorably adjudicated T-5, T5R, (formerly known as Single Scope

Background Investigation (SSBI)/SSBI Periodic Reinvestigation (SBPR)/SSBI Phased Periodic

Reinvestigation (PPR))

2) ADP-II (IT-2): Favorably adjudicated T-3, T3R, (formerly known as Access National Agency

Check and Inquiries (ANACI)/ National Agency Check with Law and Credit (NACLC)/Secret

Periodic Review (S-PR))

3) ADP-III (IT-3): Completed T-1, (formerly known as National Agency Check with Inquiries

(NACI))

Privileged users must maintain the baseline Cyberspace Workforce Information Assurance Technical (IAT) or

Information Assurance Manager (IAM) relating to the position being filled. Privileged users are defined as anyone who has privileges over a standard user account as in system administrators, developers, network administrators, code signing specialist and Service Desk technicians.

All MCEN users must read, understand, and comply with policy and guidance to protect classified national security information, Controlled Unclassified Information (CUI), and prevent unauthorized disclosures in accordance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide and https://www.marinenet.usmc.mil/

CJCSI 6510.01F.

MCEN Official E-mail usage – MCEN IT resources are provided for official government use only and other limited authorized purposes. Authorized purposes may include personal use within limitations as defined by the supervisor or the local Command. Auto forwarding of e- mail from MCEN-N to commercial or private domains (e.g., Hotmail, Yahoo, Gmail, etc.) is strictly prohibited. E-mail messages requiring either message integrity or non-repudiation are digitally signed using DOD PKI. All e-mail containing CUI, an attachment, or embedded active content must be digitally signed.

MCEN users will follow specific guidelines to safeguard CUI, which includes Personally Identifiable

Information (PII) and Health Insurance Portability and Accountability Act (HIPAA) information. Non-official e-mail is not authorized for and will not be used to transmit any CUI. Non-official e-mail is not authorized for official use unless under specific situations where it is the only means for communication available to meet operational requirements. This can occur when the official MCEN provided e-mail is not available but must be approved prior to use by the Marine Corps Authorizing Official (AO).

All personnel will use DOD authorized PKI certificates to encrypt e-mail messages if they contain any of the following:

1. Controlled Unclassified Information (CUI).

2. Any contract sensitive information that normally would not be disclosed to anyone other than the intended recipient as this is considered CUI.

3. Any privacy data, PII, or information intended for inclusion in an employee’s personal file or any information that would fall under the tenets of MSGID: DOC/5 USC 552A. Personal or commercial e-mail accounts are not authorized to transmit unencrypted CUI.

4. Any medical or health data, to include medical status or diagnosis concerning another individual.

5. Any operational data regarding status, readiness, location, or deployment of forces or equipment.

1.5.6.6 KEY CONTROL

The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

NOTE: All references to keys include key cards.

No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan (QCP). Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the

Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the next payment due to the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the next payment due to the

Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the

Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.5.6.7 LOCK COMBINATIONS

The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know. These procedures shall be included in the Contractor’s

QCP.

1.5.7 POST AWARD CONFERENCE/PERIODIC MEETINGS

The Contractor agrees to host a Post Award Conference (PAC) for the Base IDIQ award convened by the contracting activity in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. Separate PACs shall be done for each individual order within 30 days of each order award. The Contracting Officer, COR, and other

Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. The PAC for the Base IDIQ shall be conducted virtually through the use of Microsoft Teams. At these meetings the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Meeting frequency shall be established by the Government Project Lead and the Contractor and any additional meetings to resolve any issues shall be at no additional cost to the Government.

1.5.8 CONTRACTING OFFICER’S REPRESENTATIVE

The COR(s) will be identified by separate letter(s) and monitors all technical aspects of the contract and assists in contract administration. The COR(s) is/are authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notify both the Contracting Officer and Contractor of any deficiencies; coordinate availability of Government Furnished Property (GFP); and provide site entry of Contractor personnel. The COR(s) is/are not authorized to change any of the terms and conditions of the resulting order, especially any terms that affect price, delivery schedule, or period of performance (PoP).

1.5.9 KEY PERSONNEL

The Contractor shall provide key personnel who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the Contracting Officer. The Project Manager or alternate shall have full authority to act for the

Contractor on all contract matters relating to daily operation of this contract.

The Project Manager or alternate shall be available between 0700 to 1800 Monday thru Friday based on the time zone of the location/installation except Federal holidays or when the Government facility is closed for administrative reasons. It is up the Contractor to propose the necessary Key Personnel at the order level, at a minimum each order shall include a Project Manager. Qualifications for all key personnel are listed in Table 1.

Table 1 - Key Personnel

KEY PERSONNEL CERTIFICATIONS EXPERIENCE SKILL

PROJECT

SEGMENT

Project Manager Certified PMO or equivalent experience

7 years Project

Management

Leadership, management, and organizational skills

Site Survey

Engineering

Implementation

On-site Project

Manager

Certified PMO or equivalent experience

7 years Project

Management

Leadership, management, and supervisory skills

Site Survey

Engineering

Implementation

Quality

Control/Quality

Assurance Manager

BICSI Installer

Certified

7 Years QC/QA

Management

Telecommunications quality management skills

Site Survey

Engineering

Implementation

Lead Systems

Engineer (LSE)

BS

Science/Engineering

10 Years Engineering

Discipline

Telecommunications and infrastructure design skills

Site Survey

Engineering

Implementation

Telecommunications

Engineer

Registered

Communications

Distribution Design

(RCDD)

10 Years Network /

Telecommunications

Telecommunications design and installation skills

Site Survey

Engineering

Implementation

Network Engineer Certified (in the OEM solution proposed)

10 Years Network /

Telecommunications

Telecommunications design and installation skills

Site Survey

Engineering

Implementation

Senior Logistician Not Applicable 7 Years DoD Logistics

Management

Leadership, management, and organizational skills with acquisition, distribution, allocation, and delivery expereince

Site Survey

Engineering

Implementation

1.5.10 IDENTIFICATION OF CONTRACTOR EMPLOYEES

All contract personnel attending meetings, answering Government telephones, and working in any situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Contractors shall obtain visitor badges in accordance with local Installation security policy.

1.5.11 CONTRACTOR TRAVEL

The Contractor shall be required to travel within CONUS and OCONUS during the performance of this contract.

The Contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this SOW. Travel will be included as part of the individual delivery/task order requirements.

The Contractor shall use the Synchronized Predeployment & Operational Tracker (SPOT) web-based system, or its successor, to account for OCONUS travel. The Contractor can register for a SPOT account at https://spot.dmdc.mil.

1.5.12 ORGANIZATIONAL CONFLICT OF INTEREST

To the extent that the work under this contract requires access to proprietary, business confidential, or financial data of other companies, and as long as these data remain proprietary or confidential, the Contractor shall protect the data from unauthorized use and disclosure and agrees not to use it to compete with those other companies.

a) “Organizational Conflict of Interest” means that because of other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the

Government, or the person’s objectivity in performing the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage. “Person” as used herein includes corporations, partnerships, joint ventures, and other business enterprises.

b) The Contractor warrants that to the best of its knowledge and belief, and except as otherwise set forth in the contract, the Contractor does not have any organizational conflict of interest(s) as defined in paragraph (a).

c) It is recognized that the effort to be performed by the Contractor under this contract may create a potential organizational conflict of interest on the instant contract or on a future acquisition. In order to avoid potential conflict of interest, and at the same time to avoid prejudicing the best interest of the

Government, the right of the Contractor to participate in future procurement of equipment and/or services that are the subject of any work under this contract shall be limited as described below in accordance with the requirements of FAR Subpart 9.5.

d) The Contractor agrees:

1) That it shall not release, disclose, or use in any way that would permit or result in disclosure to any party outside the Government any information provided to the Contractor by the

Government during or as a result of performance of this contract. Such information includes, but is not limited to, information submitted to the Government on confidential basis by other persons. Further, the prohibition against release of Government provided information extends to cover such information whether or not in its original form, e.g., where the information has been included in Contractor generated work or where it is discernible from materials incorporating or based upon such information. This prohibition shall not expire after a given period of time. See, Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-

7000, Disclosure of Information, included in the contract.

2) The Contractor agrees that it shall not release, disclose, or use in any way that would permit or result in disclosure or any party outside the Government any information generated or derived during or as a result of performance of this contract.

3) The prohibitions contained in subparagraphs (d)(1) and (d)(2) shall apply with equal force to any affiliate of the Contractor, any sub-Contractor, consultant, or employee of the Contractor, any joint venture involving the Contractor, any entity into or with which it may merge or affiliate, or any successor or assign of the Contractor. The terms of paragraph (f) of the

Special Contractor Requirement relating to notification shall apply to any release of information in contravention of this paragraph (d).

e) The Contractor further agrees that during the performance of this contract and for a period of three years after completion of performance of this contract, the Contractor; any affiliate of the Contractor;

any sub-Contractor, consultant, or employee of the Contractor; any joint venture involving the

Contractor; any entity into or with which it may subsequently merge or affiliate; or any other successor or assign of the Contractor, shall not furnish to the Marine Corps, either as a prime Contractor or as a sub-Contractor, or as a consultant to a prime Contractor or as a sub-Contractor, any system, component or services which is the subject of the work to be performed under this contract. This exclusion does not apply to any re-competition for those systems, components, or services on the basis of work statements growing out of the effort performed under this contract, developed from a source other than the Contractor, sub-Contractor affiliate, or assign of either. During the course of performance of this contract or before the three-year period following completion of this contract has lapsed, the

Contractor may, with the authorization of the cognizant contracting officer, participate in a subsequent procurement for the same system, component, or service. In other words, the Contractor may be authorized to compete for procurement(s) for systems, components, or services subsequent to an intervening procurement.

f) The Contractor agrees that, if after award, it discovers an actual or potential organizational conflict of interest; it shall make immediate and full disclosure in writing to the contracting officer. The notification shall include a description of the actual or potential organizational conflict of interest, a description of the action, which the Contractor has taken or proposes to take to avoid, mitigate, or neutralize the conflict, and any other relevant information that would assist the contracting officer in making a determination on this matter. Notwithstanding this notification, the Government may terminate the contract for the convenience of the Government if determined to be in the best interest of the Government.

g) Notwithstanding paragraph (f) above, if the Contractor was aware, or should have been aware, of an organizational conflict of interest prior to the award of this contract or becomes or should become aware of an organizational conflict of interest after award of this contract and does not make an immediate and full disclosure in writing to the contracting officer, the Government may terminate this contract for default.

h) If the contactor takes any action prohibited by this requirement or fails to take action required by this requirement, the Government may terminate this contract by default.

i) The contracting officer's decision as to the existence or nonexistence of the actual or potential organization conflict of interest shall be final and is not subject to the clause of this contract entitled

"DISPUTES" (FAR 52.233.1).

j) Nothing in this requirement is intended to prohibit or preclude the Contractor from marketing or selling to the United States Government its product lines in existence on the effective date of this contract; nor, shall this requirement preclude the Contractor from participating in any research and development. Additionally, sale of catalog or standard commercial items are exempt from this requirement.

k) The Contractor shall promptly notify the contracting officer, in writing, if it has been tasked to evaluate or advise the Government concerning its own products or activities or those of a competitor in order to ensure proper safeguards exist to guarantee objectivity and to protect the Government's interest.

1) The Contractor shall include this requirement in subcontracts of any tier which involve access to information or situations/conditions covered by the preceding paragraphs, substituting "sub-

Contractor" for "contactor" where appropriate.

l) The rights and remedies described herein shall not be exclusive and are in addition to other rights and remedies provided by law or elsewhere included in this contract.

m) Proprietary Information Exchange Agreement (PIEA)/Non-Disclosure Agreements (NDA). The

Contractor shall arrange the signature on all PIEA/non-disclosure agreements necessary to interface with other Contractors to accomplish the contract requirements in accordance with FAR 9.505-4 prior to beginning any efforts associated with this SOW. Copies of all non-disclosure agreements required for this contract shall be provided to the Contracting Officer and COR.

1.5.13 SYSTEM SECURITY PLAN

1. System Security Plan (SSP) And Plans of Action and Milestones (SSP/POA&M) Reviews:

a) Within thirty (30) calendar days of contract award, the Contractor shall make its SSP(s) for its covered

Contractor information system(s) available for review by the Government at the Contractor’s facility.

The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation

Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSP(s) at the Contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of

DFARS clause 252.204-7012 then the Government will notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) calendar days of notification by the Government. The Contracting Officer may provide for a correction period longer than thirty (30) calendar days and, in such a case, may require the Contractor to submit a plan of action and milestones (POA&M) for the correction of the identified deficiencies. The Contractor shall immediately (within twenty-four (24) hours) notify the Contracting Officer of any failure or anticipated failure to meet a milestone in such a POA&M.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the

SSP(s) at the Contractor s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three

(3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) calendar days’ notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated

Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-

171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with

DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems affecting this contract.

Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and

POA&M their plans to implement the following, at a minimum: The Government will identify the appropriate solutions at the Task Order level, as needed

(i) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication.

For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted.

(ii) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the

Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its sub-Contractors, suppliers, or Contractors based on need-to-know principles;

(iii) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(iv) Audit user privileges on at least an annual basis;

(v) Implement:

a. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

b. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program).

(vi) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(vii) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) calendar days of discovering the cyber incident (inclusive of the

72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3)

Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from

Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) calendar days of identification. In such a case, the Contractor may request a delivery date later than ten (10) calendar days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered Contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with NCIS, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, sub-Contractor or Contractor logs that show network activity, including any additional logs the Contractor, sub-Contractor or Contractor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the

Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this SOW shall be in accordance with federal, state, and non-US law.

1.5.14 OPERATIONS SECURITY (OPSEC)

1.5.14.1 GENERAL CONTRACTOR OPSEC REQUIREMENTS

1. During the course of this contract, in addition to those restrictions, instructions and guidelines delineated in the contract SOW, Deliverables Table, and/or other references provided, the Contractor will adhere to the following minimum requirements in support of Program Executive Office Digital Enterprise Services Installation

Services Transport and Communications (PEO-DES ISTC) OPSEC Program:

a) Introduction of personnel electronic devices into Government spaces, laptops, tablet PCs, cellular phones, cameras, recording devices, and data recording/storage devices is STRICTLY controlled and forbidden in most cases. Company issued equipment required for the performance of work must be approved by the PEO-DES ISTC and/or Government Security Officer. Photography and recording is not allowed except for official use and by permit only. (Unless otherwise stipulated in the contract, contact the Installation Security Officer for approval.) Photographs will be reviewed by Security to ensure sensitive and/or classified information is not revealed.

b) Contractor…