MINIMUN SPECS.docx

8/5/24 Minimum Specifications/Statement of Work For Single-Ply Cutting Machine to be located in Bldg. 10A

1.0 Scope

1.1 Statement of Purpose

Tobyhanna Army Depot’s (TYAD’s) goals is to replace an existing Gerber Technology Gerber Cutter GT3250 with a new more modern single-ply cutting machine.

1.2 Removal of Existing Multi-Ply Cutting Machine

The removal of the existing multi-ply cutting machine shall be performed by Tobyhanna Army Depot Production Equipment personnel.

2.0 Functional Requirements of New Single-Ply Cutting Machine

2.1 General Requirements

This specification/Statement of Work (SOW) sets forth the general system requirements for the purchase, installation and training of shop personnel on the proper operation and preventative maintenance of a new single-ply cutting machine. Used or refurbished equipment is NOT acceptable. For the purpose of this specification, the single-ply cutting machine will be referred to as the single-ply cutting machine, cutting machine and machine.

2.2 Requirements Overview

The single-ply cutting machine obtained as a result of this solicitation shall provide a conveyorized automatic means of cutting various fabrics. The fabrics to be cut range from nylon, vinyl, and up to 1” thick foam minimum.

2.3 Cut Speed

The cutting machine shall be capable of a minimum of 60 inches per second cut speed. (It is understood that actual cutting speeds vary based on the material being processed and patterns being cut.)

2.4 Cutting Area

The cutting machine shall have a minimum of a 72” by 144” cutting area.

2.5 Cutting Head

The cutting head shall employ a pneumatically oscillating tool knife head with a depth limiting function. In addition to the knife the cutting head shall have two each 7/8” diameter heavy duty spindles as a minimum. The tool head shall also be equipped with a marking/labeling assembly such that material being processed can be marked.

2.6 Cutting Parameters

Cutting machine operators shall be capable of adjusting cutting parameters such as the cutting tool pressure, vacuum levels and cutting speed on the machine’s touch screen control.

2.7 Conveyor System

The cutting machine shall have the ability to continuously convey rolled material at a consistent speed. The conveyor shall employ a bristle type conveyor belt with replaceable blocks/sections.

2.8 Vacuum Table

The cutting machine shall have a vacuum table for holding material down during the cutting process. The vacuum table shall have a minimum of 10 horsepower, variable-frequency drive (VFD) controlled vacuum blower. The vacuum pressure shall be variable and programmable for processing different materials. The vacuum table shall provide the appropriate vacuum while the material is being conveyed from the cutting area to the pickup area.

2.9 Control

The cutting machine shall have a sealed control cabinet to protect against particulates from the fabric cutting area. The cabinet shall be fan-cooled for optimal computer performance. The control shall employ an industrial computer for multi-axis motion. The cutting machine shall have a minimum of a 7” LCD touchscreen, color control panel for inputting commands mounted on the traveling bridge/gantry. The gantry shall also have a joystick for positioning the gantry and the control head. In addition to the touchscreen control on the gantry the machine shall have a kiosk type control cabinet on wheels that can be positioned on either side or end of machine. Programs for the cutting machine shall be accomplished via a personal computer (PC) with Windows based software. (The PC shall be provided by the government per requirements identified by the contractor.) Programs shall then be transferred to the machine controller via memory stick. The control system shall employ cutting software that provides the following functions as a minimum: allows operators or programmers to define patterns to be cut, allows the machine to cut and convey at the same time, stores multiple programs/recipes and allows user to switch between cut program to go from one cutting job to another. (It must be understood that due to security issues and concerns vendors will NOT be permitted to remotely access the cutting machine via a network or internet for troubleshooting or any other purposes.)

2.10 Software

The cutting machine software shall be user friendly, prompting users for necessary parameters and input. The software features shall include but not be limited to being capable of uploading and converting various types of Computer Aided Manufacturing (CAD) files such as DXF and other major CAD formats. Software shall also include pattern and nesting functions. The cutting machine shall come with lifetime software key and updates.

2.11 Safety Features

The cutting machine shall be provided with the following safety systems, as a minimum:

2.11.1 Emergency Stop Buttons

The cutting machine shall have emergency stop buttons provided to immediately stop motion of the cutting machine. The buttons shall be bright red in color and located such that it is easily accessible and noticeable in the case of an emergency situation. Emergency stop switches shall be provided at various locations around the cutting machine, on the traveling bridge/gantry and at the control cabinet/kiosk as a minimum. The E-stop buttons shall immediately stop all motion of the cutting machine. The gantry/traveling bridge shall also have bump stops or some form of stopping switch such that if the bridge comes in contact with a person or object in the path of the gantry the bridge travel is disabled until the person or object is clear of the area and an operator resets and restarts the machine.

2.11.2 Service Door Interlocks

Service Door interlock switches immediately stop and prevent motion when opened.

2.11.3 Bump Stops/Light Beams

The cutting machine shall employ bump type stops on both sides of the gantry or an infrared light beams/light curtain at operator station to protect the operators from being exposed to hazards associated with moving parts.

2.11.4 Status Lights

The cutting machine shall employ status lights to provide operator with a visual indicator of when it is safe and not safe to reach into the cutting area. Status lights shall display red when it is not safe to reach into access opening and green when it is safe to reach into access opening.

2.12 Accessories

The following accessories shall be provided with the cutting machine as a minimum.

2.12.1 Pneumatic Air Booster System: A pneumatic air booster system or similar type system shall be provided with the cutting machine to provide for fluctuations in compressed air pressure from the shop air system. The air booster system shall not serve as the primary source of compressed air but balance the compressed air flow to prevent inconsistencies in the pressure from negatively impacting the cutting process.

2.12.2 Plastic Roll Holder: A plastic roll holder shall be provided with the cutting machine to dispense plastic for holding fabric down on the cutting surface.

2.12.3 Spare Oscillating Tools: Three spare oscillating tools shall be provided with the cutting machine to allow for quick tool changes when changing from one material to another.

2.12.4 Blades: The cutting machine shall include a minimum of 5 each oscillating cutting blades in each of the appropriate sizes for cutting a minimum of 1” thick foam, nylon, vinyl. The following size blades shall be provided as a minimum:

- OSC Blade, 0.63 mm Thick, 31.0 mm cutting height, 86°, Pointed Tip

- OSC Blade, 0.63 mm Thick, 12.0 mm cutting height, 65°, Pointed Tip

- OSC Blade, 1.50 mm Thick, 16.5 mm cutting height, 81°, Pointed Tip

- OSC Blade, 1.50 mm Thick, 35.0 mm cutting height, 83°, Flat Tip

- OSC Blade, 1.50 mm Thick, 70.0 mm cutting height, 89°, Pointed Tip

- Tungsten Carbide 50 x 5 x 1 x 30

2.16 Power Requirements

The cutting machine and its accessories provided shall operate on a 208 VAC, 3-phase, grounded, 60 cycle electrical service. Control power and computers associated with the machine may be 120 VAC. Power required to include voltage and amperage shall be stated in proposal.

2.17 Physical Size/Footprint

The cutting machine shall not require a footprint greater than 12’ x 18’ when installation is complete and machine is ready for operation. It is acceptable to provide the equipment in a disassembled condition but the government will not assemble the equipment. This will be considered part of the contractor’s installation. Cargo door entrances to Building 10A where machine will be installed are 14’ wide by 12’ high nominal. Machine shall be cable of going through existing doorways without modification to the building or doorways.

3.0 Safety

The cutting machine shall be UL listed and meet all requirements set forth in OSHA General Industry Standards 29 CFR 1910, dated 1 July 1996 or CE listed. In addition it shall meet or exceed the National Fire Protection Association (NFPA) requirements of NFPA 79-1994, "Electrical Standards for Industrial Machinery." All energy control sources shall have the capability of being locked out and tagged out. The contractor's manuals shall detail the lockout/tagout procedures which are required to bring the cutting machine to a zero mechanical state for maintenance or service procedures. If the machine has a power switch and plugs into a receptacle such that the switch maybe turned off and the machine can be unplugged from the power source, that is sufficient to comply with zero mechanical state requirement. Start-up procedures to return from the zero mechanical state to full operational capability shall also be provided.

3.1 ISO 45001

Tobyhanna Army Depot is an ISO 45001 certified site; therefore, Tobyhanna Army Depot complies with Occupational Safety and Health Administration (OSHA) standards. Accordingly, Tobyhanna Army Depot expects and requires full contractor compliance with all applicable safety regulations and standards. The Contractor is responsible for maintaining, monitoring and enforcing full compliance.

3.2 OSHA Rules and Regulations

Contractors must comply with all Department of Labor and OSHA Rules and Regulations, 29 CFR 1910 (General Industries) and/or 1926 (Construction), and all applicable sections of the National Fire Protection Association (NFPA) Codes.

3.3 Standards for Electrical Safety

Particular attention is directed to NFPA 70E, Standard for Electrical Safety Requirements for Employee Workplaces. Contractor shall fully comply with all sections of this standard, including but not limited to; PART I, Chapter 2 - Ground Fault Protection for Personnel on Construction Sites, PART I, Chapter 3-7.1 - Use of Flexible Cords and Cables, PART II, Chapter 2-3 - Working On or Near Electrical Conductors or Circuit Parts, PART II, Chapter 5 - Lockout/Tagout Practices and Devices.

4.0 Delivery

5.0 Installation

Installation responsibilities shall be shared between the Government and the contractor. The Government will unload the equipment from the truck, move it to the shop area, rough level the equipment, and connect the utilities (electricity and compressed air). Government personnel will not assemble the machine. This will be considered part of the contractor’s installation. The contractor shall then complete any incidental installation processes in order to place the cutting machine into service and ready for demonstration/acceptance testing. All installation procedures shall be coordinated with the Contracting Officer (KO) or the Contracting Officer's Representative (COR). All installation shall be performed by English speaking U.S. citizens. All work shall be performed during normal working hours: Monday through Friday from 7:30 am to 4:00 pm Eastern Standard Time, excluding Federal Holidays, unless special arrangements are made with the KO or COR.

5.1 Installation Requirements

Installation shall be completed by trained authorized system support personnel. The installation including assembly, wiring and testing shall be in accordance with the manufacturer’s installation instructions. The contractor shall provide all tools, material movement equipment and lift equipment necessary to assemble and install the machine in its predefined location.

5.2 Requirement to Use Electric Powered Vehicles

In accordance with Tobyhanna Army Depot’s policy to eliminate the use of fossil fuel vehicles within depot buildings, only electric-powered material movement equipment (to include forklifts, high-reach equipment, etc.) shall be allowed in any depot building. Additionally, the Contractor will provide any battery recharging units required for operation of this material movement equipment.

6.0 Acceptance Testing

Operational Acceptance Testing for the cutting machine shall be performed following installation of the machine at Tobyhanna Army Depot and prior to training. Acceptance Testing will consist of the Contractor's technical representative demonstrating the ability to perform to the standard specified in the Requirements section of this specification. The material to be used for the Acceptance Testing shall be provided by the Government. In the event that the machine fails the acceptance test or fails to comply with any other aspect of this specification, the Contractor shall correct any deficiencies within 15 working days of the acceptance test, at which time the machine will be retested for compliance. It shall be at the discretion of the Contracting Officer as to whether all, part, or none of the acceptance test procedure shall be performed again. For the purpose of re-testing required due to the failure of the system to pass the initial testing, it shall be the responsibility of the Contractor to provide the material required for any re-testing, inclusive of any shipping costs, and such material shall be per the specification provided by the Government.

7.0 Training

Training shall begin within 10 working days of installation, set-up, and successful acceptance testing of the cutting machine. The contractor shall provide training for a maximum of 3 shop personnel and 2 Engineering personnel in the proper set-up, operation, and calibration of the machine. The contractor shall also provide instruction for 2 equipment mechanics on the proper preventative maintenance and troubleshooting techniques for the cutting machine. Instruction shall be performed at the Depot during normal Depot working hours (Monday thru Friday 7:30 AM to 4:00 PM) excluding Federal Holidays. The start-up and instruction shall be structured to be completed within two days (sixteen hours) and have sufficient time for a question and answer session. Training will take place after installation and acceptance testing but prior to final acceptance by the Contracting Officer (KO) or her Representative (COR). The contractor shall supply all training materials necessary to complete the training requirement.

7.0 Documentation

The single-ply cutting machine shall be provided with a comprehensive Operator’s Manual. A minimum of one hard copy and one electronic copy on CD/DVD of the manual shall be provided at the same time as machine delivery.

Department of Defense Item Unique Identification Code(DOD IUID) is Not required.

8. Warranty

8.1 Warranty Requirement

Contractor warrants that, at the time of delivery, the cutting machine shall conform to the requirements of the contract and be free from all defects in material and workmanship at the time of acceptance for a minimum of one (1) year from date of final acceptance by the Government.

8.2 Warranty Coverage

The Contractor shall provide a minimum of a one (1) year warranty on parts and labor for all performance requirements. This warranty excludes any damage caused by the customer through misuse or abuse. Warranty service does not cover repairs required because of accidents, fire, water, abuse, misuse or conditions resulting from an act of nature. There shall be no cost to the Government for repairs to include parts, shipping, labor, and travel required to return the system to full operation during the one-year warranty period. The equipment furnished under this specification shall be warranted for parts and labor for a period of 1 year from the date of final acceptance. IN THE CASE OF ANY COMPONENTS OR SUBSYSTEMS WHICH COME WITH A WARRANTY FROM THE MANUFACTURE THAT IS LONGER THAN A YEAR, THAT WARRANTY WILL BE PROVIDED TO THE GOVERNMENT WITH THE OTHER REQUIRED DOCUMENTATION. THE EXISTANCE OF WARRANTIES FOR COMPONENTS OR SUBSYSTEMS WHICH HAVE A DURATION OF LONGER THAN ONE YEAR IN NO WAY NEGATES OR DIMINISHES THE RESPONSIBILITY OF THE CONTRACTOR FOR PROVIDING WARRANTY OF THOSE COMPONENTS OR SUBSYSTEMS FOR A PERIOD OF ONE YEAR AFTER THE DATE OF FINAL ACCEPTANCE. There shall be single contractor accountability to prevent confusion of responsibility if a problem or breakdown occurs.

3.0 Cyber Requirements

3.1 Applicable Publications

The Vendor, and all sub-contractors, must abide by all applicable regulations, publications, manuals, and local policies and procedures. This includes, but is not limited to; AR 25-1 as well as STIGs and SRGs as published on https://public.cyber.mil.

3.2 Acronyms

3.3 Definitions

This section contains explanations of terms used in this document. They are taken from, and not to supersede, those definitions given in Army Regulation (AR) 25-1. All terms used in this document are in accordance with AR 25-1. This section shall be considered the authoritative source for definitions of terms not contained within AR 25-1 and/or its supporting documents.

3.3.1 Automation Support Branch

The Automation Support Branch (ASB), under the Mission Support Division, under the Directorate of Production Engineering, is the single point of contact for all mission-related IT equipment at TYAD. The ASB develops, protects, and maintains specialty IT equipment, both networked and standalone, in support of unique workloads across TYAD.

3.3.2 Configuration Control Board

The Configuration Control Board (CCB) is the local approving authority, composed of Supervisory personnel, for all actions regarding IT equipment at TYAD. Receiving an ATO for an IT equipment, from NETCOM, does not automatically guarantee that the system can be utilized at TYAD. The IT equipment must also obtain approval from the TYAD CCB, before it may be used with Army ISs at TYAD. The CCB is the local entity responsible for approving the STIGs and SRGs deemed applicable by the TRC, before the ATO accreditation package is submitted to NETCOM for approval.

3.3.3 Government

Any federal civilian, or military personnel employed by the United States Department of Defense (DOD), United States Army (Army), and/or Tobyhanna Army Depot (TYAD).

3.3.4 Industrial Review Board

The Industrial Review Board (IRB) is the local governing body that oversees all industrial mission assets to ensure compliance with TYAD production requirements. Composed of SMEs from the Directorates of Production Engineering (D/PE) and Systems Integration and Support (D/SIS), the IRB collects requirements, reviews contracting documents, plans industrial capabilities, and oversees contract implementation in alignment with current and future production needs. The three voting members of the IRB are the Division Chiefs for the Mission Support Division, Design, Development and Fabrication Division, and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) Finishing Division.

3.3.5 Information Management Division

Part of the Directorate of Installation Services, the Information Management Division (IMD) is responsible for the development, protection, and maintenance of the TYAD SBU LAN. The IMD operates all critical infrastructure upon which TYAD’s IT equipment operate.

3.3.6 Information System

Information System (IS) is defined as the organized collection, processing, transmission, and dissemination of information in accordance with defined procedures, whether automated or manual. For the purposes of Army Portfolio Management System (APMS), the terms "application" and "information system" are both IT investments describing a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (see JP 1–02).The application of IT to solve a business or operational (tactical) problem creates an information system.

3.3.7 Information Technology

Information technology (IT) is any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used directly or is used by a contractor under a contract with the executive agency, which 1) requires the use of such equipment; or 2) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term "information technology" also includes computers, ancillary equipment, software, firmware, and similar procedures, services (including support services), and related resources. The term "information technology" does not include any equipment that is acquired by a Federal contractor incidental to a Federal contract. (Reference 40 USC Subtitle III (Clinger-Cohen Act of 1996).)

3.3.8 Technical Review Cell

Composed of technical experts from both the ASB, and IMD, the Technical Review Cell (TRC) conducts the preliminary review of all actions, related to IT equipment at TYAD, prior to either ATO submission, or CCB approval. The TRC is responsible for determining which security technical implementation guides (STIGs), and security requirements guides (SRGs) are applicable to a given system, based on the direction given by NETCOM, and higher headquarters.

3.3.9 Tobyhanna Army Depot

Tobyhanna Army Depot (TYAD) is responsible for the development, and protection of the TYAD Internal Campus Area Network (TYAD-ICAN). To obtain an ATO, all IT equipment Vendors will provide the resources necessary to obtain an ATO to TYAD, so that the TYAD entities, named in this sub-section, can assemble, and submit, the information to NETCOM for consideration. In addition to approval from NETCOM, local approvals must be obtained, from the entities named in this sub-section, for an IT equipment to operate both on the TYAD-ICAN, and standalone.

3.3.10 United States Army Network Enterprise Technology Command

The 9th Army Signal Command, otherwise known as United States Army Network Enterprise Technology Command (NETCOM), is responsible for all Army network development, and protection. In accordance with AR 25-1, all ISs must obtain an Authority to Operate (ATO) from NETCOM, before being permitted to communicate with any Army system. It is the responsibility of the Vendor, of any IT equipment, to provide all requested documentation, software, hardware, and licenses to the Tobyhanna Army Depot (TYAD) for ATO submission.

3.3.11 Vendor

Any non-Government personnel, whether the original equipment manufacturer (OEM), reseller, or third-party personnel involved in the procurement, installation, and/or maintenance of the IT equipment.

3.4 Hardware Requirements

Without exception, all IT equipment shall comply with any, and all, applicable security technical implementation guides (STIGs) and security requirement guides (SRGs) as published by the Defense Information Systems Agency (DISA). This includes STIGs and SRGs regarding physical security. In addition, all IT equipment will comply with relevant Department of Defense (DOD) guidance, and mandates regarding hardware lifecycle upgrades. Without exception, all hardware must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.4.1 Communication Interfaces

All IT equipment must utilize at least RS-232 serial, or Universal Serial Bus (USB) communication methods. USB connections are to function as a peripheral device only, such as a printer. USB Mass Storage Devices are strictly prohibited. Additional communication interfaces, such as Ethernet, or RS-485, are acceptable, but cannot be in lieu of an RS-232, or USB interface. Full system functionality must be provided via all communication methods present in the IT equipment. All communication interfaces must be enabled, and available for use by the Government, upon delivery of the IT equipment to the Government. This is to ensure continuity of operations (COOP) should a communication interface become either inoperable, or prohibited for security, or technical reasons.

3.4.2 Cryptographic Devices

Any, and all, hardware implementing cryptographic functionality must utilize a Federal Information Processing Standard (FIPS) 140-2 Level 1, or better, compliant device, certified by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).

3.4.3 Workstations and Servers

Only standardized, Government owned, managed, and maintained computing hardware shall be utilized.

3.4.4 Removable Storage Media

The use of removable storage media, including, but not limited to, Universal Serial Bus (USB) flash drives, CompactFlash cards, and Secure Digital (SD) cards is prohibited, except by authorized Government personnel. Neither the Vendor, nor their sub-contractors, shall utilize such devices, and will provide data via optical media, such as a compact disc (CD) or the DOD SAFE available at https://safe.apps.mil/.

3.4.5 Memory Contents

In the event of main, and backup power failure, it is preferred that the IT equipment shall not utilize volatile memory to store information including, but not limited to, parameters, configurations, or passwords. Upon restoration of power, the IT equipment must return to a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. The Vendor must state which form of memory (volatile or non-volatile) they will be using for which system functionalities. Further demonstration of memory is required in section 3.8.2.

3.4.6 Smart Card Readers

DOD personnel utilize a smartcard, called a Common Access Card (CAC) to access IT equipment. All user identification, and authentication, is to be accomplished with a FIPS 201 compliant smartcard reader.

3.4.7 Testing Hardware

The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

3.4.8 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.5 Software Requirements

Without exception, all IT equipment shall comply with any, and all, applicable STIGs, and SRGs developed by DISA, as well as relevant Army guidance, and mandates. Any, and all software, firmware, or operating systems intended to be used on, with, or in support of any IT equipment is required to have a current, and valid, ATO, approval from the TYAD CCB, a unique name to identify the product, and employ a version numbering system to enable tracking of outdated software. All data delivered to TYAD will be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data. Without exception, all software, firmware, and data must come from sources approved by the DOD, and abide by all current restrictions. Without exception, all software, firmware, data, and/or operating systems must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.5.1 Operating Systems

All IT equipment shall utilize only operating systems, approved by the Army, and configured according to applicable STIGs, SRGs, Army, and local TYAD guidance, and mandates. All operating system installations must be protected by the DOD’s Host Based Security System (HBSS) software suite.

3.5.2 Install Location

Unless authorized by the TYAD CCB, all software, firmware, and data provided the Vendor, and all sub-contractors, must be installed within, and provide full system functionality while running from, standard locations appropriate for the particular operating system on which it is installed (e.g., Program Files, Program Files (x86), etc.)

3.5.3 Account Credentials

The IT equipment must integrate with TYAD’s Active Directory infrastructure in order to utilize the existing public key infrastructure (PKI), operated by the Army, for user, service, and machine accounts. In addition, the Government must have the ability to change and/or disable, any, and all, built-in administrative, user, and service accounts in the system, including those in embedded sub-systems (e.g., microcontrollers, FPGAs, PLCs, CPLDs, etc.).

3.5.4 Cryptographic Functionality

All cryptographic functions must be FIPS 140-2 Level 1 compliant, or better, and utilize an implementation certified by the NIST CMVP.

3.5.5 Encryption Certificates

For cryptographic functionality, requiring use of a certificate, the system must be able to generate a certificate signing request (CSR) for submission to a DOD Certificate Authority. The CSR must be in a FIPS 140-2 Public Key Cryptography Standards (PKCS) #10 format of at least 2048 bits.

3.5.6 Connections to Outside Systems

All data shall remain within the bounds of the DOD Global Information Grid (GIG). Connections to outside entities for purposes including, but not limited to, performance metric reporting, or remote support are prohibited.

3.5.7 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.6 Support Requirements

All IT equipment are required to have a valid support contract for at least the software, and firmware. While a support contract is in effect, the following requirements, and all those listed in applicable STIGs, and SRGs from DISA, as well as relevant DOD guidance, and mandates shall apply in order for the system to maintain the ATO. The information contained within the Acceptance section 3.8 of this document shall also apply for the duration of the support contract. In addition an upgrade path for the system for its planned life cycle must be outlined by the vendor. The upgrade path must be able to address all potential issues discussed under heading 3.6 and its subheadings.

3.6.1 Response Time

The Government will receive a response from either the Vendor, or one of their sub-contractors, no later than 24 hours after the Government initiated a service request with either the Vendor, or one of their sub-contractors.

3.6.2 Replacement Hardware

Any, and all, replacement hardware shall be new, or functionally, and aesthetically, equivalent to new, in performance, and appearance.

3.6.3 Software Updates

Software support will include software updates and enhancements on covered software products. Covered software products is defined as any software, or firmware provided, by the Vendor and/or any subcontractors, to the Government.

3.6.4 Operating System Compatibility

The IT equipment must remain compatible with future updated operating systems in accordance with DOD migration schedules during the entirety of the system’s planned lifecycle. Delivery, to the Government, of all materials required to perform upgrades for compatibility must be completed within the timelines set by DISA, NETCOM, U.S. Army Cyber Command (ARCYBER), U.S. Cyber Command (USCYBERCOM), and any additional DOD organizations tasked with the security of the GIG.

3.6.5 Security Updates

The Vendor, and all of their sub-contractors, shall address all security-related issues for the duration of the support contract. Delivery, to the Government, of all materials required to perform mitigation, and/or remediation of Information Assurance Vulnerability Alerts and Bulletins (IAVAs and IAVBs) must be completed within the timelines set by DISA, NETCOM, ARCYBER, USCYBERCOM, and any additional DOD organizations tasked with the security of the GIG.

3.6.6 Safety Issues

The Vendor, and all of their sub-contractors, shall address all safety-related issues, as identified by the TYAD Safety Office, for the duration of the support contract. Delivery of all materials required to perform mitigation and/or remediation of safety hazards must be completed within the timelines set by the TYAD Safety Office.

3.7 Cyber Documentation

The Vendor, and all sub-contractors, shall provide at least a digital copy of the following information, in a file format to be approved by the TYAD CCB. All the following information must be delivered with a valid cryptographic hash using an approved method. The cryptographic hashes of any products built using the information provided by the Vendor, and all sub-contractors, must match the cryptographic hashes of the compiled data provided to the Government.

3.7.1 Manuals

The Vendor, and all sub-contractors, shall provide a complete set of instruction manuals containing all information necessary to operate, maintain, administer, and reinstall software and hardware contained within the system.

3.7.2 Disaster Recovery

The vendor shall also provide step-by-step instructions to facilitate a complete restoration of the system, to the state in which it was initially accepted by TYAD, in the event of a fatal system error.

3.7.3 System Backups

The Vendor, and all sub-contractors, shall also provide a backup copy of all configuration settings in effect at the time of successful demonstration of system functionality.

3.7.4 Source Code

If any software, firmware, or data has been customized for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government. If any software, firmware, or data, governed by an open source license has been provided for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government.

3.7.5 Calibrations and Certifications

The vendor and all sub-contractors must provide a digital copy of any documentation related to certifications received by the system or information of calibrations performed on the system.

3.7.6 Implementation Plan

The Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. All IT IT equipment, components, software, and firmware must have an associated version number.

3.7.7 Digital Copies of Paper Deliverables

In addition all documentation requested in section 7.0 Documentation must be provided digitally.

3.8 Acceptance

The following criteria must be met before any IT equipment can be accepted, and put into use, by TYAD. Upon acceptance, all assets provided to TYAD by the Vendor, and all sub-contractors, shall become the sole property of the Government. All data delivered to TYAD shall be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data, and must not be initially provided after receipt of the data by TYAD. Data received by TYAD which does not match the associated cryptographic hashes shall not be considered valid, and will not be accepted.

3.8.1 Proof of Implementation

Upon solicitation, the Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. This plan, and the associated list of components will be verified by TYAD personnel to ensure the promised assets have not been tampered with prior to system delivery at TYAD. The same component list will be used to verify that no assets are tampered with during the install phase, after delivery, but prior to acceptance by TYAD. The component list will continue to be used to verify system integrity, and track changes made, after acceptance by TYAD.

3.8.2 Proof of COOP

A successful demonstration of disaster recovery is required. The demonstration must include removing any power or backup power, battery or otherwise, from the system followed by the return of a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. Any files and/or passwords used in the disaster recovery demonstration must be provided to TYAD by the vendor. This demonstration must be carried out in accordance with demonstration guidelines defined in section 3.6.3.

3.8.3 Proof of Functionality

The IS must obtain written confirmation, from the Contracting Office Representative (COR), of successful demonstration of full system functionality, a demonstration of COOP (section 3.8.2), and any demonstrations agreed to by the vendor during the solicitation or performance periods. The demonstration must occur at TYAD, in the presence of either the COR, or the Contracting Office Technical Representative (COTR) and at least one TYAD subject matter expert (SME). The COTR cannot serve as the only SME, at least one SME shall be from the Cost Center where the asset is to be utilized. Full system functionality demonstrations shall only be performed on the fully installed IT equipment. The written confirmation, from the COR, will contain an itemized list of checks performed during the demonstration. Each check will detail the steps taken, inputs/commands given, and results received. The TYAD COR/COTR and TYAD SMEs shall sign and date the verified component list, previously provided as Proof of Implementation, as well as the completed system functionality demonstration checklist. End-user license agreements (EULA) and similar documents will be signed by the TYAD COR/COTR and TYAD SMEs, after signing both the verified component list, and completed system functionality demonstration checklist. If the COTR is present for the full system functionality demonstration test, and signs on behalf of the COR, then the COR must sign and date the same documents, upon receipt from the COTR.

3.8.4 Proof of Documentation

The COR will provide a signed and dated memo once all documentation outlined in Section 3.7 has been delivered to and verified by TYAD.

3.8.5 Proof of Authority to Operate

IT products, such as software to be installed on Army computing resources, must undergo the Risk Management Framework (RMF) Assess Only process. Systems fitting the description of an IS, such as those provided by a Vendor with software, firmware, or operating system not controlled by the Army, are required to undergo the RMF Assess and Authorize process. Both an IT product, and an IS must be registered in the Enterprise Mission Assurance Support Service (eMASS). Proof of an Authority to Operate (ATO) is only valid once the relevant entry in eMASS receives a signature from the Approving Official (AO). Without an AO signature, no ATO exists, and the IT/IS cannot be accepted.

3.8.6 Proof of TYAD TRC Approval

The IS must obtain an ELTY 1642 Requirement Document form, digitally signed by all approving authorities listed on the form. The TYAD TRC approval process typically occurs in parallel with the ATO approval process.

3.8.7 Proof of TYAD CCB Approval

The IS must obtain an ELTY 6353 Change Request form, digitally signed by all approving authorities listed on the form. TYAD TRC approval is required before consideration by the TYAD CCB.

Part 4 Security Standards

6.1 AT OPSEC requirements

2024 SEC OPS BLURB

All TYAD contracts and other acquisition-related documents must ensure privacy and security controls follow the information, and that contractors and service providers protect Privacy Act information in the same way the organization adhering to the Federal Acquisition Regulations (FAR) Privacy Act provisions (Subparts 24.1 and 24.2) and include the specified contract clauses (Parts 52.224-1 and 52.224-2), as appropriate, to ensure that personal information is protected as mandated.

In addition to the changes authorized by the clause of this contract; should Force Protection Condition (FPCON) at the installation change, the Government may require changes in contractor security matters and/or processes.

FPCON impact on work levels.

Current FPCON: Bravo FPCON Charlie: Applies when a hostile incident occurs within the CDR’s area of interest (AOI), or intel is received indicating a hostile act or targeting against DoD elements, PAX, or facilities is likely.

FPCON Delta: Applies when a terrorist attack or hostile act has occurred or is anticipated against specific installations or operating areas.

(Please annotate with an X which option may apply.

If option 1 applies, indicate which contracted services will be affected in the brackets)

1. _____ During FPCONs Charlie and Delta, [XXX] services are discontinued. [XXX] services will resume when the FPCON level is reduced to level Bravo or lower.

2. __X___This contract and its employees are considered mission essential. Therefore, all contractor employees are required to report for duty and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the contacting officer via the appropriate COR.

Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays.

Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation; including fire, traffic, safety and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

(If Required) The contractor shall provide support during contingencies, exercises, heightened operations, and adverse weather or security closures in the accomplishment of performance requirements. From time to time, the Base Commander may decide to close all or part of a base in response to an unforeseen emergency or similar occurrence. Such emergencies include adverse weather such as snow, or ice, "an act of God,” such as tornado or earthquake, or a base disaster such as a gas leak or fire.

Emergency Communications and Services.

If assigned to TYAD for seven-days or longer, contractors will enroll in the ALERT! Mass Warning Notification System (MWNS) at https://alertservices.csd.disa.mil/.

Alert! MWNS is NOT optional - it is a Headquarters Department of the Army (HQDA) requirement to be a registered user.

Due to the life-safety implications of the information being relayed and the requirement to provide immediate alerts and warnings, personnel assigned to TYAD must ensure that their personal contact information, including after-duty hours contact information, as appropriate (e.g., personal cellular phone numbers or landline phone numbers), e-mail addresses, home address, etc., are entered into the system and regularly updated or verified every 90 days to remain current and accurate.

· A Common Access Card (CAC) is required to register for ALERT!

· If a CAC has not been deemed necessary for the contractor (see below paragraph: Common Access Card (CAC), COR will send the following information to usarmy.tyad.tyad.mbx.secops-at@army.mil to manually input personnel data into ALERT!

· Full Name

· Cell Phone

· Is SMS ok for alerts? Yes or No

· Email

· Contractor: For what Cost Center

· Name of COR

· Expected length of contract In the event of a life-threatening emergency or natural disaster, COR will account for assigned contractors. COR will send personnel accountability report to Emergency Operations Center (EOC).

Base closure announcements will be disseminated via ALERT! MWNS.

Antiterrorism (AT) Level I Training. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training prior to contract report date. This training is required for any additional or new contractor employees, who start after that period. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR/POC within 10 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://jko.jten.mil course# JS-US007 for their training. Completion of contractor employee training will be documented on ELTY form 583, TYAD On-Post Training Record, or contractor equivalent. As applicable, contractor employees must complete annual AT awareness training as it pertains the length of the contract.

iWATCH Army Training. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award. Contractors and all associated sub-contractors will be briefed by the TYAD Antiterrorism/Force Protection officer. It is recommended this training be conducted as part of an initial entry briefing or unit/organization newcomer’s briefings.