N0018919QQ146.docx

N0018919QQ146

Section SF 1449 - CONTINUATION SHEET

PWS

Performance Work Statement (PWS) for SAS Environment & Code Review/Recommendations

1.0 Introduction:

NAVSUP Business System Center (BSC) requires an external review of the SAS architecture, methodology used by government SAS developers, and any custom code/scripts used in the normal course of WSS business. NAVSUP BSC also requires recommendations for improvement of the existing infrastructure, development processes, and code execution.

2.0 Background:

NAVSUP BSC Code 95, Data Analytics branch, has been tasked with overseeing a comprehensive review of the SAS application within the Navy Data Platform (NDP) environment. The intent is to identify areas of potential improvement in both the architecture and configuration of the SAS hardware as well as identify areas of improvement within the NAVSUP Weapon System Support (WSS) development process.

NAVSUP BSC Code 95 acts as the technology integrator and server administrators of the SAS servers within the larger NDP environment.

NAVSUP WSS acts as the SAS customer and developer, developing and consuming reports and metrics using the SAS application.

The SAS application environment is hosted at a NAVAIR facility in Patuxent River, MD and consists of 12 production servers and 5 development servers, broken out in the following roles:

3.0 Directives:

The contractor shall comply with the following directives, and any updated/future versions as they are released:

· Federal Information Security Modernization Act of 2014 (“FISMA”)

· DoD Directive 5400.11, DoD Privacy Program, 29 October 2014

· DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016 (incorporating Change 1 July 2017)

· DoD Directive 8140.01, Cyberspace Workforce Management, 11 August 2015 (incorporating Change 1, 31 July 2017)

· DoD Instruction 4161.02, Accountability and Management of Government Contract Property, 27 April 2012 (incorporating Change 1, 29 September 2017)

· DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017)

· DoD Instruction 8500.01, Cybersecurity, 14 March 2014

· DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, 12 March 2014 (incorporating Change 2, 28 July 2017)

· DoD Instruction 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems 6 June 2012 (incorporating Change 1, 27 October 2017)

· DoDD 5400.11-R, Department of Defense Privacy Program, 14 May 2007

· DoD Manual 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 (incorporating Change 4, 10 November 2015)

· SECNAV Instruction 5211.5E, Department of Navy Privacy Program, 28 December 2005

· SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May 2016

· SECNAV Instruction 5510.30B, DON Personnel Security Program Instruction, 6 October 2006

· SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

· SECNAV Manual M-5510.30, Department of the Navy Personnel Security Program, 1 June 2006

· CJCSI 6211.02D--Defense Information System Network (DISN): Policy Responsibilities and Processes of 4 August 201 5

· DoD Public Key Infrastructure (http://iase.disa.mil/pki-pke)

· ISO/IEC/IEEE 12207:2017(E) First edition 2017-11 - ISO/IEC/IEEE International Standard - Systems and software engineering -- Software life cycle processes

· ANSI/EIA 649.B-2011 – Configuration Management Standard.

· ANSI/EIA 836D-2015 – Configuration Management Data Exchange and Interoperability.

· Federal Risk and Authorization Management Program (“FedRAMP”)

· Department of Defense Cloud Computing Security Requirements Guide, Version 1, Release 3, dated 6 March 2017, or the version and release number in effect when cloud services are provided.

· All applicable Security Requirements Guides, Security Technical Implementation Guides, and National Security Agency security configuration guides in effect when cloud services are provided.

· Common Criteria for Information Technology Security Evaluation, Part 3: Security Assurance Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003; or the version and revision number in effect when the cloud services are provided.

· NIST SP 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010, includes updates as of 5 June 2014

· NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, April 2013, includes updates as of 22 January 2015

· NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations, December 2014, includes updates as of 18 December 2014

· ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management Systems - Requirements

· ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software Identification Tag

· ISO/IEC 19770 Series - Information Technology

· A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Sixth Edition

5.0 Requirements/Tasks:

The contractor shall perform every requirement in this performance work statement. Not every performance requirement has a related standard expressed in this document. In such cases the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

1.1 SAS Environment & Code Review/Recommendations, The contractor shall:

1.1.1 Evaluate WSS development process within SAS environment utilizing an automated discovery process. Provide a preliminary report of initial findings and recommendations within 60 days of receiving government system access. Provide an unbiased final report within 90 days of receiving government system access. Both reports should have a detailed and executive version to provide to system integrators and executive managers.

1.1.2 Evaluate SAS usage within the WSS organization to fit business needs. Provide an unbiased preliminary report of initial findings and recommendations within 60 days of receiving government system access. Provide a final report within 90 days of receiving government system access. Both reports should have a detailed and executive version to provide to system integrators and executive managers.

1.1.3 Perform analysis of SAS queries, code, and execution. Provide an unbiased preliminary report of initial findings and recommendations within 60 days of receiving government system access. Provide a final report within 90 days of receiving government system access. Both reports should have a detailed and executive version to provide to system integrators and executive managers.

1.1.4 Perform a comparative analysis of existing architecture and industry best standard enterprise architectures for similar SAS deployments. Provide an unbiased preliminary report of initial recommendations within 60 days of receiving government system access. Provide a final report within 90 days of receiving government system access. Both reports should have a detailed and executive version to provide to system integrators and executive managers.

1.1.5 Provide an unbiased briefing of analysis and recommendations. Briefing shall be provided within 10 days of the end of the period of performance (POP). Report should be in executive briefing format.

1.2 Mentoring and Knowledge Transfer Services.

The contractor shall provide weekly knowledge transfer sessions to government personnel identified by the TA.

6.0 Deliverables:

All deliverables must meet the format requirements specified by the Contracting Officer’s Representative. Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

6.1 Weekly Status Report. Status reports shall be sent electronically to the Technical Assistant (TA) and Contracting Officer’s Representative (COR) within seven (7) days following the end of the monthly period documenting the performance. The monthly status report shall include the following elements:

· Resources by name

· Date project/task received

· Status of work with accomplishments documented

· Percentage of project/task completed

· Estimated date of project/task completion

· Any issues/problems encountered or possible and recommended solutions

· Changes to the Project Management Plan (PMP) to include roles and responsibilities and schedule changes

· Identify any Government dependencies that are overdue which impact schedule or performance

· Evaluate performance and determine adequacy of staffing.

6.2 Mentoring/Knowledge Transfer documentation, lesson plans, and mentoring reports. The mentoring report shall include:

· Trainer Name

· Trainee Name

· Date Knowledge Transfer began

· Date Knowledge Transfer completed

· Description of skill/knowledge area

Unless stated otherwise, the following instructions apply to all deliverables:

7.0 Performance Standards Summary:

SAS Code Review

8.0 Period of Performance:

The final deliverables shall be completed and delivered no later than 6 months from the date of award. Services shall start no later than 30 September 2019. No contractor services shall be performed Saturdays, Sundays, Government Holidays or during base closures without prior approval from the TA. The contractor shall follow Naval Support Activity base policy for reporting to work during severe weather and base closure. The contractor is not authorized to begin work until both the Visit Authorization Request (VAR) and System Authorization Access Request - Navy (SAAR-N) forms have been successfully processed and base and system access have been granted.

ON-BOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. An employee is considered to be “productive” upon completion of the following items:

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. Information Assurance (IA) certification (if applicable)

9.0 Place of Performance:

Work will be performed at NAVSUP BSC located at 5450 Carlisle Pike, Mechanicsburg, PA 17050-2411. Remote work is authorized with the coordination and approval of the COR.

10.0 Travel:

No Travel is required.

11.0 Security:

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

SUPTXT204-9400(7-18) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (JUN 2018)

Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, and Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this text will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy Command's Security Manager and Information System Security Manager (ISSM)/Information Assurance Manager (IAM) upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the "supervisor".

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness) training, and maintain a current requisite background investigation. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this text including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this text in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor's Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor's Security Representative. The Contractor's Security Representative shall be the primary point of contact on any security matter. The Contractor's Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

.SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product) .Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) .Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command's Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command's Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM)Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command's Security Manager at least 30 days prior to the individual's start date. Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command's Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command's Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor's Security Representative. Although the contractor will take JPAS "Owning" role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

. Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and . Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor's Security Representative must submit for all employees each of the following:

. SF-85 Questionnaire for Non-Sensitive Positions . Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) . Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM

Failure to provide the required documentation at least 30 days prior to the individual's start date may result in delaying the individual's start date.

* Consult with your Command Security Manager and Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM) for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

(End of Clause)

DoD 8570.01-M Information Assurance Workforce Improvement Program.

___X__ No Additional IA Certification Required _____ Information Assurance DoD 8570.01-M Required:

IA Certification Level

DoD Directive 8570.1 of 15 Aug 2004, Information Assurance Training, Certification, and Workforce Management DoD 8570.01- Manual of 19 December 2005, IA Workforce Improvement Program SECNAV Instruction 5239.3B of 17 June 2009, DON Information Assurance Policy SECNAV Manual-5239.2 of 29 May 2009, DON Information Assurance Workforce Management Manual to Support the Information Assurance Workforce Improvement Program

Computing Environment Certification _X_ Red Hat or similar Unix OS-level certifications are required.

Privileged system access is not required. A DD254 Contract Security Classification is not required.

The contracting officer will ensure that contractor personnel accessing DoD information systems have the appropriate and current information assurance baseline certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. Prior to being engaged and upon request by the Government, the Contractor shall provide documentation supporting the information assurance baseline certification status of personnel performing information assurance functions to the contracting officer. Contractor personnel who do not provide appropriate and current baseline certifications shall be deemed unauthorized to access DoD information systems.

The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including-

(1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M.

(2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

(a) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(b) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

12.0 Government Provided Equipment:

The government will provide work facilities to the on-site contractor. The government will provide appropriate desk spaces if necessary and access to government SAS users and administrators.

14.0 Non-Disclosure Agreement:

Contractor and subcontractor employees performing work under this performance are required to sign a Non-Disclosure Agreement (NDA) as part of their onboarding process. The contractor shall maintain copies of all signed agreements and have the documents readily available at the COR’s request. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

15.0 NAVSUP Business Systems Center Procedures for Contractor Access/Visit Authorization Request (VAR):

1. A company letter to the Technical Assistant (TA) containing the following information:

a. Contract Information

(1) Contract Number

(2) Date Issued

(3) Date of Expiration

(4) Name and phone number of the TA

(5) Purpose

(6) Systems to be accessed

(7) Files/Data required

(8) Type of access required (i.e., inquiry/update/delete)

(9) Equipment to be used with location and mode of access identified

(10) Security point of contact including address and phone number

b. Information for all contractor employees requesting access, to include:

(1) Full Name

(2) Job Title

(3) Date of Birth

(4) Place of Birth

(5) Citizenship

(6) Social Security Number

(7) Naturalization Number (if applicable)

(8) Type and date of Security Investigation.

(9) Government Clearance Level (if applicable)

(10) Valid email address for the Contractor’s employee

c. Appropriate Company Official's signature

16.0 Enterprise-wide Contractor Manpower Reporting Application (ECMRA):

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address: https://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.ecmra.mil.

17.0 Points of Contact:

TA:

Name: Patrick Mitchell Organization/Code: NAVSUP Business Systems Center (Code 9513) Address: 5450 Carlisle Pike, Bldg 409 Mechanicsburg, PA 17050 Phone: 717-605-4383 E-mail: Patrick.a.mitchell1@@navy.mil

COR/Invoice Acceptor:

Name: Alanna Keck Organization/Code: NAVSUP Business Systems Center (Code 9113) Address: 5450 Carlisle Pike, Bldg 409 Mechanicsburg PA 17050 Phone: 717-605-0787 E-mail: alanna.keck@navy.mil

INSTRUCTIONS TO OFFEROR

This Request for Quote (RFQ) is being solicited under FAR Part 13 Simplified Acquisition Procedures.

TYPE OF CONTRACT: FIRM-FIXED PRICE

PROPOSAL SUBMITTAL INSTRUCTIONS:

DUE DATE: 09/13/2019 AT 11:00AM EST

SUBMIT TO: mark.stumpo@navy.mill SUBMITTAL FORMAT: Electronically via email

The price quote submission shall include the following:

All price and price supporting information shall be contained in the price submission. Quoter is responsible for submitting sufficient information to enable the Government to fully evaluate their price.

The price submission is not page limited, but is strictly limited to the information listed above.

The technical quote shall include:

(a) A brief but detailed submission that demonstrates of a thorough understanding of the requirement and the tasks as stated in the PWS. This shall outline the method and or tools the contractor will use to review and analyze SAS and Netezza code. How the code review data will be provided to the Government. The overall approach to the project with regards to the timelines established in the PWS.

(b) Contractor experience with this type of work.

(c) The quotes shall also identify any potential obstacles and risks associated with the work and any assumptions made as well as risk mitigation strategies for the obstacles and risks identified.

(d) Quotes shall provide what qualified resources are able to be cleared to work on federal contracts and are available or can be made available to begin work no later than 09/30/2019.

EVALUATION CRITERIA

The Government will award a purchase order resulting from this solicitation to the responsible quoter whose quote conforming to the solicitation represents the best value to the Government after a comparative evaluation of the quotes. The award determination will consider both price and non-price factors and the Government reserves the right to award to other than the lowest price.

As a result, the following factors will be used to evaluate quotes:

1. Approach evaluation will be based on quoter’s demonstration of a thorough understanding of the requirement and the tasks as stated in the PWS to include;

a. Method/tools contractor will use to review and analyze SAS and Netezza code.

b. How the code review data will be provided.

c. Overall approach to the project with regards to timelines.

d. Contractor experience with this type of work.

2. Quotes shall identify any potential obstacles and risks associated with the work and any assumptions made as well as risk mitigation strategies for the obstacles and risks identified.

3. Performance Start – Quotes shall state that qualified resources that are able to be cleared to work on federal contracts are available or can be made available to begin work by 09/30/2019.

4. Price - The quoter's price will be evaluated to determine the price fair and reasonable. The evaluation may include, but is not limited to, the price analysis techniques listed at FAR 13.106-3(a)(2). Quotes shall provide a breakdown of a firm fixed price to include labor categories, estimated hours, labor rate, and any other factor that went into developing the total FFP.

SAS Code Review Support

FFP

SAS Code Review Support IAW PWS FOB: Destination

MILSTRIP: N5006119PR00055

PURCHASE REQUEST NUMBER: 1300793798

PSC CD: D318

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

DELIVERY INFORMATION

PATRICK MITCHELL

5450 CARLISLE PIKE BUILDING 409

MECHANICSBURG PA 17050-2411

717-605-4383 FOB: Destination N00367

CLAUSES INCORPORATED BY REFERENCE

CLAUSES INCORPORATED BY FULL TEXT

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2019)

(a) Definitions. As used in this provision— “Covered telecommunications equipment or services,” “Critical technology,” and “Substantial or essential component” have the meanings provided in clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Contractors are not prohibited from providing—

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Representation. The Offeror represents that—

It ___ will, ____ will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation.

(d) Disclosures. If the Offeror has responded affirmatively to the representation in paragraph (c) of this provision, the Offeror shall provide the following information as part of the offer

(1) All covered telecommunications equipment and services offered (include brand; model number, such as original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable);

(2) Explanation of the proposed use of covered telecommunications equipment and services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b) of this provision;

(3) For services, the entity providing the covered telecommunications services (include entity name, unique entity identifier, and Commercial and Government Entity (CAGE) code, if known); and

(4) For equipment, the entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known).

(End of provision)

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2019)

(a) Definitions. As used in this clause—

“Covered foreign country” means The People’s Republic of China.

“Covered telecommunications equipment or services” means–

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country

“Critical technology” means–

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled-

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology;

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817). “Substantial or essential component” means any component necessary for the proper function or performance of a piece of equipment, system, or service

(b) Prohibition. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in Federal Acquisition Regulation 4.2104.

(c) Exceptions. This clause does not prohibit contractors from providing—

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement.

(1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph (d)(2) of this clause to the Contracting Officer, unless elsewhere in this contract are established procedures for reporting the information; in the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause

(i) Within one business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

(End of clause)

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS--COMMERCIAL ITEMS (MAY 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(4) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: (Contracting Officer check as appropriate.)

___ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

____ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

____ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

X (4) 52.204-10,…