NAMA-17-R-0003_LACS_Solicitation_Amendment_003.docx

NARA—NAMA-17-R-0003, LACS Integration

ATTACHMENT 1

SCHEDULE OF PRICES

1. SERVICES TO BE FURNISHED

(a) The purpose of this contract is to acquire services to assess and implement a logical access control system at the National Archives and Records Administration (NARA). All services must be provided in accordance with the terms and conditions of this single award Indefinite Delivery / Indefinite Quantity (IDIQ) contract with primarily firm-fixed price task orders, with the option for labor hour/time and material orders.

(b) Fixed Price (FP). The Contractor is required to furnish all the work that can be identified in advance, both in sufficient detail, and for which a fair and reasonable price can be obtained. The FP must include the fully burdened cost for delivering the services required by this contract. All work in the Performance Work Statement (PWS) is considered fixed price work, except for the “ODC/ Non-Local Travel”.

(c) ODC/ Non-Local Travel. The NTE amount listed is the maximum amount, in the performance period, the Government has reserved for the purchase of other direct costs and travel outside the local area, which are not considered part of the term licenses customarily offered by the Contractor. Should the Contractor exceed this amount in the performance of work under this contract it does so at its own risk.

2. SCHEDULE OF PRICES

The Schedule of Prices should reflect a summary of all proposed labor categories and/or ODC’s. To substantiate its pricing, the contractor shall attach a separate spreadsheet with a detailed view of the proposed labor categories, fixed hourly rates, and ODC’s. The Government reserves the right to not pay for ODCs which, are not clearly identified and explained in the Contractor’s proposal. The Government does not guarantee that ODCs will be included in the resulting contract and/or task orders.

CLIN = Contract Line Item Number; IAW = In accordance with; MIN= Minimum Guaranteed MAX= Maximum; Mo. = Month; NTE = Not-to-Exceed.

Base Year: Months 1-12

Option Year I: Months 13-24

Option Year II: Months 25-36

Option Year III: Months 37-48

Option Year IV: Months 49-60

*Half of the total Option Year IV pricing will be added to the total contract price to account for 6 additional months of service, in accordance with FAR 52.217-8. The 6 additional months do not need to be priced separately in the price proposal. It is for government price analysis only.

ATTACHMENT 2

PERFORMANCE WORK STATEMENT (PWS)

LOGICAL ACCESS CONTROL SYSTEM (LACS) INTEGRATION

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country so that people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 NARA operates a Wide Area Network (WAN) that provides network services to all NARA facilities throughout the country. This network is known as NARANet. The services of NARA’s General Support System (GSS) are provided by Micro Focus (Suse Linux) and the authoritative directory for identity is e-Directory, with subordinate Active Directory domains used by specific applications. NARA's Identity and Access Management (IAM) system provides access governance to NARA’s premises IT systems. In many cases, this access is managed from the NARA Identity Management System (IDMS).

2.0 SCOPE OF WORK

2.1 The scope of work includes all personnel and resources necessary to establish, refine, develop, test, implement, and manage an optimal Homeland Security Presidential Directive (HSPD)-12 compliant IAM program within the NARA enterprise. The Contractor must provide the personnel and resources necessary to support NARA’s IAM program which includes both the Logical Access Control (LAC) and Physical Access Control (PAC) requirements as described herein, except for those specifically identified as Government-furnished. The Contractor shall be required to meet with Government personnel and other NARA contractors throughout the term of this contract on an ad hoc basis, as needed to effectively perform services required herein. The Contractor shall coordinate meetings with other NARA contractors through Government personnel and only meet with other NARA contractors with Government personnel present.

2.2 The Contractor shall be required to perform these services during normal hours of operation, as needed, at Archives II, 8601 Adelphi Road College Park, MD 20740. However, the Contractor may be required to travel to other NARA sites listed in PWS Attachment 1, NARA Facilities Nationwide depending on project needs. The Contractor may coordinate working off site with approval from the Contracting Officer’s Representative (COR) on an ad-hoc basis.

2.2.1 Normal hours of operation at NARA - Archives II are between the hours of 6:30 A.M. and 6:30 P.M. EST, Monday through Friday, 52 weeks a year excluding weekends and Federal holidays. During these hours, the Contractor shall provide sufficient staffing levels to perform the required services.

2.2.2 Federal holidays observed by NARA

2.2.2.1 In addition to the holidays listed above, any day specifically declared by the President of the United States will be considered a Federal holiday.

2.2.2.2 When a holiday falls on a Sunday, the following Monday shall be observed as the Federal holiday. When a holiday falls on a Saturday, the preceding Friday shall be observed as the Federal holiday

2.3 Contractor personnel shall be on-call before and after the normal hours of operation, including weekends (Saturday and Sunday) and holidays. To support emergency operations, maintenance and testing schedules, and to assist with NARA’s requirement of 99.9% operational uptime for NARANet. On call support averages 40 hours per year.

2.4 In the event of a NARA facility closure, the Contractor is expected to work remotely and generally be available via email or phone. The Contractor shall check the operating status of the Government at www.opm.gov and/or call (301)-837-0700 to obtain the latest NARA facility status. If the Government operating status at www.opm.gov authorizes unscheduled telework, the Contractor shall report to NARA unless otherwise directed by the COR.

2.5 All services and Electronic Information Technology (EIT) delivered as result of subsequent ID/IQ task orders shall comply with accessibility standards in accordance with FAR Subpart 39.2, Electronic and Information Technology as required by Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended. Information about the Section 508 Electronic and Information Technology Accessibility Standards may be obtained via the Web at the following uniform resource locator (URL): www.Section508.gov.

2.6 The primary location of this contract is located at the NARA site located at 8601 Adelphi Road, College Park, Maryland. NARA may also request travel to other geographically separated NARA locations, as required.

3.0 DESCRIPTION OF SERVICES

3.1 NARA’s objective is to obtain professional services for the design, testing, implementation, deployment, and continuous operational support for NARA’s HSPD-12, Personal Identity Verification (PIV) 2, LACS, and overall IDMS. The Contractor must support the implementation of technical mandatory authentication to the network for all NARA users. The Contractor must provide research, design, development, and integration of two-factor PIV authentication of NARA infrastructure devices and applications. Additionally, the Contractor must provide a Derived Credential LACS solution for all NARA supported mobile devices, along with all other tasks outlined in this PWS.

3.2 Identity and Access Management System

3.2.1 Architecture Analysis and Design. The Contractor shall perform architecture support for NARA IDMS and IAM systems which include Micro Focus’s eDirectory Services, Micro Focus Identity Management systems, Micro Focus Access Management systems, Microsoft Active Directory Services, Remedy Service Ticketing, SecureAuth Web Based Single Sign-On (SSO), Gmail Directory Services, and System Authentication and Access Controls. The current IDMS configuration consists of eight (8) total Micro Focus Drivers. Specific tasks may include, but are not limited to:

3.2.1.1 Coordinate, manage and participate on NARA IAM projects;

3.2.1.2 Provide architecture analysis and recommendations on NARA IAM projects; and

3.2.1.3 Provide impact assessments of architecture changes to NARA IAM systems.

3.2.2 Development, Testing, and Release of New Architecture(s) or changes to the IDMS. The Contractor shall provide the development, testing, and release of new and existing Identity Management drivers into the IDMS. The Contractor shall add new IDMS drivers to the infrastructure on an “as needed” basis, as NARA instantiates new systems. On average, the Contractor shall add five (5) drivers per year, though a not-to-exceed number will be determined on a task order level. During the term of this contract, the Contractor shall:

3.2.2.1. Update of the existing HR driver to use the IBC interface which allows two way synchronization of employee information.

3.2.2.2. Develop a driver to synchronize Contractor information from the IBC Contractor module to include full user provisioning of new accounts.

3.2.2.3 Update the existing integration of General Services Administration (GSA) Managed Service Office (MSO) SIP US Access into NARA IDMS to enroll new users that have been provisioned from Human Resources (HR) Systems and to update user information in GSA, as needed from NARA IDMS.

3.2.2.4 Create an IDMS driver to synchronize users into a new NARA Active Directory (AD) domain to include user provisioning and the required fields for PIV Authentication from the NARA IDMS system. This environment will ultimately include all NARA desktops and Windows OS servers.

3.2.2.5 Develop, test and release new and existing Access Management Systems for HSPD-12 compliant access and Single Sign-On, to include adding redundancy, monitoring and the configuration of additional applications for authentication. It is expected that on average five applications will be added for authentication per year. Focus on SSO support and configuration assistance for major NARA Applications (FISMA reportable) high value applications.

3.2.2.6 Develop, test and release the enterprise Password Self Service Portal, to include redundancy and addition of PIV authentication to the portal.

3.2.2.7 Integrate and refine the IDMS driver integration with NARA Remedy Helpdesk system into the NARA IDMS.

3.2.2.8 Configure the NARA Citrix remote access system to allow PIV authentication.

3.2.2.9 Integrate the Digital Signature and Encryption certificates into the IDMS in support of the NARA Initiative to digitally sign all documents using PIV Card signing certs.

3.2.2.10 Provide support for technical mandatory two-factor authentication to the network for all NARA users.

3.3 Continuing Refinement, Contingency Planning, and Monitoring

3.3.1 Continue refinement of procedures to handle and support forgotten PIN, forgotten or lost PIV card, and resolution of revoked certificates.

3.3.2 Provide monitoring of the NARA PIV Environment, NARA IAM systems, and authentication directories including: adding redundancy to the existing Sentinel system; addition of event sources from NARA IDM; NARA Active Directory servers; and creation of additional reports as needed, it is expected that an average of five (5) reports will be added per year.

3.3.2.1 Provide automated solution to update of NARA IDM with last login event using a PIV credential as known to Sentinel to facilitate consolidated authentication reports.

3.3.3 Provide Contingency Plan for backing up and restoring configurations of IDMS.

3.3.3.1 Contingency Plan shall include creating backup procedures of IDMS drivers and restore activities.

3.3.3.2 Implement Contingency Plan for backing up and restoring configurations of IDMS.

3.3.3.3 Restore of IDMS configurations shall be performed at least once per quarter.

3.4 Implementation of improved reporting from US Access, IDMS and the network in order to provide transparency to stakeholders and managers regarding the PIV-2 card enrollment status and PIV enablement process, FISMA metrics.

3.4.1 Provide web interface available to system owners to run pre-configured reports.

3.4.2 Allow reporting to include information from all IDMS connected systems.

3.4.3 Create new reports based on reporting needs, it is expected that an average of (5) five new reports per year will be required.

3.5 Create implementation plan for Privileged User Management of NARA personnel with elevated access to all major applications or NARA enterprise systems.

3.6 Create implementation plan for Standard User Management of NARA personnel access to NARANet.

3.6.1 Implementation plan for Standard User Management of NARA personnel access to NARANet shall include the technical mandatory conversion of all NARA personnel.

3.7 Create implementation plan for HSPD-12 compliant SSO enabled access to all infrastructure devices and all major NARA applications.

3.8 Create plan for the convergence of NARA Logical Access Systems and Physical Access Control (PAC) systems. The plan will list all existing PAC systems and implementation plan for each.

3.8.1 Integrate and refine NARA PACS System (Lenel) into the NARA IDMS for Archives I and Archives II.

3.9 System Support Tasks The Contractor shall perform problem fault/diagnostic assistance and restoration of services on systems based on the Micro Focus and Microsoft products. Specific tasks shall include, but are not limited to:

3.9.1 Support for PIV enabled authentication for NARA infrastructure devices.

3.9.2 Support for PIV enabled authentication to NARA applications, it is expected that as systems are added to the HSPD-12 SSO solution, the systems will be supported by the Contractor. During the base year this will include approximately (5) high value NARA applications.

3.9.3 Support for forced PIV Login using directory policies.

3.9.4 Coordinate and manage requests for third party technical support for authentication needs based on IDMS managed credentials.

3.9.5 Coordinate, manage, and resolve trouble tickets submitted through Remedy in regard to PIV enabled authentication and IDMS connected systems.

3.9.5.1 Contractor shall develop and maintain operational level agreements (OLAs) and service level agreements (SLAs) to ensure the following:

3.9.5.2 The OLAs and SLAs adequately address the customer’s needs and provide the required services and support in the most efficient and cost-effect manner possible.

3.9.5.3 OLAs and SLAs are measured and monitored to include at a minimum,

· acknowledging a customer request or problem;

· providing an estimated time to completion or fix the request or problem; and

· maintaining the service or system availabilities.

3.9.5.4 Supporting other NARA system support staff in identifying problems, root cause analysis and implementation of problem resolutions, relating to Micro Focus Identity Management and Access Management Systems. Support tasks include expert knowledge in the troubleshooting of the following Micro Focus IDMS Drivers: eDirectory driver, Active Directory Remote Loader driver, Java Database Connectivity (JDBC) driver, Loopback driver, Delimited Text driver, Micro Focus Google Driver.

3.9.6 Provide Tier 3(**) level of support of the Enterprise eDirectory, Active Directory, LDAP, Public Key Infrastructure (PKI), and Sentinel SIEM systems

3.9.7 Provide Tier 2 and Tier 3 level of support for NARA-wide PIV authentication deployment.

3.10 System Configuration Tasks The Contractor shall configure systems as requested by COR. The Contractor shall suggest a proper system configuration; changes will be approved through the NARA Request for Change (RFC) process. Specific tasks may include, but are not limited to:

3.10.1 Configure directory and identity services database schemas for NARA systems.

3.10.2 Configure security controls for systems configured for authentication through the Micro Focus Access Manager.

3.10.3 Configure identity management system policies and rules.

3.10.4 Configure and executing automated tests leveraging the NARA automated test framework (IdMUnit) for IDMS driver integrations with connected systems.

3.10.5 Configure system redundancy and high availability for the Enterprise Password Self-Service solution.

3.10.6 Design and configuration for key system components as defined in PWS paragraph 3.3 to facilitate: disaster recovery, fault tolerance, load balancing and performance testing.

3.10.7 Assist in the design and architecture of the NARA LDAP authentication services.

3.10.8 Support security requirements, to include hardening and documentation, for initial Authority to Operate (ATO) and Continuous Authorization activities on all new or updated systems associated with Contractor efforts specifically outlined in section 3.2.

4.0 Additional Services

May include, but are not limited to:

4.1 Design, develop, test, and implement a Derived Credential (PIV-D) LACS solution for all of the NARA mobile devices. Specific tasks may include, but are not limited:

4.1.1 Develop an end-to-end solution for issuing, managing, and authenticating with a Derived Credential for NARA mobile devices (Apple iOS and Android).

4.1.2 PIV-D enablement to NARA electronic mail application.

4.1.3 Mobile Device Management (MDM) Integration (Multiple MDMs).

4.1.4 Internal Certificate Authority (CA) Integration for PIV-D.

4.1.5 PIV-D Request Service.

4.1.6 Web Request User Interface (Hosted UI instead of through iPAD, tablet, or Device App)

4.1.7 iOS iPAD Application Updates.

4.1.8 Encryption and Signing Testing.

4.2 NARA Public Access Security System (NARA-PASS): The Contractor shall provide continued support and design activities for NARA-PASS: an account and authentication system for external restricted access to NARA data available in the DMZ. Specific tasks may include, but are not limited to include:

4.2.1 Configure reporting interface.

4.2.2 Cluster the NARA-PASS servers for full redundancy with servers at both data centers, A2 and ABL.

4.2.3 Facilitate the use of Security Assertion Markup Language (SAML) authentication to the Identity Provider (IDP) servers.

4.2.4 Document system configuration of the NARA PASS System and each connected system.

4.2.5 Additional NARA-PASS tasks may include, but are not limited to:

4.2.5.1 NARA-PASS ongoing Tier 2 and Tier 3 support.

4.2.5.2 NARA-PASS enable applications as requested by NARA Application Areas;

4.2.5.3 Helpdesk support documentation.

4.2.5.4 Deploy Future software releases.

4.2.5.5 Provide System monitoring.

4.2.5.6 Provide end user training documentation.

4.2.5.7 Provide testing for NARA-PASS enabled authentication.

4.2.5.8 Add online help documentation.

4.2.5.9 Document system configuration.

4.2.5.10 Configure a generic NARA-PASS interface to allow a more dynamic, template deployment for future applications that take advantage of NARA-PASS.

4.2.5.11 Develop methodology and standards for incorporating new user registrations for applications.

4.2.5.12 Develop and assist with drivers to facilitate workflow processes to perform automated service request resolution.

4.3 Access Governance Solution

4.3.1 Implementation of Privileged Account Management:

4.3.1.1 Database privileged account monitoring for users, tools and applications.

4.3.1.2 Risk-based session control to enable automatic session termination or access revocation.

4.3.1.3 Remote session establishment and control for operating systems.

4.3.1.4 Risk profiling that quickly identifies high-risk users.

4.3.1.5 Smart risk ratings built on potential threat analysis.

4.3.1.6 Keystroke logging that allows complete review of any session of interest.

4.3.1.7 Comprehensive audit capabilities for complete compliance management and forensic analysis.

4.3.2 Implementation of Two Factor Authentication of Infrastructure Device.

4.3.3 Implementation of Two Factor Authentication of all Major NARA applications.

5.0 TASK ORDER PROJECT MANAGEMENT

5.1 The Contractor shall be responsible for managing all aspects of the services required within each task order Performance Work Statement (PWS). Project management shall include the ability and resources to define, plan, implement, integrate, and monitor every aspect of the service. The Contractor’s Project Manager shall provide management and technical oversight in coordination with the COR and NARA Project Manager to ensure that the project successfully achieves its objectives on time, within budget, and in accordance with expected quality levels.

5.2 For each task order against this IDIQ, the Contractor shall develop and deliver a Project Management Plan (PMP). The PMP shall describe the Contractor’s overall strategy and approach to managing the services required. The PMP shall address the following:

5.2.1 Project management methodology;

5.2.2 Subcontractor management (if applicable);

5.2.3 Communications management;

5.2.4 Logistics;

5.2.5 System Configuration management;

5.2.6 Risk Management Plan (risk identification, mitigation, and management);

5.2.7 Configuration management;

5.2.8 System Operations and Maintenance support; and

5.2.9 Milestones, deliverables, and dependencies for the completion of the project.

5.3 The Contractor shall submit updates and changes to the PMP after its finalization, as appropriate, to reflect the project status.

5.4 The Contractor shall be required to submit project plans on an ad hoc basis, as new system integrations, modules, upgrades, or tasks related to this PWS are ordered.

5.5 The Contractor shall provide monthly status reports (due the 1st business day of each month) which, shall include the following:

5.5.1 Tasks accomplished within the previous month, progress towards completion of the scheduled tasks, and deliverables submitted;

5.5.2 Updated project schedule (must include original baseline dates, planned dates, and actual dates);

5.5.3 Planned activities for the current month and dependencies on completing those tasks;

5.5.4 Any problems, issues, or explanations of schedule slippages, in the previous month, to include recommendations on remediation of those issues, plan for recovery from the schedule slippage, and potential impact to the timely delivery of services within acceptable quality standards; and

5.5.5 Any projected or actual risks to successful completion of the project to include the remediation or mitigation of those risks, as necessary.

5.6 The Contractor shall provide management briefings on an ad hoc basis, if requested by the COR regarding the overall status of project.

6.0 DELIVERABLES AND PERFORMANCE MEASURES AND STANDARDS

Deliverables, performance measures and standards will be identified at the task order level. They will be used to evaluate the Contractor's performance along with the acceptable quality level (AQL). The Contractor's performance will be assessed randomly throughout the task order period of performance in accordance with the QASP.

7.0 PERSONNEL

The personnel performing work on this project shall be qualified and maintain professional competence in their areas of specialization. Contractor personnel shall have proven expertise in performing the requested services. All Contractor personnel assigned to a task order are required to complete and return to the COR PWS Attachment 8, Non-Disclosure Agreement, prior to performing work under this requirement.

7.1 Key Personnel. The following positions are considered essential to achieving the desired outcomes for the services required herein. The Contractor shall provide personnel to fulfill these positions who meet the minimum qualifications for each designated position.

7.1.1 Program Manager. The Program Manager shall be responsible for project management, quality control, and overall task order performance this reward. The Project Manager shall ensure adherence to program management reporting, integrated schedules, task order reporting requirements, and will serve as the Contractor’s primary point of contact. The qualifications required are:

7.1.1.1 Must have a minimum of seven (7) years of experience managing complex IT projects, which involved many dynamic interacting parts and coordinating all activities required to undertake these types of projects.

7.1.1.2 Must have a solid understanding of IT Systems and Software Development Lifecycle including, experience with HSPD-12, PIV, FICAM, and Identity Management as demonstrated by training and/or experience.

7.2 General Personnel Qualifications. The Contractor shall provide personnel with the required skills and experience levels to fulfill the requirements of this task order.

7.2.1 The Contractor’s personnel must have experience in the administration of large and small systems. The Contractor’s personnel must be able to work independently on the projects assigned, work well in a team environment, and have good verbal and written communication skills.

7.2.2 The Contractor’s personnel must have relevant skills and experience in the following areas. Note: The personnel qualifications and experience are not necessarily applicable for one candidate. NARA requires a mix of personnel to perform these services whose knowledge skills and experience meet the requirements:

7.2.2.1 Architecture and Design:

· Smart card development/configuration for logical access of IT resources.

· Directory authentication systems.

· Experience implementing Federal Identity, Credential and Access Management (FICAM) systems.

· Experience implementing FICAM systems that are interoperable across federated environments (beyond the firewall).

· Lenel (or other) badge system integration.

· Microsoft Active Directory provisioning.

· Experience configuring and LACS-enabling Encryption.

· Development experience with Microsoft Kerberos, LDAP, Oracle OID, SecureAuth, and other single sign-on enabled authentication layer technologies.

· Development experience with Microsoft Authentication Services.

· Development experience with Citrix NetScaler integration.

· Development experience with Cisco Prime integration.

· Development experience with Remedy Ticketing System integration.

· Development experience with NetIQ Sentinel Enterprise.

· Development experience with NetIQ Identity Manager.

7.2.2.2 PIV2 Smartcard:

· Directory authentication and authorization based on PIV2 card certificates, signatures and associated identity.

· Integration of PIV2 card attributes of details with connected network infrastructure such as the user principal name, unique ID, proximity ID, and other stored characteristics.

7.2.2.3 Identity Management:

· Experience in identity management support infrastructure.

· Experience with the LDAP protocol and schema.

· Experience with SAML and SAML 2 protocols and technologies.

· Experience with SOAP/REST protocols and technologies.

7.2.2.4 General:

· Experience with the integration of badge systems and databases.

· Experience federating identity between organizations following open standards for interoperability.

8.0 QUALITY CONTROL

8.1 The Contractor is responsible for proactively monitoring and controlling the quality of services and related products in this PWS.

8.2 The Contractor shall plan and perform quality inspections, and shall perform all quality inspections requested by the COR.

8.3 The Contractor shall perform quality inspections prior to requesting NARA’s acceptance of the Contractor’s work. The Contractor shall document the results of all quality inspections. The Contractor shall resolve all quality issues.

8.4 The Contractor shall provide a report to the COR that details the results of completed quality inspections and corrective actions to be taken.

8.5 The Contractor shall implement an inspection system that includes both scheduled and unscheduled inspections and covers all services and related products listed in the PWS, and describe that system and the frequency of inspections in its Quality Control Plan (QCP). The Contractor’s inspection system shall facilitate continuous improvement and address any negative trends or rejected work, provide a means to correct deficiencies, and document all corrective actions taken. The Contractor shall describe these aspects of its system in its QCP.

8.6 The Contractor shall create an internal quality control and inspection organizational structure and describe its feedback system and lines of authority for quality control. This organizational structure shall identify procedures for interfacing with the Government. The details of this shall be included in the QCP.

8.7 The Government reserves the right to determine the QCP unacceptable at any time during contract performance. If the QCP is found to be unacceptable, the CO will notify the Contractor and take action to enforce the Inspection of Services clause, requiring an inspection system acceptable to the Government.

9.0 GOVERNMENT FURNISHED INFORMATION / EQUIPMENT

9.1 Government Furnished Equipment (GFE). While, specific GFE will be provided at the task order level, the Government may provide Government Furnished Equipment, if needed, one (1) each: desk, telephone, and computer at Archives. All GFE is governed by FAR clauses 52.245-1, Government Property Alternate I (Apr 2012) and shall be returned to the COR within five (5) business days after completion of the project.

9.2 Government Furnished Information (GFI).

9.2.1 The Contractor shall use all the deliverables provided under previous contract NAMA-14-F-0170.

9.2.2 Prior to release and during the course of each task order, NARA will provide the Contractor with access to information about NARA’s network architecture and operational procedures that relate to and are required to successfully complete the task order.

9.2.3 Contractors are required to comply with NARA’s security policies and procedures at all times with respect to protecting and controlling the use of this information.

9.2.4 All government furnished information will be provided to the Contractor as needed.

PWS ENCLOSURE

NARA FACILITIES NATIONWIDE

Arkansas

Little Rock - William J. Clinton Presidential Library and Museum - Presidential Library 1200 President Clinton Avenue, Little Rock, Arkansas 72201 (plus some warehouse space not included in count)

California

Laguna Niguel - NARA's Pacific Region (Laguna Niguel) - (records and staff moved to Riverside – building only includes a small RM staff in offices) Chet Holifield Federal Building, 24000 Avila Road, 1st Floor, East Entrance, Laguna Niguel, California 92677-3497

Riverside - NARA's Pacific Region (Riverside, CA) – Regional Archives and Records Center 23123 Cajalco Road, Perris, California 92570-7298

San Francisco (San Bruno) - NARA's Pacific Region (San Francisco) – Regional Archives and Records Center, Leo J. Ryan Building, 1000 Commodore Drive, San Bruno, California 94066-2350

Simi Valley - Ronald Reagan Library - Presidential Library, 40 Presidential Drive, Simi Valley, California 93065-0699

Yorba Linda – Richard Nixon Library – Presidential Library, 18001 Yorba Linda Blvd. Yorba Linda, California 92886-3903

Colorado

Denver - NARA's Rocky Mountain Region – National Archives and Federal Records Center, 17101 Huron St. Broomfield, CO 80023

District of Columbia

National Archives Building - Archives, 700 Pennsylvania Avenue, NW, Washington, DC 20408

The Federal Register – Offices of the Federal Register and Office of Government Information Services, 800 North Capitol Street, NW, Washington, DC 20002

Georgia

Atlanta - NARA's Southeast Region – Regional Archives and Records Center, Southeast Regional Archives, 5780 Jonesboro Road, Morrow, Georgia 30260

Atlanta – NARA's Southeast Region - Southeast Regional Records Center, 4712 South park Blvd., Ellenwood, Georgia 30294

Atlanta - Jimmy Carter Library and Museum - Presidential Library, 441 Freedom Parkway, Atlanta, Georgia 30307-1498

Illinois

Chicago - NARA's Great Lakes Region (Chicago) – Regional Archives and Records Center, 7358 South Pulaski Road, Chicago, Illinois 60629-5898

Valmeyer - NPRC Annex Records Center (Civilian), 1411 Boulder Boulevard, Valmeyer, IL 62295

Great Lake Naval Recruit Center – Palletized storage of records (pending mid 2011) Great Lakes NRC, 3355 Illinois Street, Great Lakes, Illinois 60088

Iowa

West Branch - Herbert Hoover Library – Presidential Library 210 Parkside Drive, West Branch, Iowa 52358 (plus some warehouse space at South Downey and I-80 not included in count)

Kansas

Abilene - Dwight D. Eisenhower Library – Presidential Library 200 Southeast Fourth Street, Abilene, Kansas 67410-2900 (multiple buildings)

Lenexa - NARA's Central Plains Region – Regional Records Center Meritex Lenexa Executive Park, 17501 West 98th Street, #31-50, Lenexa, Kansas 66219

Maryland

College Park - National Archives at College Park – Archives II 8601 Adelphi Road, College Park, Maryland 20740-6001

Suitland - Washington National Records Center – Regional Archives and Records Center 4205 Suitland Road,, Suitland, Maryland 20746-8001

Massachusetts

Boston - John Fitzgerald Kennedy Library – Presidential Library Columbia Point, Boston, Massachusetts 02125-3398

Pittsfield - NARA's Northeast Region (Pittsfield) – Regional Records Center 10 Conte Drive, Pittsfield, Massachusetts 01201-8230

Waltham - NARA's Northeast Region (Boston) – Regional Archives and Records Center Frederick C. Murphy Federal Center, 380 Trapelo Road, Waltham, Massachusetts 02452-6399

Michigan

Ann Arbor - Gerald R. Ford Library – Presidential Library 1000 Beal Avenue, Ann Arbor, Michigan 48109-2114

Grand Rapids - Gerald R. Ford Museum – Presidential Museum 303 Pearl Street NW, Grand Rapids, Michigan 49504-5353

Missouri

Independence - Harry S. Truman Library - Presidential Library 500 W. US Hwy. 24. Independence, Missouri 64050-1798

Lee's Summit - NARA's Central Plains Region – Regional Records Center 200 Space Center Drive, Lee's Summit, Missouri 64064-1182

Civilian Personnel Records Center, 111 Winnebago Street, St. Louis, Missouri 63118-4126

St. Louis -- NPRC Records Center and Archives (Military), 1 Archives Drive, St. Louis, Missouri 63138

NPRC Records Center and Archives, 1829 Dunn Road, St. Louis, Missouri 63138

Kansas City Archives, 400 West Pershing Road, Kansas City, MO 64108

FRCP IRS Facility, 8300 Northeast Underground Drive, Kansas City, MO 64161

New York

Hyde Park - Franklin D. Roosevelt Library - Presidential Library, 4079 Albany Post Road, Hyde Park, New York 12538-1998

New York - NARA's Northeast Region (New York City) – Regional Archives Federal Building, 201 Varick Street, 12th Floor, New York, NY 10014*

* NARA also has some space in Federal Hall and is working with GSA for space in the Customs House (not included in count)

Ohio

Dayton - NARA's Great Lakes Region (Dayton) Moraine Business Center, 3150 Springboro Road, Dayton, Ohio 45439-1883, (buildings 1, 2 and 4) – Regional Records Center

Dayton - NARA's Great Lakes Region (Dayton) 8801 Kingsridge Drive, Dayton, Ohio 45406 - Regional Records Center, Fairfield - Palletized Storage facility

Pennsylvania

Philadelphia - NARA's Mid-Atlantic Region (Northeast Philadelphia) - Regional Records Center 14700 Townsend Road, Philadelphia, Pennsylvania 19154-1096

Texas

Austin - Lyndon Baines Johnson Library – Presidential Library, 2313 Red River St., Austin, Texas 78705-5702

College Station - George Bush Library – Presidential Library, 1000 George Bush Drive West, College Station, Texas 77845

Fort Worth - NARA's Southwest Region Regional Records Center Federal Center Warehouse 1 and 9, 501 West Felix Street, Building 1, Fort Worth, Texas 76115-3405

Carter Industrial Park, 1400 John Burgess Drive, Fort Worth, Texas 76140

Dallas - George W. Bush Presidential Library, 2943 SMU Blvd., Dallas, TX 75205

Houston – NARA has a small presence in the GT Leland Federal Building, 1919 Smith Street, Houston, TX (not included in count of facilities)

NEW FACILITY – The Montgomery Plaza facility leased thru GSA.

Washington (State)

Seattle - NARA's Pacific Alaska Region (Seattle) Regional Archives and Records Center 6125 Sand Point Way NE, Seattle, Washington 98115-7999

West Virginia

Rocket Center -- Allegheny Ballistics Laboratory (ARL), Rocket Center, WV.

ATTACHMENT 3

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1.0 INTRODUCTION:

This Quality Assurance Surveillance Plan (QASP) has been developed to provide the Contracting Officer’s Representative (COR) and other Government evaluators a summary of the key performance standards required in the contract, performance levels, and method of surveillance normally used for that performance standard. These are listed in Attachment 4, Performance Requirements Summary (PRS).

The QASP describes a systematic method to evaluate receipt by the Government of acceptable services the Contractor is required to furnish. The Contractor is required to provide satisfactory performance in all areas of the contract. Before invoices can be paid, a determination by the COR must first be made that satisfactory services have been received.

Any non-conformance with contract requirements is a “defect.” A defect may be recorded for each item evaluated that failed to meet the standards as required by the subject Performance Work Statement (PWS) paragraph(s). Examples of defects that will be recorded include, but are not limited to:

Quality Assurance is based on the premise that the Contractor, and not the Government, is responsible for management and quality control actions to meet the terms of the contract. The Government will follow the guidance in FAR 52.212-4, Contract Terms and Conditions - Commercial Items when performance is other than satisfactory.

Good management and use of an adequate quality control (QC) plan will allow the Contractor to operate within specified performance requirements. The COR and Government evaluators shall be objective, fair, and consistent in evaluating Contractor performance against contract requirements and standards. The main emphasis is on quality performance.

2.0 ACTUAL SURVEILLANCE:

Actual surveillance will be performed on a periodic basis, 100% surveillance, or as otherwise specified in the PRS in conjunction with the PWS.

If satisfactory performance is not achieved, the COR will determine the possible cause of the less than satisfactory performance. The COR will initiate a Contract Discrepancy Report (CDR) for all defects that could not be re-performed and for all defects not corrected by the Contractor in a timely or satisfactory manner when requested by the Government. The COR will submit the CDR documentation recording the less than satisfactory performance and stating a recommended action to the Contracting Officer (CO) including any proposed contract deductions.

3.0 SURVEILLANCE METHODS:

Services shall have the results of the surveillance documented. The surveillance methods the Government will use to evaluate the Contractor’s performance for the listed tasks are specified in the PRS. Customer complaints may be used in conjunction with the above surveillance methods as an indicator of performance or as areas to emphasize further for future surveillance.

4.0 INFORM CONTRACTOR:

a. Regardless of the surveillance method, the Contractor should be kept informed of performance status. The COR will notify the Contractor of any defect(s) to be corrected. The time to re-perform and correct defects after notification will vary depending on the type of defect, the item being inspected, the level of the item (i.e., routine, urgent, or emergency), etc. The COR will inspect re-performed or corrected discrepancies. If corrected properly and timely, the defect(s) will not result in a payment deduction. However, the COR will maintain all documentation for file maintenance and turn this information over to the CO upon completion of the contract. Performance issues should also be an item of discussion during contract status meetings.

b. CDRs should be used to officially notify the Contractor of a performance problem. CDR use includes notifying the Contractor of:

c. Critical performance problems should be immediately communicated with a follow-up written CDR. The COR will complete the CDR and forward it to the CO for review and approval. The COR will sign and forward the CDR to the Contractor for the Contractor’s response and comments. The Contractor will have seven (7) calendar days (or such lesser time that the COR stipulates) to complete a response. After evaluating the Contractor’s response, the COR will forward the CO any CDR requiring further action (contract interpretation, problem resolution, reduced payments, deficiency letter notification, cure notice, etc.). The COR will provide the CO recommended actions with supporting rationale.

5.0 REVISIONS TO QASP:

Revisions to this surveillance plan are the responsibility of the COR and the CO.

ATTACHMENT 4

PERFORMANCE REQUIREMENTS SUMMARY (PRS)

1.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS). The PRS captures key requirements of the Performance Work Statement (PWS) at an outcome level (performance standard) and states the performance level and method of surveillance for the requirement. The absence of any contract requirement from the PRS does not limit the rights or remedies of the Government within the contract.

2.0 METHOD OF SURVEILLANCE. The PRS provides the surveillance method(s) the Government will use to evaluate the Contractor’s performance for the listed tasks. The primary surveillance methods used will be 100% surveillance, periodic surveillance, or customer complaints.

3.0 GOVERNMENT QUALITY ASSURANCE. The Quality Assurance Surveillance Plan, Attachment 3, describes how the Government will inspect, in conjunction with this PRS, and how the COR, other performance evaluators, the Contractor, and the Contracting Officer will communicate to ensure satisfactory performance of the contract requirements.

4.0 The Contractor shall provide the Contractor SLA(s) related to the services available under each task order. The SLA(s) submitted by the Contractor and accepted by NARA are subject to change only to the extent that the Contractor changes its SLA except those changes that decrease service levels beyond the minimum levels delineated in this contract (the Contractor shall ensure that NARA is provided updated SLAs as these changes occur).

5.0 The Contractor shall provide its SLA for the services identified in the PWS. Upon acceptance by NARA, these SLA’s shall not change without a modification to the contract.

PERFORMANCE REQUIREMENTS SUMMARY

(RS-1) Deliverables PWS paragraph 6.0

(RS-2) Services PWS paragraph 3.10

(RS-3) Services PWS paragraph 3.9

(RS-4) Personnel PWS paragraph 7.1

(RS-5) Quality Control PWS paragraph 8.0

ATTACHMENT 5

ADDITIONAL NARA TERMS AND CONDITIONS

(ADDENDA TO FAR CLAUSE 52.212-4)

1. CONTRACTOR RESPONSIBILITY

The Contractor is responsible for the day-to-day inspection and monitoring of the Contractor work performed to ensure compliance with contract requirements. The results of all Contractor quality control inspections conducted must be documented on inspection checklists and be made available to the Government, during the term of the contract.

2. GOVERNMENT CONTRACT ADMINISTRATION

a. This contract will be administered by:

National Archives and Records Administration Office of the Chief Acquisitions Officer, Code Z 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

b. Contract Specialist (CS):

Scott Cox (Contractor) Telephone: (301) 837-3160 Email: scott.cox@nara.gov

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make reference to the contract number and must be emailed or mailed with postage prepaid to the address listed above.

c. Contracting Officer (CO)

Any Z Warranted CO

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

3. DESIGNATION OF CONTRACTING OFFICER'S REPRESENTATIVE (COR)

a. COR: TBD

b. The individual named above is designated as the Contracting Officer's Representative (COR) to assist the Contracting Officer (CO) in the discharge of the CO's responsibilities. The COR is responsible for monitoring, giving progress reports to the Contract Specialist (CS), and overall technical surveillance of services to be performed under this contract and should be contacted regarding questions or problems of a technical nature. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the CO be effective or binding upon the Government.

c. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the CO in writing.

d. No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

e. The responsibilities of the COR include, but are not limited to, the following:

(1) Serve as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO;

(2) Be responsible for the inspection and acceptance of the services performed and determining the adequacy of performance by the Contractor in accordance with the terms and conditions of this contract;

(3) Confer with representatives of the Contractor…