Performance Work Statement - Repair (FARS) Fire Alarm Reporting System - Revised.pdf

Performance Work Statement for

Fire Alarm Reporting System (FARS)

1.0 DESCRIPTION OF SERVICE/GENERAL INFORMATION

1.1 Description of Services: The contractor shall provide all equipment, tools, parts, materials, transportation, personnel, labor, supervision, and management to provide and install a Fire Alarm Reporting System (FARS).

1.1.1 Scope. The Government requires an Upgrade existing Monaco Fire Alarm Reporting System (FARS) network, server, and client hardware and software, including MDT’s, switches, and RF devices to latest, approved, and tested products. All connected equipment up to panel must be considered. Panels are excluded.

1.2 Project Specifics

1.2.1 Replace and upgrade FARS network, servers, clients, mobile, and RF devices up to but excluding panels to latest approved, tested products and components.

a. Perform evaluation of the D-21 system and make recommendations for upgrades or changes.

b. Provide and install 12 network switches with DoDIN APL approved network switches.

c. Provide and install three (3) repair by replacement rack mount EM servers (H1, H2, & NAS Drive).

d. Provide and install one (1) repair by replacement rack mount D-21 server CPU (S1).

e. Provide and install three (3) Repair by Replacement rack mount D-21 client CPU’s (C3, C4 & C5).

f. Provide and Install one (1) Repair by Replacement rack mount D-21 IAS client CPU (IAS C2).

g. Provide and Install one (1) Repair by Replacement rack mount D-21 IAS client CPU (IAS C1).

h. Provide and Install one (1) Repair by Replacement rack mount D-21 server CPU (S2).

i. Provide and install one (1) Repair by Replacement tower D-21 client CPU (C2) and install at the Alarm Shop.

j. Provide and install one (1) Repair by Replacement rack mount D-21 client CPU (C1) and install at the Security Forces Comm Room.

k. Provide and install one (1) View Generator CPU at Fire Station #1.

l. Provide and install five (5) Repair by Replacement Mobile Tablets.

m. Provide and install (1) rugged laptops to be used for system maintenance.

n. Perform backup of the database and provide to base (DM).

o. Make and provide copies of the drive images of the newly installed machines after completion of the hardening process.

p. Test and verify the D-21 systems are synchronized.

q. Validate the system performance after installation.

r. Provide operator and administrator training.

1.2.2 OPTION # 1 Service

a. Provide completed reports after completion.

b. Clean and verify operation of the exterior components of the D-21 PCs.

c. Check rack mounted UPS systems.

d. Verify network connectivity between all D-21 network computers and devices.

e. Ensure redundant D-21 database is synchronized with the primary D-21 database.

f. Preform redundant server takeover test.

g. Update media files in new files are available.

h. Validate the system performance after installation.

1.2.3 OPTION # 2 Wireless

a. Evaluate replacement of (3) wireless nodes supporting RF with fiber runs

1.3 Worksite Preparation. Prior to commencing any work the contractor shall coordinate the date and time for delivery and set-up with the contracting officer.

1.4 Place of Performance. Davis-Monthan AFB, AZ

1.5 Start Date. The contractor shall schedule the start of period of performance with the contracting officer. Period of Performance is negotiable but is anticipated to be no longer than 90 calendar days from project award, or upon approval of AFCEC design review (per Item 3), IAW AFGM 2019-32-02, para 3.1.

1.6 Contractor Hours of Operation. The contractor shall perform services during the hours of 7:00 a.m.

and 3:30 p.m., Monday through Friday. The contractor must receive approval from the Project Manager:

Mr. Dennis Robinson, at 228-5206 in order to work outside of these hours.

1.7 Manuals/Warrantee Documents & Technical Data. Upon completion the contractor shall provide the Government with two copies of all necessary manuals, warrantee documents, and/or technical data, including copies of system operator, administrator, and/or maintenance manuals, copies of the system’s topology, hardware/ software inventory, and configuration, as well as training and associated materials.

Proprietary software must be annotated and all requirements documented in system policy documents.

1.8 Cyber Security Requirements

1.8.1 Ensure cybersecurity application and documentation in all phases and on all devices IAW UFC 04-10- 06, AFGM 2019-32-02, NIST 800-82r2, a Vendor must incorporate cybersecurity into all phases of product/service delivery: design, development, test and evaluation, integration, execution, construction, operation, maintenance, sustainment, upgrade, or replacement.

b Vendor is required to perform an initial security assessment, a scan of vulnerabilities, to provide a copy of the scan results, and to mitigate the identified vulnerabilities prior to final acceptance by the Air Force.

c Vendor must comply with cybersecurity guidance from ISO/PM to add newly-installed or acquired CS to the installation’s inventory.

d Vendor must use government-owned assets (e.g., computer, tablet) for CS maintenance and all maintenance is to be conducted on site.

e Vendor must provide sufficient documentation to enable the Air Force to finalize the authorization, and obtain approved Risk Management Framework (RMF) authorization package.

f When the CS operating system cannot be upgraded or comply, a detailed Plan of Actions and Milestones must be documented and approved through the RMF process to appropriately manage the resulting security risk or to provide remediation that eliminates the risk.

g Contractor is required to maintain compliance in accordance with USCYBERCOM TASK ORD 17- 0019, as applicable. Contractor will download all monthly patches from DISA site for all applicable operating systems and applications.

h Contractor must document any and all necessary privileged use and security access controls necessary to run vendor system. Contractors with privileged access to government systems must meet DoD 8570.01 and 5200.02_AFMAN 15-1405 security clearance levels. All Contractors shall also comply with Operations Security (OPSEC) requirements as set forth in DoD Directive 5205.02E, DoD Operations Security (OPSEC) Program Manual and AFI 10-701, Operations Security. Application and cost for the appropriate Personnel Security Investigation (PSI) shall be the responsibility of the Contractor. If the contractor is notified by any Government official having security cognizance over the contract that an employee’s security clearance has been revoked or suspended, the contractor must notify the Contracting Officer the same day the contractor receives the notice and all access revoked.

2. GENERAL:

2.1 General Information:

Provide a submittal of all materials to be used, prior to ordering, to be reviewed and approved by the Project Manager, and DM 355 CES Cybersecurity ISO and Program Manager. Align design specifications and proposal with requirements within UFC 4-010-06, NIST SP 800-82r2. Proposal will require technical and cybersecurity design and review acceptance by AF Civil Engineer Community (AFCEC) COO prior to installation start date.

Return work site to original condition and to the satisfaction of the Project Manager.

2.1.1 Vendor must provide sufficient documentation to enable the Air Force to finalize the authorization, and obtain approved Risk Management Framework (RMF) authorization package. Vendor must harden system IAW applicable STIG and patch guidance and provide verifiable scans no less than 60 days old at time of system acceptance. Vendor must document how system meets applicable cybersecurity controls and provide POA&M for exceptions.

2.1.2 All work must be completed IAW AFGM 2019-32-02, AFI 17-101 Risk Management Framework, AFMAN 17-1303 Cybersecurity Workforce Improvement Program, Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, UFC 4-010-06, NIST SP 800-82r2, NIST SP 800-53r5 (draft), as well as all applicable DoD cybersecurity requirements.

2.1.3 Provide quarterly PMI services IAW AFGM 2019-32-02, para 3.8 on all hardware and software.

2.1.4 Contractor must document any and all necessary privileged use and security access controls necessary to run vendor system. Contractors with privileged access to government systems must meet DoD 8570.01 and 5200.02_AFMAN 15-1405 security clearance levels. All Contractors shall also comply with Operations Security (OPSEC) requirements as set forth in DoD Directive 5205.02E, DoD Operations Security (OPSEC) Program Manual and AFI 10-701, Operations Security. Application and cost for the appropriate Personnel Security Investigation (PSI) shall be the responsibility of the Contractor. If the contractor is notified by any Government official having security cognizance over the contract that an employee’s security clearance has been revoked or suspended, the contractor must notify the Contracting Officer the same day the contractor receives the notice and all access revoked.

2.1.5 Provide network administrator(s), server administrator(s), and personnel that ensure compliance with DoD 8570.01M, DoD 8570.01-M, Information Assurance Workforce Improvement Program. The contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including— (1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and (2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M. Upon request by the Government, the contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

2.1.6 All work will be accomplished in accordance with the National Electrical Code and the Davis-Monthan Design Guide and any updated Davis-Monthan Design Guides.

2.2 English Language. Contractor employees must speak, read, write, and understand English fluently.

2.3 Work Area. The contractor shall, at all times, keep work areas free from accumulations of waste material, rubbish, tools, scaffolding, equipment, and materials. Upon completion of the job or when away from the work site, the contractor shall leave the work area and premises in a clean, neat, safe and workmanlike condition. The contractor shall remove and properly dispose of all job related waste material.

2.4 Safety. The contractor shall comply with all local, state and federal laws and safety regulations.

Compliance with OSHA and other applicable laws and regulations for the protection of contractor employees is exclusively the obligation of the contractor, and the Government will assume no liability or responsibility for the contractor’s compliance or noncompliance with such responsibilities. The contractor is responsible for furnishing contractor employees with all necessary personal protective equipment to perform services.

2.5 Fire Prevention and Safety Standards. Contractor employees shall comply with the Occupational Safety and Health Act (OSHA), Davis-Monthan AFB Fire Protection Program, Air Force Occupational Safety, and the Fire Prevention and Health Program.

2.6 Smoking in AF Facilities. Contractors are advised that the AF has placed restrictions on the smoking of tobacco products in AF facilities. AFI 40-102, Tobacco Use in the Air Force, outlines the procedures used by the commander to control smoking in our facilities. Contractor employees and visitors are subject to the same restrictions as Government personnel. Smoking is permitted only in designated smoking areas.

2.7 Illegal Substances. Illegal substance possession and/or use will not be tolerated on any military installation, including DMAFB. The contractor shall ensure that contractor employees who have base access do not possess and/or use illegal substances. All contractors and subcontractors are required to adhere to all local, state and federal laws concerning possession and/or use of illegal substances.

Contractors found to be in possession of illegal substances will be barred from the installation and subject to arrest and prosecution by local authorities.

2.8 Illegal Aliens. IAW Air Combat Command (ACC) supplement to AFI 31-101, The Air Force Installation Security Program (FOUO), illegal aliens are unauthorized on DMAFB. The contractor shall not hire illegal aliens to perform contract services on DMAFB, nor attempt to bring illegal aliens on the installation. Corrective/punitive action will be taken against the contractor and the illegal alien if the contractor hires illegal aliens to perform contract services on DMAFB.

2.9 Contractor Travel on DMAFB. Contractor employees shall not loiter in any working area before or after performing services. All contractor employees shall limit their travel on DMAFB only to the specific areas required for performance of services or in travel directly to and from these locations. Upon completion of contract work, contractor employees shall promptly depart DMAFB.

2.10 Contractor Employee Conduct. The Government reserves the right to require removal from the installation any contractor employee who endangers persons or property, whose actions are inconsistent with professional conduct, whose continued employment is inconsistent with the interest of military security or who is found to be incapacitated or under the influence of alcohol, drugs, or other substances.

Removal of employees for any reason does not relieve the contractor of the requirement to perform services specified herein.

2.11 Controlled/Restricted Areas. The Contractor shall adhere to/implement local base procedures for entry to AF controlled/restricted areas where Contractor personnel work. An AF Form 2586, Unescorted

Entry Authorization Certificate, must be completed and signed by the sponsoring agency’s Security Manager before a Restricted Area Badge will be issued. Contractor employees must have a favorably completed National Agency Check plus written Inquires (NACI) investigation before receiving a Restricted Area Badge. Interim access can be granted in accordance with AFI 31-501, Personnel Security Program Management.

2.12 Key Control. The contractor shall establish and implement methods of making sure all keys/combinations issued to the contractor by the government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the Government. The contractor shall immediately report to the COR or Contracting Officer any occurrences of lost or duplicated keys. In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the Contracting Officer, to re- key or replace the affected lock or locks without cost to the Government. The Government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, the Government shall replace all locks and keys for that system, and the total cost will be deducted from the monthly payment due the contractor.

2.12.1 The contractor shall prohibit the use of keys and/or cipher lock combinations, issued by DMAFB, by any persons other than the contractor’s employees and the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in performance of contract work requirements in those areas.

2.12.2 The contractor shall control access to all Government provided lock combinations to preclude unauthorized entry. The contractor is not authorized to record lock combinations without written approval by the COR. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

2.13 Privacy Act. The Contractor shall ensure that its employees fully understand and comply with Title 5 of US Code, Section 552.a and DoD 5400.7-R, DoD Freedom of Information Act Program. These procedures must be followed to identify and safeguard reports and data accordingly. The contractor will ensure that Contractor employees are briefed annually on properly identifying and handling Privacy Act data/information.

2.14 Protection of Personally Identifiable Information. Personally Identifiable Information (PII) refers to information that can be used to distinguish or trace an individual’s identity either alone or when combined with other information that is linked or linkable to a specific individual. PII may range from common data elements such as names, addresses, dates of birth, and places of employment, to identity documents, Social Security numbers (SSN) or other government-issued identity, precise location information, medical history, and biometrics. The contractor shall protect all PII encountered in the performance of services in accordance with Department of Defense Directive 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R, Department of Defense Privacy Program. If a PII breach results from the contractor's violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who's PII has been compromised.

2.15 List of Employees. Upon contract award, and prior to beginning work, the contractor shall submit to the Contracting Officer a list of contractor employee names, social security numbers, and driver’s license numbers, or other means of positive identification of all employees performing services on DMAFB.

Foremen, supervisors, and superintendents must be identified on the list of employees. The contractor shall submit an updated list when an employee's status or information changes. The name of any contractor employee that is terminated during the period of the contract must be reported to the Contracting Officer, in writing, within one workday of the employee’s termination.

2.16 Pass and Identification Items. The contractor shall ensure the pass and identification items required for contract performance on DMAFB are obtained for employees and non- Government owned vehicles.

2.17 Retrieving Identification Media. The contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires;

e.g. terminated for cause, retirement, etc, or upon contract completion. The contractor shall notify the Contracting Officer in writing when an employee departs, and return the employee’s identification to the office that issued it.

2.18 Traffic Laws. Contractor employees shall comply with all Davis-Monthan AFB traffic regulations and state traffic laws. Contractor employees are subject to random vehicle speed control checks. Failure to adhere to base traffic regulations may result in the loss of base driving privileges, debarment from the base, or other administrative action. The use of cell phones is strictly prohibited while driving on Davis- Monthan AFB, unless the phone is hands free. Seat belt use is mandatory for all drivers and vehicle passengers.

2.19 Random Personnel and Vehicle Searches. Contractor personnel are subject to random personnel and vehicle searches. If contractor personnel refuse to be searched, they will be denied entry to the base. Denial of entry to contractor personnel who refuse to be searched, or detention of personnel found to be in possession of contraband, may result in loss of base driving privileges, debarment from the base, or other administrative action. Detention of contractor employees for any reason does not relieve the contractor of the requirement to perform contract services.

2.20 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition on themselves or within their contractor owned vehicle or privately owned vehicle while on Davis-Monthan AFB.

2.21 Reporting Requirements. Contractor employees shall immediately report to an appropriate DMAFB authority any information or circumstances of which they are aware that may pose a threat to the security of Department of Defense personnel, contractor personnel, resources, and classified or unclassified defense information.Physical Security. Contractor employees are responsible for safeguarding all Government property and controlled forms provided for the contractor’s use. At the end of each work period, the contractor shall secure all DMAFB facilities, equipment, and materials.

3. GOVERNMENT PROVIDED SERVICES

3.1 Emergency Services. The Government will provide security forces services (call 228-4444 for emergencies only), and fire protection services (call 228-3333). There are no emergency medical services available on DMAFB; therefore the contractor must dial 911 for emergency medical services.

3.2 Utilities. The Government will furnish a source of electricity at the worksite as available.

dodm5200.02_afma n16-1405.pdf

USAF Non-Office IT Windows 10 Migratio