Protective Distribution System contract PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Protective Distribution System (PDS) Preventive Maintenance and Support Services

Part 1: General Information

I. GENERAL: This is a service and supply contract under which the personnel rendering the services are not subject to supervision and control usually prevailing in relationships between the Government and its employees. The services required are for sustainment and maintenance and does not include a new installation. The Contractor shall ensure that all contractor employees and subcontractor employees are medically, dentally, and psychologically fit for performance of their duties.

1.1 Background: The Joint Interagency Task Force South (JIATFS) utilizes a CyberSecure Protective Distribution System (PDS) to protect its sensitive data networks. This system was installed under a previous contract which included installation and warranty service period. To ensure mission success and personnel safety through the continued secure operation of this critical infrastructure, a new service contract is required for ongoing preventive maintenance, technical support, and system sustainment.

1.2 Description of Services/Introduction: The Contractor shall provide all required labor, materials, supervision, equipment, software, licenses, and certifications necessary to provide comprehensive preventive maintenance and support services for the JIATFS CyberSecure PDS. The goal is to ensure the system remains fully operational, up-to-date, and compliant with all relevant security standards.

1.3 Objectives: To provide quality, recurring support and maintenance to ensure the PDS maintains its operational effectiveness, security posture, and longevity. This minimizes disruptions due to system failures and ensures compliance with standards such as CNSSI 7003.

1.4 Scope: The Contractor shall provide comprehensive remote and on-site support services to maintain the PDS. Tasks include, but are not limited to:

a. Annual renewal of the CyberSecure IMS™ Gold License for all active hardware.

b. 24/7/365 Remote Help Desk, Telephone, and Online Technical Support.

c. Guaranteed response Service Level Agreements: Up to 24 hours (Monday-Friday) and up to 72 hours (Weekends/Holidays).

d. Priority case escalation for critical issues.

e. Provision and remote assistance for all necessary software updates and patches.

f. Support for continuing Information Assurance (IA) documentation.

g. One (1) annual on-site preventive maintenance visit.

h. As-needed system configuration updates (e.g., zone media, notification lists).

i. Web-based and on-site system training for all necessary personnel.

1.4.1. Original Equipment Manufacturer (OEM) Support Assurance: The Contractor shall procure and maintain active OEM Software Support Assurance and hardware maintenance agreements directly with CyberSecure IPS for the entirety of the contract’s Period of Performance.

a. Access to Updates: The Contractor shall ensure the Government receives continuous, uninterrupted access to all OEM-developed software upgrades, firmware patches, vulnerability remediations, and security enhancements as they are released.

b. Proof of Authorization: Upon proposal submission and upon request throughout the life of the contract, the Contractor must provide written proof from the OEM (CyberSecure IPS) verifying that they are a certified integrator/authorized partner in good standing, legally permitted to distribute and install these updates on the Government’s behalf.

c. Tier 3 Escalation: The Contractor must guarantee a direct escalation path to OEM Tier 3 engineering support for critical system failures that cannot be resolved at the local technician level.

1.5 Period of Performance: The period of performance shall be for one (1) Base Year from the date of award, with four (4) one-year Option Periods.

1.6 General Information:

• 1.6.1 Quality Control Plan (QCP): The Contractor shall develop, implement, and maintain a QCP to ensure all work is performed at or above the standard defined in the Performance Requirements Summary (PRS). The QCP shall be submitted within thirty (30) days of contract award.

• 1.6.2 Quality Assurance (QA): The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP).

• 1.6.3 Recognized Holidays: The Contractor is not required to schedule on-site services on Federal holidays.

• 1.6.4 Hours of Operation: The contractor is responsible for conducting on-site business between the hours of 0730 – 1630 Monday through Friday, except Federal holidays. Remote support shall be available 24/7/365 as specified in the scope.

• 1.6.5 Place of Performance: The work performed under this contract will be performed within or adjacent to the JIATFS Compound, Key West, FL.

• 1.6.6 Type of Contract: The Government anticipates awarding a firm fixed-price contract.

• 1.6.7 Access and General Protection Policy and Procedures: The contractor shall comply with all installation access, physical security, and force protection condition (FPCON) procedures. Contractor personnel shall not be required to independently obtain Defense Biometric Identification System (DBIDS) credentials. Instead, for technicians requiring entry who do not possess valid military installation access, the Government/Sponsor will submit a base access request or access roster to coordinate temporary entry. The contractor remains responsible for providing all necessary vetting information (e.g., full names, dates of birth, driver’s license numbers, or other government-issued identification) to the Government sponsor in a timely manner to facilitate these requests. All contractor personnel must still successfully pass required background checks (such as NCIC-III) and adhere to Army Regulation (AR) 190-13.

• 1.6.8 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend a post-award conference and periodic performance review meetings as required by the Contracting Officer (KO).

• 1.6.9 Contracting Officer Representative (COR): The COR will be identified by a separate letter and will serve as the technical point of contact for the Government.

The COR is not authorized to change any terms and conditions of the contract.

• 1.6.10 Key Personnel: The Contractor shall provide a contract manager or lead technician who is responsible for the performance of the work and shall be available during normal business hours for communication.

• 1.6.11 Special Qualifications: All contractor personnel shall be citizens of the United States, be able to read, write, and speak English, and possess the necessary skills and knowledge to perform the required services. Personnel operating vehicles shall have valid driver's licenses.

• 1.6.12 Identification of Contractor Employees: Contractor employees shall identify themselves as contractor personnel at all times and present a neat, professional appearance.

• 1.6.13 Non-Disclosure Requirements: The Contractor and its personnel shall not divulge or release any data or information obtained during performance of this contract without written approval from the KO. This includes prohibitions on posting to social media and use in marketing materials.

• 1.6.14 Organizational Conflict of Interest (OCI): The Contractor shall notify the KO immediately if any actual or potential OCI arises.

Part 2: Definitions & Acronyms

2.1. Definitions:

Contractor. The total contractor organization or a separate entity of it; such as an affiliate, division, or plant that performs its own purchasing.

Contracting officer (KO). A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

Contracting Officer’s Representative (COR). An individual designated and authorized in writing by the contracting officer to perform specific technical or administrative functions.

Defective Service. A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Foreign National. A foreign national is not a U.S. citizen. Green card holders are also identified as foreign nationals. A foreign national is further categorized as either a third country national or a local national based on the person’s citizenship and location of performance of duty.

Key Personnel. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

Local National. Local nationals are foreign nationals who are citizens of the country where the performance of duty will occur.

Performance Work Statement (PWS). A statement of work that describes the required results in clear, specific, and objective terms with measurable outcomes.

Physical Security. Protection of the perimeter area, government property, and assets that prevent the loss or damage of Government property.

Quality Assurance. The various functions, including inspection, performed by the government to determine whether a Contractor has fulfilled the contract obligations pertaining to quality and quantity.

Quality Assurance Surveillance Plan (QASP). A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor’s performance in meeting critical performance standards identified in the contract.

Quality Control (QC). Tasks performed by the Contractor to improve the quality of the organization’s output.

Shall. An imperative command; has a duty to or is required to. Denotes that a regulation must be followed unless the contracting officer has obtained a deviation.

Subcontractor. Any supplier, distributor, vendor, or firm that furnishes supplies or services to or for a prime contractor or another subcontractor.

Third Country National. Third country nationals are foreign nationals who are not citizens of the country where the performance of duty will occur.

Workday. The number of hours per day the Contractor provides services in accordance with the contract.

Work Week. Monday through Friday, unless specified otherwise.

2.2 Acronyms:

AFFSSIR Armed Forces Repository of Specimen Samples ALMS Army Learning Management System ANSI American National Standards Institute AOR Area of Responsibility AR Army Regulation ATCTS Army Training Certification Tracking System AT Anti-Terrorism CAC Common Access Card CFR Code of Federal Regulations CI Counter Intelligence CLIN Contract Line Item Number CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative DBIDS Defense Biometrics Identification System DD Form 254 Department of Defense Contract Security Requirement List

DNA Deoxyribonucleic Acid (DNA) DOD Department of Defense DODD Department of Defense Directive DODI Department of Defense Instruction FAR Federal Acquisition Regulation FHP Force Health Protection FCG Foreign Clearance Guide FN Foreign National FY Fiscal Year GFE Government Furnished Equipment GFP Government Furnished Property GFS Government Furnished Services IA Information Assurance IAW In Accordance With IT Information Technology JIATFS Joint Interagency Task Force South JPAS Joint Personnel Adjudication System JTR Joint Travel Regulation KO Contracting Officer LN Local National LOA Letter of Authorization NASKW Naval Air Station Key West NCIC-III National Crime Information Center Interstate Identification Index NIST National Institute of Standards and Technology ODC Other Direct Costs OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OSHA Occupational Safety and Health Administration OPSEC Operation Security PDS Protective Distribution System PIPO Phase In/Phase Out PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QCP Quality Control Program RA Requiring Activity SCR Service Contract Reporting SOP Standard Operating Procedures SPOT Synchronized Predeployment and Operational Tracker TCN Third Country National TE Technical Exhibit TSDB Terrorist Screening Data Base U.S.C. United States Code USSOUTHCOM United States Southern Command

Part 3: Government Furnished Items and Services

• 3.1 Services: (Reserved)

• 3.2 Facilities: The Government will provide access to the facilities where the PDS equipment is located.

• 3.3 Utilities: The Government will provide all utilities required for the performance of tasks outlined in this PWS.

• 3.4 Equipment: CyberSecure Interceptor and Stoplights.

• 3.5 Materials: (Reserved)

• 3.6 Parts: (Reserved)

Part 4: Contractor Furnished Items and Services

• 4.1 General: The Contractor shall furnish all supplies, equipment, facilities, software, licenses, and services required to perform work under this contract that are not listed under Part 3 of this PWS.

• 4.2 Materials: The Contractor shall provide all materials, supplies, and equipment necessary to meet the requirements under this PWS.

• 4.3 Equipment: The Contractor shall provide all tools to meet the requirements under this PWS.

Part 5: Specific Tasks

5.1 Basic Services: The contractor shall provide continuous remote support and one annual on-site preventive maintenance visit, scheduled in advance with the JIATFS COR.

The contractor shall provide a written summary of services rendered, observations, and recommendations at the conclusion of the on-site visit.

5.2 Remote Support Services:

• 5.2.1 Technical Support: Provide 24/7/365 help desk support via telephone and online means to address system issues. The Contractor may provide telephonic assistance to coordinate troubleshooting with the Government’s dedicated on-site Physical Security System Administrator; however, no remote electronic access to the system is permitted, as all equipment resides on a standalone network.

• 5.2.2 Software Maintenance: Provide and assist with the application of all new CyberSecure IMS™ software updates and patches to maintain system integrity and performance.

• 5.2.3 IA Support: Provide documentation and assistance to support the Government’s Information Assurance compliance efforts.

5.3 Annual On-Site Preventive Maintenance:

• 5.3.1 System Health Check: Conduct an overall hardware and software Alarmed Carrier PDS health check.

• 5.3.2 System Calibration: Perform re-calibration of all alarmed zones to ensure accurate monitoring.

• 5.3.3 System Analysis: Conduct a resource trend analysis of the CyberSecure Server (CPU, Memory) and provide a comprehensive analysis of the CyberSecure Health Report for all monitored zones.

• 5.3.4 On-Site Updates: Install any critical software updates or patches that could not be applied remotely or via telephonic assistance with government appointed system administrators.

5.4 Training and System Updates:

• 5.4.1 Web-Based Training: Provide up to four (4) web-based, instructor-led training sessions annually. These sessions shall be suitable for new administrators or as a refresher for existing staff.

• 5.4.2 On-Site Training: Provide one (1) CyberSecure IMS™ User Training Class for an unlimited number of students during the annual on-site visit.

• 5.4.3 As-Needed Updates: As requested by the COR, update system configurations, including zone media, Standard Operating Procedures, project templates, and email/voice dialer notification settings.

5.5 Travel: All travel, lodging, per diem, and rental car costs required for the performance of the annual on-site visit shall be included in the firm-fixed-price of the contract.

Part 6: Applicable Publications

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

6.1.1 DOD Commercial Use of Imagery Guidelines

6.1.2 AR 190-13, The Army Physical Security Program

6.1.3 Army Directive 2014-05, Policy and Implementation Procedures for CAC Credentialing Access for Uncleared Contractors

6.1.4 32 CFR Part 117, National Industrial Security Program (NISP)

6.1.5 Defense Federal Acquisition Regulation Supplement (DFARS)

6.1.6 Joint Travel Regulation (JTR)

6.1.7 AR 735-5, Policies and Procedures for Property Accountability

6.1.8 DoDM 8140.03, Cyberspace Workforce Qualification and Management Program

6.1.9 DoD Instruction 8500.01, Cybersecurity

6.1.10 NIST Special Publication 800-53 (Rev. 5), Security and Privacy Controls for Information Systems and Organizations

6.1.11 CNSSI 7003, Protected Distribution Systems (PDS)

6.1.12 DODI 3020.41, Contractor Personnel Authorized to Accompany the U.S. Armed Forces

6.1.13 USSOUTHCOM SC Regulation 40-501, Medical Suitability Screening Regulation

6.1.14 DODI 2000.16 DoD Antiterrorism (AT) Program

6.1.15 Homeland Security Presidential Directive-12 (HSPD-12)

6.1.16 Federal Information Processing Standards Publication (FIPS PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. Attachment/Technical Exhibit List:

7.1 Attachments:

7.1.1 Attachment 1 – Performance Requirements Summary

7.1.2 Attachment 2 – Deliverables Schedule

ATTACHMENT 1

Performance Objective

Required Service (PWS Reference)

Performance Standard

Acceptable Quality Level

(AQL)

Method of Surveillance

1. Remote Technical Support

Provide 24/7/365 remote help desk, telephone, and online technical support. (PWS 1.4.b, 5.2.1)

Acknowledge receipt of all service requests within the guaranteed response times: - Up to 24 hours (Mon-Fri) - Up to 72 hours (Weekends/Holidays).

All critical issues receive priority case escalation.

95% of all service requests acknowledged within the specified timeframes.

Periodic inspection of contractor service logs;

COR review and verification.

2. System Software Maintenance

Provide and assist with the installation of all necessary software updates and patches. (PWS 1.4.e, 5.2.2)

All critical software updates and security patches are provided to the COR within 5 business days of their public release by the

OEM.

100% of critical updates and patches provided within the required timeframe.

Review of contractor-provided update notifications;

Random Sampling.

3. Annual On- Site Preventive Maintenance

Conduct one

(1) annual on-site preventive maintenance visit. (PWS 1.4.g, 5.3)

The on-site visit must be scheduled with the COR at least 30 days in advance and completed within the contract year. A summary report must be delivered to the COR within 10 business days of visit completion.

100% completion of the annual visit and submission of the summary report.

Direct observation by COR; Review of the contractor's summary report.

4. System Sustainment & Training

Provide web-based training sessions, on-site user training, and

Schedule and conduct up to four (4) web-based training sessions annually as requested.- Provide

95% of all training and configuration update requests are

Customer feedback;

Direct observation by COR; Review of as-needed system configuration updates. (PWS 1.4.h, 1.4.i, 5.4) one (1) on-site training class during the annual visit.- Complete requested configuration updates within 15 business days of the request.

completed as required.

system configuration.

5. Contract Deliverables

Submit required contract deliverables, including the Quality Control Plan (QCP).

(PWS 1.6.1)

The Quality Control Plan (QCP) shall be submitted to the COR for review and approval within thirty

(30) days of contract award.

100% of the QCP is submitted on time and is found acceptable by the Government.

COR review and acceptance of the deliverable.

6. License Renewal

Renew the CyberSecure IMS™ Gold License for all active hardware.

(PWS 1.4.a)

The annual license renewal shall be completed no later than 30 days prior to the expiration of the current license term.

Proof of renewal must be submitted to the

COR.

100% of license renewals completed on time.

COR verification of license status and review of renewal documentation.

ATTACHEMENT 2

Deliverable PWS Reference Frequency / Due Date

Submitted To

Quality Control Plan

(QCP)

1.6.1 Within thirty (30)

days of contract award

Contracting Officer Representative

(COR)

Annual On-Site Preventive

5.1, Attachment 1

Within ten (10) business days of

COR

Maintenance Summary Report

Completing the annual on-site visit

Information Assurance (IA)

Support Documentation

5.2.3 As required

Proof of CyberSecure IMS™

Gold License Renewal

1.4.a, Attachment 1

No later than 30 days prior to the current license's expiration