PWS.doc

Performance Work Statement (PWS)

Heidelberg Laser Lithography Systems Maintenance and Service 18 June 2025

C.1 Background

The Contractor shall provide preventive and corrective maintenance services for the following Government-owned equipment located at the Army Research Laboratory (ARL) in Adelphi, MD:

One (1) Heidelberg Volume Pattern Generator (VPG) 200++, Serial Number: HI943

One (1) Heidelberg Direct Write Lithography (DWL) 200 Laser Lithography System, Serial Number: HI684

The period of performance shall include one (1) base year, with two (2) additional one-year options. The Contractor shall ensure both preventive and corrective maintenance are performed in accordance with the manufacturer’s specifications to maintain optimal operational capability of the systems.

C.2 Objective

Preventive and corrective maintenance for the Government-owned laser lithography systems manufactured by Heidelberg Instruments is critical in supporting nanofabrication at the Specialty Electronic Materials and Sensors Cleanroom (SEMASC). Preventative support and maintenance shall ensure full functionality and performance of the systems to prevent any failures or system downtime.

C.3 Requirement

C.3.1 Preventative Maintenance

The Contractor shall maintain the performance of the Heidelberg VPG200++ (Serial No. HI943) and DWL200 (Serial No. HI684) by conducting scheduled preventive maintenance visits in accordance with the Original Equipment Manufacturer (OEM) Technical Maintenance and Service Documentation.

· DWL200: Two (2) scheduled preventive maintenance visits annually

· VPG200++: Four (4) scheduled preventive maintenance visits annually

During each preventive maintenance visit, the Contractor may implement OEM-approved modifications necessary to correct issues and ensure reliable, full operation of the systems.

Each preventive maintenance inspection shall include, at a minimum:

· Initial checks

· Optics checks

· Vacuum checks

· Electronics checks

· Performance checks

Based on the inspection results, the Contractor shall take all necessary corrective actions to restore each system to normal operating condition.

Prior to performing any maintenance, the Contractor shall inspect each laser system for signs of mechanical or electrical defects, including but not limited to overheating, corrosion, dust accumulation, oil residue, or broken components. The Contractor shall also conduct performance checks to verify operational status.

The schedule for preventive maintenance visits shall be coordinated and mutually agreed upon between the Contractor and the Army Research Laboratory (ARL) Technical Point of Contact (TPOC).

C.3.2 Corrective Maintenance (Repair Service)

The Contractor shall perform Corrective Maintenance to ensure the continued operational capability of the Heidelberg VPG200++ (HI943) and DWL200 (HI684) systems. Corrective Maintenance shall include:

· Repair of defects resulting from normal wear and tear.

· Diagnosis and repair of defects reported by the Government that prevent normal operation of the systems.

· All labor, travel, and related expenses necessary to perform the corrective maintenance covered under this Agreement.

Support and Response Times:

· The Contractor shall provide unlimited phone support and respond within 48 hours of a reported problem (excluding weekends and federal holidays).

· For issues requiring on-site technical support, the Contractor shall provide service within five (5) business days of the reported problem (excluding weekends and federal holidays).

Hardware Coverage:

· DWL200 System: All non-consumable hardware components shall be covered under this Agreement. The Exposure Laser System (or alternate laser systems, if applicable) is considered consumable and is excluded from coverage. All costs associated with the repair of non-consumable items shall be included.

· VPG200++ System: All non-consumable hardware components shall be covered under this Agreement. The Exposure Laser System (or alternate laser systems, if applicable) is considered consumable and is excluded from coverage. All costs associated with the repair of non-consumable items shall be included.

C.3.3 System control software

The Contractor shall provide all update releases of System control software for both the VPG200++ and DWL200.

C.3.4 Place of Performance

U.S. Army Research Laboratory

2800 Powder Mill Road

Adelphi Maryland

20783-1138

C.3.5 Period of Performance

First year: 11 September 2025 – 10 September 2026

Option year (if exercised): 11 September 2026 – 10 September 2027

C.3.6 Service hours

Preventive and Corrective Maintenance (Repair Service) shall be carried out by the Contractor Monday through Friday between 8:00 AM and 5:00 PM local time (except holidays).

Routine access of Contractor personnel to Government-controlled facilities is not required. Access to Government-controlled information systems is not required.

The Contractor is not required to obtain a National Agency Check with Inquiries or higher. National, religious, or other special holidays observed by Heidelberg Instruments are excluded.

C.3.7 Quarterly Status Meetings

The Contractor shall participate in status meetings, to be held at least quarterly with the TPOC, to be scheduled by the TPOC. The meetings shall discuss the progress of the contract, performance of the Contractor, and any problems that have arisen or are expected to arise.

C.4 AT-OPSEC

C.4.1 Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

C.4.2 For contractors that do not require CAC but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

C.4.3 DISTRIBUTION STATEMENT A

Approved for public release; distribution is unlimited.

Contracting Officer:

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

(a) Within thirty (30) days of contract award, unless otherwise notified by the Government, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

(b) If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

(c) Upon conclusion of the correction period, the Government may conduct a followon review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

(d) The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST SP 800-171

(a) The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

(b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of National Security Agency- or NIST-approved algorithms (i.e., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

(a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period in DFARS clause 252.204-7012 ), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

(b) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Army Counterintelligence (Cl) Outreach

The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

5. Army Cl/Industry Monitoring

(a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor will coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.