PWS W9124J-26-P-DATA Offside Data Storage _18 Mar 2026.pdf

PERFORMANCE WORK STATEMENT (PWS)

Brooke Army Medical Center (BAMC)

Offsite Data Storage

Part 1 General Information

1. General: This is a non-personal services contract to provide all management, tools, supplies, equipment, transportation, and labor to safely and securely store backup media, digital records, and electronic data at an offsite location. The contractor shall provide a Turn-key solution that provides environmental controls to securely store, track and efficiently transport stored data to and from storage facility until data is needed for emergency recovery.

The government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn, is responsible to the government.

1.1. Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Off Site Data Storage as defined in this performance work statement except for those items specified as government furnished property and services.

The contractor shall perform to the standards in this contract.

1.2. Background: This requirement is derived from the Department of Defense (DoD) Security Technical Implementation Guides and is a requirement for Brooke Army Medical Center (BAMC) to maintain an Authority to Operate (ATO). BAMC has been mandated to provide this capability and has done so for the past several years.

1.3. Objectives: Provide Off Site Data Storage, Tape/Data Pickup and Tape/Data Delivery.

The contractor shall provide all management, tools, supplies, equipment, transportation and labor to safely and securely store backup media, digital records, and electronic data at an offsite location. The contractor shall provide a turn-key solution that provides environmental controls to securely store, track and efficiently transport stored data to and from storage facility until data is needed for emergency recovery.

1.4. Scope: A comprehensive suite of services to transport, store, manage, relocate, and retrieve backup media from a secure, offsite facility operated by trained experts. Provide services to manage backup media across its lifecycle.

Moving Tapes/Data offsite and into the care of a trusted third party with proven resources, technology and experience focused on protecting our data, to reduce downtime and restoring data to operational levels.

The contractor shall store data in a climate controlled highly protected facilities. The contractor shall ensure each vault maintains acceptable temperature (60 - 70 degrees F) and away from 100-year flood plain and known fault lines. Away from statistically high crime and fire areas. Entire building shall have 100% fire suppression coverage. The contractor shall ensure that Data Storage Site is at least 20 miles from Brooke Army Medical Center (BAMC) Hospital, or the site shall be in a different electrical grid from BAMC. Offsite Storage Site shall be accessible to major commercial center. The contractor shall ensure Data is available whenever requested;

24/7/365. The contractor shall have maximum 4-hour response on local emergency requests. The contractor shall provide a verifiable chain-of-custody and audit trail.

1.5. Period of Performance: The period of performance shall be for one (1) base year of 12 months and three (3) 12-month option years.

1.6. General Information

1.6.1. Quality Control Quality control is the responsibility of the contractor. The contractor shall be responsible for the delivery of quality services/supplies to the government (see FAR 52.246-1, Contractor Inspection Requirements). The Contractor shall develop and maintain a quality program to ensure services are performed in accordance with commonly accepted commercial practices for data storage and retrieval.

The contractor shall develop, implement and maintain an effective quality control system that includes a written quality control plan (QCP). The QCP shall implement standardized procedure/methodology for monitoring and documenting contract performance to ensure all contract requirements are met. The contractors' QCP shall contain a systematic approach to monitor operations to ensure acceptable services/products are provided to the government. The QCP, as a minimum, shall address continuous process improvement; procedures for scheduling, conducting and documentation of inspection; discrepancy identification and correction;

corrective action procedures to include procedures for addressing government discovered non-conformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent re-occurrence of discrepancies; procedures for trend analysis; and procedures for collecting and addressing customer feedback/complaints. The contractor shall upon request provide to the government its quality control documentation. After the Government accepts the quality control plan, the contractor shall receive the contracting officer's acceptance in writing of any proposed change to its Quality Control (QC) system.

1.6.2. Quality Assurance: The government will evaluate the contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is a government only document primarily focused on what the government shall do to ensure that the contractor has performed in accordance with the requirements of the contract.

1.6.3. Federal Government Holidays: The contractor shall not perform services on holidays.

New Year’s Day 1st day of January Martin Luther King Jr. Day 3rd Monday of January Presidents Day 3rd Monday of February Memorial Day Last Monday of May Juneteenth 19th Day of June Independence Day 4th day of July

Labor Day 1st Monday of September Columbus Day 2nd Monday of October Veterans Day 11th Day of November Thanksgiving Day 4th Thursday of November Christmas Day 25th day of December

1.6.4. Hours of Operation: The contractor shall conduct business, between the hours of 0800 hours to 1700 hours, Monday through Friday. Emergency or Disaster Recovery hours of support will be 24/7; 365 days a year. The contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this Performance Work Statement (PWS), when the government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: The work to be performed under this contract will be performed at BAMC 3600 Roger Brooke, Fort Sam Houston, Texas and the contractor's storage facilities. The contractor shall pick up tapes and data from 3600 Roger Brooke, Fort Sam Houston, Texas and take these items to the contractor’s storage location.

1.6.6 Security Requirements: The contractor personnel, to include subcontractors, performing work under this contract shall provide drivers that are bonded, licensed and the vehicles shall have physical security, be insured, and provide secure off-site storage at time of the proposal submission, and shall maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached Department of Defense Contract Security Requirement List (DD254).

1.6.7. Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

1.6.7.1 Key Control: The contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the government are not lost or misplaced and are not used by unauthorized persons. Note: All references to keys include key cards. No keys issued to the contractor by the government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include tum-in of any issued keys by personnel who no longer require access to locked areas.

The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer Representative.

1.6.7.2. The contractor shall prohibit the use of government issued keys/key cards by any persons other than the contractor's employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the contracting officer.

1.6.8 Lock Combinations The contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor's Quality Control Plan.

1.6.9. Personal Identity Verification (PIV). Not Applicable

1.6.10. Visit Notification. Not Applicable

1.6.11. Special Qualifications: All drivers shall be bonded, licensed and insured. Vehicles shall be insured and secured. Contractor shall sign a Department of Defense Standard Contract Clause for Business Associates.

1.6.12. Post Award Conference/Periodic Progress Meetings: The contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5, Post Award Orientation. The contracting officer, COR, and other government personnel, as appropriate, will meet periodically, quarterly as a minimum, with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.13. Contracting Officer Representative (COR): The COR will be identified by separate letter.

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including government drawings, designs, and specifications; monitor contractor's performance and notify both the contracting officer and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.14. Key Personnel: Not Applicable

1.6.15. Identification of Contractor Employees: The contractor (to include subcontractors) shall provide each employee an identification (ID) badge, which includes at a minimum, the company name, employee name and a color photo of the employee. ID badges for key personnel shall also indicate their job title. ID badges shall always be worn during which the employee is performing work under this contract. Each contractor (to include subcontractors) employees shall wear the ID badge in a conspicuous place on the front of exterior clothing and above the waist except when safety or health reasons prohibit. The contractor (to include subcontractors) shall be responsible for collection of ID badges upon completion of the contract or termination of employee. A listing of issued identification cards shall be furnished to the contracting officer prior to the contract performance date and updated as needed to reflect contractor and subcontractor personnel changes. All contract personnel attending meetings, answering government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are government officials. The contractor shall ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.6.16 Anti-Terrorism and Operations Security Requirements (N/A)

1.6.17. Contractor Travel: The contractor shall be required to travel in various locations in Continental United States (CONUS excludes Alaska and Hawaii) during the performance of this contract to deliver and pick up data and backup tapes. The government will authorize travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires government approval/authorization and notification to the COR.

1.6.18. Other Direct Costs: Not Applicable

1.6.19. Data Rights: The government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be government owned and are the property of the government with all rights and privileges of ownership/copyright belonging exclusively to the government.

These documents and materials may not be used or sold by the contractor without written permission from the contracting officer. All materials supplied to the government shall be the sole property of the government and may not be used for any other purpose. This right does not abrogate any other government rights.

1.6.20. In accordance with (IAW) Federal Acquisition Regulation (FAR) 39.2. Headquarters Installation Information Systems (HQIIS) shall be compliant with Section 508, an amendment to the United States Workforce Rehabilitation Act of 1973. The Contractor shall ensure all HQIIS applications are accessible to people with disabilities and that current and future requirements to maintain compliance with Section 508 are met.

1.7.1. Access and General Protection/Security Policy and Procedures. This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility, or area. Contractor and all associated sub-contractors' employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as directed by Department of Defense (DOD), Headquarters, Department of the Army (HQDA) and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition

(FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

(N/A) Contractor Employees Who Require Access to Government Information Systems. All contractor employees with access to a government info system shall be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and shall successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter.

(N/A) The contractor shall complete Information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees shall complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions shall comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M and Army Regulation (AR) 25-2 within seven days of employment.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACT ADMINISTRATOR. The official government representative delegated authority by the contracting officer to administer a contract. This individual is normally a member of the appropriate contracting/procurement career field and advises on all technical contractual matters.

2.1.2. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or services to the government. The term used in this contract refers to the prime.

2.1.3. CONTRACTING OFFICER. A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the government.

Note: The only individual who can legally bind the government.

2.1.4. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical directions to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does not have authority to change the terms and conditions of the contract.

2.1.5. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the performance work statement.

2.1.6. DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.7. GOVERNMENT-FURNISHED PROPERTY (GFP) OR GOVERNMENT PROPERTY

(GP). Property in the possession of, or directly acquired by, the government and subsequently made available to the contractor.

2.1.8. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the key personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the people that are listed in the proposal.

2.1.9. PHYSICAL SECURITY. Actions that prevent the loss or damage of government property.

2.1.10. QUALITY ASSURANCE. The government procedures to verify that services being performed by the contractor are acceptable in accordance with established standards and requirements of this contract.

2.1.11. QUALITY ASSURANCE SPECIALIST. An official government representative concerned with matters pertaining to the contract administration process and quality assurance/quality control. Acts as technical advisor to the contracting officer in these areas.

2.1.12. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.13. QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of a product or service shall meet contract requirements.

2.1.14. SUBCONTRACTOR. One that enters a contract with a prime contractor. The government does not have privity of contract with the subcontractor.

2.1.15. WORKDAY. The number of hours per day the contractor provides services in accordance with the contract.

2.1.16. WORK WEEK. Monday through Friday, except for federal holidays unless specified otherwise.

2.2. ACRONYMS:

ACOR Alternate Contracting Officer's Representative

AFARS Army Federal Acquisition Regulation Supplement

AR Army Regulation

ATCTS Army Training Certificate Tracking System

ATO Authority to Operate

CFR Code of Federal Regulations

CMR Contract Manpower Reporting

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTS Commercial-Off-the-Shelf

DA Department of the Army

DD250 Department of Defense Form 250 (Receiving Report)

DD254 Department of Defense Contract Security Requirement List

DFARS Defense Federal Acquisition Regulation Supplement

DHA Defense Health Agency

DMDC Defense Manpower Data Center

DOD Department of Defense

FAR Federal Acquisition Regulation

FPCON Force Protection Condition

GP Government Property

GFP Government Furnished Property

HIPAA Health Insurance Portability and Accountability Act of 1996

HQIIS Headquarters Installation Information Systems

HQDA Headquarters Department of the Army

ID Identification

IA Information Assurance

IAW In Accordance With

IT Information Technology

KO Contracting Officer

MEDCOM Medical Command

MTF Medical Treatment Facility

OCI Organizational Conflict of Interest

OCONUS Outside Continental United States (includes Alaska and Hawaii)

ODC Other Direct Costs

PIPO Phase In/Phase Out

PIV Personal Identification Verification

POC Point of Contact

PRS Performance Requirements Summary

PWS Performance Work Statement

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Program

TAA Trade Agreement Act

TE Technical Exhibit

TO Task Order

U.S.C United States Code

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: The government will not provide any services

3.2. Facilities: The government will not provide any facility resources.

3.3. Utilities: The government will provide any utilities

3.4 Incidental Equipment: The government will not provide any facility resources

3.5. Equipment: Government equipment includes backup media (magnetic tapes) and digital data. Locks on the storage cases are provided by Brooke Army Medical Center.

3.5. Materials: The government will not provide any materials.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1. General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Part 3 of this Performance Work Statement (PWS).

4.2. Facility Clearance Level. Not Applicable

4.3. Materials: The contractor shall provide all materials, supplies, and equipment necessary to meet the requirements under this PWS.

4.4. Equipment: The contractor shall provide all equipment required to meet the requirements under this PWS. Not Applicable

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. Basic Services. The contractor shall provide all management, tools, supplies, equipment, transportation and labor to safely and securely store backup media, digital records, and electronic data at an offsite location. The contractor shall provide a tum-key solution that provides environmental controls to securely store, track and efficiently transport stored data to and from storage facility until data is needed for emergency recovery.

5.2. Task Heading. A comprehensive suite of services to transport, store, manage, relocate, and retrieve backup media from a secure, offsite facility operated by trained experts. Provide services to manage backup media across its lifecycle.

Moving tapes offsite and into the care of a trusted third party with proven resources, technology and experience focused on protecting our data, to reduce downtime and restoring data to operational levels.

Data should be stored in a climate controlled highly protected facilities that is TAA compliant.

Each vault shall maintain acceptable temperature (60 - 70 degrees F). Away from 100-year flood plain and known fault lines. Away from statistically high crime and fire areas. Entire building must have 100% fire suppression coverage. Must be at least 20 miles from computer location.

Site must be accessible to major commercial center. Data shall be available whenever requested;

24/7/365a. Vendor shall have maximum 4-hour response on local emergency requests

Provide a verifiable chain-of-custody and audit trail.

5.3. TAA Compliance. The contractor shall only use equipment that are U.S.-made or designated country end products as set out in the Trade Agreements Act (19 United States Code, U.S.C. § 2501-2581).

PART6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6.1.1 Required Army and DoD Regulations, Directives, BAMC Hospital Policies and Procedures, Circulars & Forms are accessible online at www.army.mil/usapa/ Following is a list of basic publications applicable to this contract/TO. Publications and forms not on the internet can be obtained from the Brooke Army Medical Center.

6.1.2 The Publications have been coded as mandatory or advisory. The contractor shall follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

6.1.3 Mandatory

• AR 25-2 Information Assurance

• AR 530-1 Operations Security

• AR 380-19 Information Systems Security

6.1.4 Advisory

• AR 310-25 - Dictionary of United States Army Terms

6.2 OTHER APPLICABLE BAMC POLICIES. Smoking Policies within Military Treatment Facility (MTFs). The contractor shall ensure that all employees comply with the U.S. Army Medical Command (MEDCOM) and Military Treatment Facility (MTF) smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

TECHNICAL EXHIBIT 1

http://www.army.mil/usapa/

Performance Requirements Summary

The Contractor service requirements are summarized into performance objectives that relate directly to mission failure if not accomplished. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Required Outcome

Performance Objective

PWS Acceptable Quality Level

(AQL)

Incentive (Positive and/or Negative)

(Impact on Contractor Payments)

Data Transportation

The contractor shall securely transport data from BAMC to TAA compliant storage site.

5.2 100% Compliance COR will perform random checks

Data Storage The contractor shall provide secure TAA compliant storage for all BAMC data.

5.2 100% Compliance COR will perform random checks

Data Retrieval The contractor shall ensure availability of the data when/as needed

5.2 100% Compliance COR will perform random checks