Att_01_-_Performance_Work_Statement_2017-12-19.pdf

DOS Request for Proposals No. SAQMMA17R0168, Attachment 01

PERFORMANCE WORK STATEMENT

I. Purpose The purpose of this contract is to provide best-in-class global security engineering and supply chain management services in support of the U. S. Department of State (DOS), Bureau of Diplomatic Security (DS), Countermeasure Directorate (DS/C). This performance work statement (PWS) presents DS/C’s requirements, objectives, required results, performance standards and applicable business rules by function.

II. Introduction The current international environment presents significant challenges for the conduct of U.S. diplomacy abroad with random physical and technological attacks occurring even in friendly countries. Moreover, the DOS increasingly finds itself not only taking on missions in hostile countries with combat zones supported by the military, but also in failed states where terrorism is an ever-present fact of life. As the combat missions subside, the Department remains engaged in country stabilization, economic assistance, advice on establishment of functional governments, and other support missions as directed.

DS is responsible for providing a safe and secure environment for the conduct of U.S.

foreign policy. Since its inception in 1916, DS has evolved and developed new capabilities to meet the changing needs of the DOS. Every diplomatic mission in the world operates under a security program designed and maintained by DS. DS/C is responsible for protecting U.S. personnel, facilities, and information, in the United States and abroad, through physical, technical, and information system security countermeasures.

The constantly evolving threat environment and emerging vulnerabilities in DOS facility security postures can lead to sudden changes in DS/C priorities. Additionally, the speed of technological change in some systems can put pressure on DOS engineering programs and budgets to assess the tradeoffs between short-term and long-term solutions. In this challenging environment, DS/C must remain on the cutting edge of the latest developments in countermeasures in order to protect U.S. personnel, facilities, and information in DOS facilities around the world.

To support this critical life safety/facility security mission, DS/C provides a contractor-operated supply chain management program (DS SCM) to support its security engineering efforts and distribute related products and services to customers in various organizational components within the DOS and to other U.S. government agencies associated with DOS efforts. More is continually being asked of the DS SCM operation.

In response, DS/C has engaged industry supply chain and logistics experts to gain a greater understanding of the current state of the art. The intent is to leverage the techniques, tools, distribution channels, analytics, and management processes developed by the commercial supply chain industrial base to create a dynamic, solution-focused, supply chain operation that integrates and manages the flow of products, services and information to reduce costs and to effectively and efficiently achieve DS/C mission objectives.

At a high level, the new Global Security Engineering and Supply Chain (GSE&SC) contract features:

• Security engineering to address current and projected gaps in security posture and develop reliable, high impact solutions that can be cost-effectively implemented and sustained;

• Transparent, data-driven, end-to-end, global supply chain management services that optimize the flow of products, services and information to improve performance and reduce costs; and,

• The flexibility and global reach to rapidly support the Countermeasure response to evolving world events.

III. Background

A. Organizational Background Operating from a global platform in 30 U.S. cities and more than 160 foreign countries, DS ensures that America can conduct diplomacy safely and securely. DS plays a vital role in protecting 275 U.S. diplomatic missions and their personnel overseas, securing critical information systems, investigating passport and visa fraud, and fighting the war on terror. In the United States, DS personnel protect the Secretary of State and high-ranking foreign dignitaries and officials visiting the United States, investigate passport and visa fraud, and conduct personnel security investigations.

The Countermeasures Directorate (DS/C) manages the development and implementation of all physical and technical countermeasure security standards and policies that apply to DOS facilities domestically and overseas; securely transports classified diplomatic materials across international borders; and provides defensive equipment to protect the lives of U.S. government personnel, classified information, and property worldwide.

The Office of Security Technology (DS/C/ST or ST) supports the DS mission through the application and use of technical security countermeasures. Following the commissioning of a DOS facility, the security technology and its infrastructure become ST’s responsibility to operate and maintain. Within ST, the Facility Security Engineering Division (DS/C/ST/FSE or FSE) is responsible for developing technical security solutions, installing and maintaining technical security systems, both overseas and domestic, management of the DS SCM program, and oversight and monitoring of the GSE&SC contract.

Attachment 03 provides further details on the ST organization including its offices and branches and their respective areas of responsibility.

B. Operational Background

1. GSE&SC Customer Profiles GSE&SC is intended to support customers from different components within the DOS and from other U.S government agencies who are associated with DOS efforts. The following profiles are intended to provide a representative sample of GSE&SC customers and the ways in which they are likely to use the GSE&SC contract throughout the period of performance. The list of customers and services are not exhaustive and are expected to change over the period of performance. For background purposes, Attachment 04 provides historical order volume by customer through Option Year 4 under the current DS SCM contract.

ST systematically installs, maintains and assesses existing technical security systems and designs and implements new technical security solutions. ST branches and divisions will depend on the effectiveness and efficiency of the Contractor to provide needed solutions, materials, and equipment to support their missions:

• The Security Technology Operations Division (DS/C/ST/STO or STO) supports technical security system repair, maintenance, and small-scale installation projects for overseas facilities. STO operates worldwide through regionally-organized engineering facilities. Currently, five Regional Directors for Security Engineering (RDSE) oversee security at 15 Engineering Services Centers (ESCs).

These Engineering Services Centers provide support to smaller Engineering Services Offices (ESO) and Technical Security Offices (TSO). ESCs are home base for many Security Engineering Officers (SEO), Security Technical Specialists (STS), Regional Security Technicians (RST), support staff, and Navy construction battalion personnel (Seabees). These technical personnel are responsible for installing, maintaining, and repairing technical security equipment overseas. They will rely on GSE&SC for supply and logistics services, materials and equipment, depot repair and maintenance, and support for special installation projects.

• The Countermeasures Program Division (DS/C/ST/CMP or CMP) is primarily responsible for worldwide technical countermeasures policy for the Department.

Countermeasures policies enforce the protection of sensitive and classified information. CMP also manages the overseas technical surveillance countermeasures (TSCM) program. CMP will use GSE&SC for supply and logistics services, depot repair and maintenance, and for management of its inventories in the Consolidated Warehouse.

• The Facility Security Engineering Division (FSE) develops, supplies, installs, and maintains technical security systems in support of the broader ST mission. FSE branches are expected to rely heavily on the GSE&SC contract. Representative activities and services will include:

o Technical security upgrades (TSU) renovate technical security systems and their supporting infrastructure to ensure posts and remote command centers stay well-equipped to detect and counter modern threats. The Project Management and Engineering Branch (DS/C/ST/FSE/PME or PME) will use GSE&SC for supply and logistics for all of the equipment and materials required to perform TSUs at U.S. missions around the world. PME will rely heavily on the Contractor’s capability to manage the lead times of multiple vendors, consolidate equipment and materials for shipping, and to coordinate shipments to arrive on post in accordance with installation schedules. Key to the success of the PME work effort is the ability to get predictable, consistent lead times, and to have reliable, on-schedule deliveries world-wide to ensure coordination with deployed installation teams. To avoid excessive storage costs and customs charges, PME will depend on the Contractor to work with each post to expedite the customs process and ensure that the proper personnel are notified when shipments arrive. PME will also depend on the Contractor to adjust to changes in priorities and installation schedules that require project materials to be stored or returned from Post.

o The Domestic Management and Engineering Branch (DS/C/ST/FSE/DME or

DME) will use GSE&SC for supply, logistics, and project staging and storage space for all the equipment and materials required for new technical security system installations and technical security upgrades at domestic locations.

DME projects typically require coordination with other government offices and agencies, facility management, and other stakeholders. DME will rely on the Contractor to adjust to changes in priorities and installation schedules that require project materials to be stored or returned from an installation site.

DME will also rely on the Contractor to stock and operate a government-provided resupply facility (located in the Consolidated Warehouse, Springfield, Virginia) supporting its Washington D.C. Metropolitan Area repair and maintenance activities.

o The Facilities Support Branch (DS/C/ST/FSE/FSB or FSB) will use GSE&SC for supply and logistics for all the materials necessary to support the X-ray, explosive detection, and other designated critical equipment programs both domestically and overseas.

o The Technology Development Branch (DS/FSE/TDB or TDB) identifies, evaluates, approves, documents, and provides technical support for Technical Security Systems (TSS) used by the Department of State at both domestic and overseas facilities. GSE&SC will provide specialized subject matter expertise and security engineering services to ensure fielded products meet DOS technical specifications, and to support TSS that is deployed in the field at DOS facilities worldwide. TDB will also use GSE&SC to provide subject matter expertise and technical services in support of its Lock Program.

• The Security Systems Integration Division (DS/C/ST/SSI or SSI) provides protective technologies for personnel and connects the Department’s technical security systems globally, providing operational security information and technical security data for U.S. government facilities worldwide. SSI will use GSE&SC for supply and logistics and to provide specially configured facilities for project staging, configuration, and storage, including the facilities required to integrate protective technologies into DS vehicles, and the facilities used to configure Security Management System enterprise (SMSe) workstations and servers and high definition video systems (HDVS). SSI will also use GSE&SC to procure the software licenses and hardware that provide the core technical functionality for ST-managed networks worldwide, including integrated technical security systems, and supporting applications that provide data availability to DS staff at Post and to remote monitoring centers.

The Contingency Operations Division (DS/C/PSP/CO or CO) of the Office of Physical Security Programs (PSP) manages all physical security countermeasure projects in high-profile, high priority contingency environments. CO will use GSE&SC for supply and logistics in support of their response to ongoing contingency operation efforts.

The Weapons of Mass Destruction Division (DS/C/PSP/WMD or WMD) provides training and equipment to personnel to aid them in surviving a chemical, biological, radiological or nuclear attack. WMD will use GSE&SC for supply and logistics for mission-related products and materials.

The Defensive Equipment and Armored Vehicles Division (DS/C/PSP/DEAV) fields equipment for the protection of life and property from terrorism and other acts of violence both domestically and at Foreign Service Posts. DEAV will use GSE&SC for supply and logistics in support of both its Defensive Equipment and Armored Vehicles programs.

Customers in DOS organizational components outside of DS/C and customers from other U.S. government agencies associated with DOS efforts will also use GSE&SC for countermeasure-related products and services. For example, DS Security Infrastructure (DS/SI) will use GSE&SC for facilities used to configure and burn-in systems destined for overseas posts, and for local delivery of configured systems to Diplomatic Pouch facilities. The DOS Bureau of Overseas Building Operations (OBO), the United States Agency for International Development (USAID), the U.S. Department of Defense (DOD), and DOS tenants will use GSE&SC for supply and logistics for equipment and materials required to resolve vulnerabilities or deficiencies brought to light in Engineering Security Services Reports. As with the other GSE&SC customers, this list is not exhaustive and is expected to change over the GSE&SC period of performance.

2. Security Engineering and Technology Development DS/C follows a disciplined engineering approach to identify and prevent gaps from arising in the DOS security posture. To prevent gaps, cost-effective, sustainable solutions are required that can be smoothly integrated, sourced and distributed.

Additionally, evolving changes in the types of threats will require DS/C to deploy additional categories of physical and technical security systems and to begin implementing TSUs that include enhanced security systems and infrastructure such as:

• High definition, digital video systems that can be remotely viewed and managed

• Advanced Uninterruptible Power Supplies and power system configurations

• Acoustic Deterrent Systems and emergency notification systems

• State-of-the-art Command Centers

• Locking mechanism, electronic key systems and door controls

• Intrusion detection technologies

• Low-light viewing solutions.

Consequently, the development of new security solutions and the provision of technical support services necessary for DOS personnel to field and sustain the approved solutions in DOS facilities are integral to GSE&SC and are expected to grow in importance over the period of performance. Attachment 05 provides TDB’s projected FY18 technology development projects by phase and type.

3. Computerized Maintenance Management System Computerized Maintenance Management System (CMMS) is ST’s enterprise asset, supply chain, and work order management system. Based on IBM's Enterprise Asset Management System, Maximo, CMMS facilitates customer purchase requests, service requests, and tracks government owned inventory. CMMS was recently integrated with the DOS Integrated Logistics Management System (ILMS), the DOS system of record for inventory management.

CMMS facilitates cooperation between ST and other DOS offices by providing an integrated and shared software environment. CMMS tracks office resource expenditures against each activity and provides metrics to support DS resource management decisions.

CMMS enables feedback on procurement actions, greater accuracy of inventories and simplified field reporting on activities and assets. Collection and analysis of this data allows the use of quantitative techniques for process improvement.

SSI manages the CMMS database. The database provides features to track and report on key performance indicators (KPIs) such as cost, location, equipment model, repairs, training, and parts usage.

4. The Customer Ordering Process DS/C customers place orders for a broad range of security-related products and services by generating a purchase request (PR) using the CMMS Purchase Request module.

Customers either select from the CMMS Item Master List (the Catalog) of standard, pre-priced items or, if what they need is not in the Catalog, they request a price quotation (Need Quote or NQ) for other items and services.

Each PR has a pre-established priority level associated with a timeframe required for the Contractor to obtain and enter the quoted price(s) into CMMS. The Purchase Request module has pre-established workflows established for the appropriate approval process.

Upon generation of the PR in CMMS, the Contractor must provide a quote for the product(s) requested and any associated freight or transportation charges in CMMS within the designated timeframe and then the PR is routed for government approval.

Occasionally, a customer’s order will involve installation, project management, specialized subject matter expertise or engineering, specialized training, or other services to fulfill its requirements. In these instances, the specific requirements will be attached to the PR and routed for quoting and approval as above.

Attachment 06 contains a detailed workflow diagram of the PR approval process. Upon government approval, the PR becomes a purchase order (PO) and is routed back to the Contractor for fulfillment, staging and delivery.

Orders are assembled, consolidated, staged, packaged, crated, and containerized to fulfill customer PO. Products are categorized as follows:

• Government-owned, Contractor-managed equipment such as items repaired by the Repair and Maintenance Center, items purchased under other contracts, or items stored to support contingency operations.

• Standard “Catalog” items that are readily available at or below pre-established, predictable target costs to be shipped in accordance with pre-established, predictable timeframes. The Catalog is currently maintained in the Maximo Item Master List (IML) application in CMMS. It contains over 6200 items ranging from a rubber grommet costing less than a quarter to sophisticated technical security equipment like X-ray machines which typically cost around $50,000 and long range thermal cameras which can cost more than $100,000 each. Catalog entries typically identify the main attributes of each item (such as commodity codes, order and issue units), any alternate items that can be used in its place, vendors that carry the item, specifications for the item, photographs, and other parts needed to build the item (i.e., item assembly structure). Catalog entries also identify transportation options and constraints. The catalog is updated regularly.

• “Need Quote” or NQ items are products and services that are not used as frequently, specialty items, or new or miscellaneous items that are needed to support the countermeasure mission. Examples of NQ items include vehicle barriers, the latest technology security equipment for evaluation purposes, specialized protective equipment, component parts for repair, and miscellaneous construction materials and services.

The Contractor is responsible for fulfilling all approved orders. Attachment 07 provides historical order volume by fulfillment method through Option Year 4 of the current DS SCM contract. Attachment 08 presents the list of Catalog items available as of September 2017. Attachment 09 contains a detailed spreadsheet, by line item, of all PRs from Option Year 2 of the current DS SCM contract. Attachment 10 contains a similar spreadsheet of all PRs from Option Year 3. Attachment 11 contains a spreadsheet of all PRs from Option Year 4.

5. Secure Purchasing and Logistics Products and materials destined for introduction into Controlled Access Areas (CAAs) and other secure spaces at DOS facilities must be securely purchased and securely received, stored, staged and packed in a Consolidated Receiving Point (CRP) IAW12 FAH 6 H-300 (Classified), 12 FAM 350, 5 FAH-2 H-830, and other applicable DOS directives. The Contractor is responsible for providing, maintaining, controlling, operating, and managing one or more CRPs sufficient to meet the DS/C mission worldwide.

6. Diplomatic Pouch The DOS Diplomatic Pouch system is designed to transport items for official use of a mission across international boundaries without procedural delay and without inspection by foreign government officials. The diplomatic pouch employs a sealed container, documented and marked to the requirements of the Vienna Diplomatic and Consular Conventions. CMMS provides information by product as to what can be shipped via the diplomatic pouch. Items shipped via the classified diplomatic pouch must be escorted by a Diplomatic Security Courier. The Contractor is responsible for providing all packaging material and labor and for delivering pouch-ready material to DOS unclassified and classified pouch facilities on a daily basis for onward shipping by the DOS.

7. Commercial Shipping and Logistics While a significant percentage of GSE&SC orders will be shipped via diplomatic pouch, shipping via conventional transportation methods is also required. The Contractor is responsible for door-to-door delivery for all shipments that do not utilize the diplomatic pouch, unless otherwise approved by the government, including providing security, coordination, and all other preparations necessary at points of origin and destination to prepare, store, handle, ship, and deliver multiple 20’ containers. The Contractor is also responsible for providing all shipping containers and all packaging material, cardboard boxes, wooden crates, pallets, padded envelopes, flats, burlap, plastic and steel bands, tape and other associated materials. Current physical locations are listed in Attachment

12. Attachment 13 provides the number of PRs fulfilled under the current contract per contract year, categorized by shipping method.

8. The Customer Receiving Process The customer receiving function differs depending on the type of order placed. For overseas project-based orders like TSUs or Operation Center installations, the order is consolidated, staged, and delivery is coordinated with DOS Transit Security, Secure Pouch, the Post or facility customer and the Associate Contractor Agreement (ACA) contractor installation team. Upon receipt of the container or containers, Post receiving personnel produce proof of delivery. The ACA contractor installation team then inventories the contents and receives the order in CMMS. Reconciliation of discrepancies and resolution of issues is conducted IAW applicable ACA provisions.

Other customers typically place two types of orders: the first is specific to a particular repair, maintenance, mission, or installation effort; the second is for restocking a storeroom. The requestor determines the priority, destination and shipping method when placing the order. Shipments are tracked using registry numbers (Pouch) or tracking numbers (commercial) that are input into CMMS by the Contractor upon acceptance of the shipment by the Pouch facility or commercial shipper. Pouch receipts provide proof of delivery for all Pouch shipments; destination receiving documents provide proof of delivery for commercial methods.

IV. Scope of Services The scope of GSE&SC is comprehensive in support of the mission of the DS Countermeasures Directorate. The Contractor shall provide all facilities (with the exception of facilities for the functions specifically identified in the contract as requiring Government-site performance), equipment, personnel, products, and services necessary to identify, develop, field and support approved solutions in domestic and overseas DOS facilities and to manage, control, and operate a global supply chain in support of the DS/C mission around the world.

The scope of this contract expressly excludes construction, as defined at FAR 2.101 Definitions, unless – (a) the construction work is incidental to the furnishing of supplies, equipment, or services (for example, the scope may include simple installation or alteration at a public building or public work that is incidental to furnishing services, supplies, or equipment hereunder; however, if a substantial and segregable amount of construction, alteration, or repair is required, such as for installation of heavy generators or large refrigerator systems or for plant modification or rearrangement, the requirements are beyond the scope of this contract); or (b) the construction work is so merged with non- construction work or so fragmented in terms of the locations or time spans in which it is to be performed, that it is not capable of being segregated as a separate contractual requirement.

V. Requirements

A. Contractor Facility Requirements The Contractor shall provide, maintain, operate and secure facilities to support all contract requirements, with the exception of the functions specifically identified in the contract as requiring -performance at Government sites. The facilities must maintain hours of operation that will support purchasing, receiving, storage, order fulfillment, and shipping operations and all contract service level agreements. The facilities must provide office space for 20 government technical monitors (GTM) and other personnel connected to GSE&SC products and services. Contractor-provided office facilities must be equipped with standard business cubicles (i.e., work surfaces, filing cabinets, and overhead storage), and telephones. The Contractor-provided facilities used for performance of supply chain functions under the current DS SCM contract are presented in Attachment 14.

At a minimum, Contractor-provided facilities must satisfy the following requirements:

1. A Consolidated Receiving Point (CRP) that meets DOS requirements for securely receiving, storing, staging and packing equipment and materials destined for introduction into Controlled Access Areas (CAAs) and other secure spaces at DOS facilities. Security procedures for a Contractor CRP are presented in Attachment 15. The size of the CRP must be sufficient to maintain control of all orders that require secure purchasing, storage, and shipping IAW12 FAH 6 H-300 (Classified), 12 FAM 350, 5 FAH-2 H-830, and other applicable DOS directives.

Procedures for shipping CAA products and contractor CRPs are presented in Attachment 16.

2. Secure outdoor storage sufficient to store 15 20-foot shipping containers.

3. Secure, covered outdoor storage sufficient to store 200 armored vehicles comprising sedans, suburbans and 15-passenger vans within 40 miles of State Annex SA-18, which is located at 8380 Alban Road, Springfield, Virginia, 22150. The outdoor coverage must be sufficient to protect the armored vehicles against UV damage.

4. Sufficient space and equipment for packaging, shipping, receiving, staging, storage and handling of Government-owned, Contractor-managed (GOCM) equipment and materials critical to reducing security vulnerabilities at DOS facilities. Equipment includes equipment such as turnstiles, bollards, alarm systems, cameras, vehicle barriers, gate arms, access control, servers, CPUs and intrusion detection equipment. The current GOCM inventories are provided in Attachment 17.

5. A repair and maintenance facility sufficient to service the technical security equipment listed in Attachment 18. The historical workload is provided in Attachment 25.

6. Loading docks and equipment capable of receiving, unloading and loading commercial trucks and shipping containers.

7. A will-call resupply point for maintenance and repair technicians in the Washington Metropolitan Area within 40 miles of State Annex SA-18 located at 8380 Alban Road, Springfield, Virginia, 22150.

8. Facilities to accommodate ACA-related activities that are connected to products or services that are provided under GSE&SC. ACA contractor personnel may occupy the space on a full-time basis. Contractor-provided office facilities must be equipped with standard business cubicles (i.e., work surfaces, filing cabinets, and overhead storage), and telephones. Contractor-provided configuration, laydown, and setup areas must be sufficient to support the inspection, assembly, testing and preparation of technical security equipment prior to shipment and installation. The requirements for Contractor-provided facilities for ACA-related activities are presented in Attachments 19 and 20 (CCR Facilities). ACA-related facilities must be located within 40 miles of State Annex SA-18 located at 8380 Alban Road, Springfield, Virginia, 22150.

9. Long term storage (storerooms) for supported customers.

Contractor-provided facilities must meet the requirements for the overnight storage of classified material at the SECRET level and must be alarmed to DS standards. The government reserves the right to accept or reject Contractor-provided facilities based on inspection by DS officials.

The Contractor must provide emergency contacts available 24 hours a day, seven days a week (although the large majority of requests will be made between the hours of 7:00a.m.

and 6:00pm Monday thru Friday).

The Contractor-provided facilities shall also be suitable for connectivity to the Department of State OpenNet or ClassNet automated information systems. The DD Form 254 Contract Security Classification Specification and its attachments provide the preliminary requirements for the establishment of connectivity to Department automated information systems.

B. Program Management, Quality Control, and Process Improvement

The Contractor shall operate and manage the GSE&SC program end-to-end, including providing quality control and performance monitoring and reporting. The Contractor shall ensure the continued provision of DS-approved supply chain products and services in alignment with DS/C requirements and customer demand.

Program Management, Quality Control, and Process Improvement 1.a Objective Proactive program management identifies and exploits areas for improvement and resolves or mitigates risks, issues and problem areas before they impact the customer mission.

1.b Required Results

1.b.(1) Actionable metrics/KPIs are established, approved by the government, and employed to monitor and report on service performance.

1.b.(2) Benchmarks and baseline performance measures are developed to fully document results from current processes.

1.b.(3) Interdependencies between individual contracted functions are categorized based upon their potential to impact specific DOS economic or operational objectives.

1.b.(4) Quality control processes and procedures routinely monitor and report on compliance with established Business Rules.

1.b.(5) Opportunities for improvement are identified. Recommendations for new or updated process include business cases, estimated timeframes and costs to implement, recommended courses of action for DOS strategic and tactical planning.

1.b.(6) SCM operations-related data are effectively gathered, managed, and reported. Issues and problems are identified, prioritized, tracked, resolved, and reported. The correct level of DOS leadership is engaged.

1.b.(7) Standard operating procedures (SOP) for contracted functions are developed, maintained, and reviewed on an annual basis.

1.c Performance Standards

1.c.(1) Metrics/KPIs are directly linked to the DOS strategic objectives for the SCM program, and they are consistently employed throughout the SCM program’s life-cycle.

1.c.(2) Quality control processes and procedures are sufficient to ensure compliance with GSE&SC Business Rules.

1.c.(3) Recommended process improvements lead to measureable gains in the efficiency and effectiveness of DOS programs and mission outcomes.

1.c.(4) Cognizant DOS leadership has continual insight and can readily understand the quality of contract performance, to include the emergence of applicable trends.

1.c.(5) SOPs are aligned with DS/C priorities and objectives and promote efficiency, quality output and uniformity of performance, while reducing miscommunication and failure to comply with applicable business rules and DOS directives.

C. Governance The GSE&SC governance framework is intended to invoke trust and confidence between the Contractor and DS/C by clearly defining expectations and authorities; by measuring performance against objectives, required results, and performance standards with mutually agreed-upon assessments, specific metrics and target values; and by rewarding successful performance. The Contractor and DS/C will implement governance through a collaborative partnership to form the framework by which the countermeasure mission is accomplished in an effective and efficient manner. Governance activities shall focus on aligning processes, removing roadblocks, and other transformation activities that enable DS/C to achieve its objectives in a way that ensures proper stewardship of the taxpayers’ money.

D. GSE&SC Business Rules and Change Management The GSE&SC Business Rules describe the unique aspects of performing within the Department of State and, more specifically, the DS Countermeasures Directorate’s operational environment. The GSE&SC Business Rules Change Management Process ensures that all changes in the program constraints and guidelines are managed in a controlled and transparent way. The GSE&SC Contractor and the DOS will implement business rule change management in a manner that ensures that the contract allows for innovation and flexibility while operating in accordance with the applicable regulations and policies.

The Program Management Office (PMO) contractor will act as the librarian for the GSE&SC Business Rules. In this capacity, the PMO contractor will convene periodic meetings, attended by DOS and GSE&SC Contractor representatives. The purpose of these meetings will be to present potential revisions to the Business Rules. For example, a change could be necessitated by new or updated laws or regulations to which the Department must subscribe. A change could also result from new/revised industry standards currently employed by the GSE&SC Contactor. Finally, there may also be an opportunity to revise the Business Rules where the GSE&SC Contractor personnel employ their in-depth knowledge and experience to identify where the current Business Rules are causing the Contractor and/or government to forgo greater efficiencies or more effective processes.

E. Performance Requirements The Contractor shall provide the organizational structure, management, quality control, governance, operational capabilities, services and qualified staff at levels sufficient to perform all contracted functions in a manner that enables DOS to achieve the objectives and produce the required results identified in the function descriptions and tables below.

All functions shall be executed to meet or exceed associated performance standards and in accordance with (IAW) specified business rules.

1. Strategic Planning The DOS uses tiers of physical, technical, and personnel security measures to defend against intruders and other unauthorized activities. Physical and technical security measures intend to deter, detect, and delay perpetrators of hostile or clandestine acts and provide notification and response time for security personnel. The tiers start outside the perimeter walls and end within the secured spaces of the facility, with each tier adding to the overall defense.

To maintain its systems in a state of readiness and to keep pace with technological advances, DS/C systematically assesses its existing security systems and emerging developments in the marketplace, identifies potential gaps in its security posture, and plans for the introduction of new security solutions and technologies to address those gaps.

Strategic Planning 1.a Objective Proactive identification of current and emerging gaps in the

Department’s security posture and countermeasure capabilities promotes timely planning for and introduction of new security solutions and technologies to address those gaps.

1.b Required

1.b.(1) Marketplace developments in technologies that are used in significant DOS systems, or have potential for significant impact on the DOS security posture, are identified and evaluated and recommendations for new or updated solutions are produced in a timely manner.

1.b.(2) Recommendations for new or updated solutions include business cases (solution value propositions), estimated timeframes and costs to develop new solutions, recommended courses of action for DOS strategic and tactical planning, and consideration of DS's ability to sustain and smoothly integrate the proposed market product or solution into the DS security platform.

1.c Performance

1.c.(1) Product obsolescence and gaps are discovered/forecasted early enough to permit proactive replacement.

1.c.(2) Recommendations recognize/expose opportunities for positive return on investment and proactively identify issues such as stagnant inventories or shifts in the cost/benefit of existing or proposed solutions.

1.c.(3) Recommendations, business cases, and courses of action are fully supported by the analyses and documentation and are presented at a level of detail commensurate with the scope of the proposed change.

1.c.(4) Estimated timeframes and costs to develop new or updated solutions are realistic and accurately forecasted.

1.d Business Rules

1.d. (1) Recommendations/proposal must adhere to the DS Security Technology Engineering Process (STEP) in Attachment 21, or DS-approved alternative, and approved SOPs and templates. Minimum content includes: 1) Description of the technology and needs assessment - outlining gaps that are not being met with current technology or reasons for this proposal. 2) An initial ROI to justify the technology (gap filled, cost saving, new technology, meet a new FAM/FAH requirement, enhanced capabilities, obsolescence, etc.)

3) Organized and detailed alternatives, including risk assessments, risk mitigation options, trade-off analyses between cost, schedule and performance, potential plans of action and implementation schedules.

1.d.(2) Changes to procedures and templates must be approved through the DS approval process prior to utilization.

2. Solution Development Solutions must meet the needs and conditions of the individual installation and support post operations. Technical security systems must work in conjunction with physical security and procedural requirements. A well-executed solution design incorporates mandatory features and addresses post-specific considerations. Solution design considerations must include:

• Intended function of the facility;

• Areas to be protected;

• Integration of routine operation, maintenance, and other requirements;

• Political, economic, legal, geographical, and climate-impacted environments;

• The threat rating contained in the Security Environment Threat List (SETL);

• Constraints, including host nation requirements and limitations;

• Total cost of ownership of materials and equipment and other budgetary considerations;

• Manpower constraints; and

• Likelihood of long-term changes in operations, relocation, retrenchment, and threat atmosphere.

Solution designs must also consider cost versus benefit both for optional security measures and for situations where alternative means are available for meeting the requirements. Most security measures, including both equipment (such as intrusion detection systems) and personnel, have on-going costs. Solution designs must consider the total cost of ownership over the solution’s life cycle.

Solution Development

2.a Objective Creative, reliable, high impact security solutions that can be effectively and efficiently implemented and sustained over the solution’s life cycle.

2.b Required

2.b. (1) For each approved project:

2.b. (1)(a) Customer requirements are gathered, refined and documented.

2.b.(1)(b) Solutions are identified, configured for the DOS environment and/or developed.

2.b.(1)(c) Solution performance is demonstrated in lab and field (post) settings, documented and reported. On-site DS technical personnel are trained in the proper installation, configuration, operation, and maintenance of new solutions.

2.b.(1)(d) Technical documentation appropriate to the scope of the change or solution is provided.

2.c Performance

2.c.(1) Requirements are complete, testable, reflect the life cycle of the solution, and are sufficient but not excessive to fill the identified gap.

2.c.(2) Solution alternatives present a range of options in terms of estimated development cost, development time, deployment strategies (e.g., deployment cost, time and method to deploy solution, and time to train installers, users, and sustainment personnel), system cost, sustainment cost (e.g., electrical power consumed, HVAC loading, maintenance costs) system capabilities, risk (i.e., level of confidence in system performance in the DS environment) and total life cycle costs (e.g., licensing, vendor-required maintenance agreements, and end of life cycle costs such as hazardous waste disposal fees).

2.c.(3) Approved solutions are developed within Contractor cost and time estimates.

2.c.(4) Solutions provided are deployable and sustainable and meet the estimated Return On Investment (ROI).

2.c.(5) Alpha and beta test results demonstrate that testing was performed IAW the DS-approved test plan and that delivered functionality fills the gap identified and meets the customer's requirements.

2.d Business

2.d.(1)

Solutions must be developed, tested, and documented IAW STEP, or the approved alternative, and approved SOPs and templates. Changes to procedures and templates must be approved through the DS approval process prior to utilization.

2.d.(2)

DS leadership determines whether to proceed from step to step.

The Contractor must provide pertinent information to facilitate an informed decision at each step. The level of detail and process required must be commensurate with the scale of the proposed change - thus small obsolete items are simpler and require less process and documentation while large complex systems require more a rigorous methodology.

2.d.(3) Documentation must adhere to STEP, or the approved alternative, and approved SOPs and templates. Minimum content includes:

1) Solution Requirements and Concept of Operations (CONOPS)

- describes general expectations of the solution, outlines its capabilities in the Department operating environment and describes applicable use cases. 2) Market Survey (RFI) and Product Comparison of the various products on the market and their ability to meet the requirements. Must include accurate costs for equipment and lifecycle. 3) Product Evaluation (Alpha) testing and comparison testing and documentation, including lessons learned, in a controlled lab environment. 4) Pilot Project Plan (Beta) Testing - testing and documentation of the solution at an operational DOS facility. 5) Final Documentation - part numbers assigned/cataloged and detailed documentation sufficient to allow for independent installation and trouble shooting by customer onsite technical personnel.

3. Project Management The constantly evolving threat environment and emerging vulnerabilities in DOS facility security postures can lead to sudden changes in DS/C priorities. GSE&SC project management processes must deliver project objectives within time, resource and budget constraints while still being agile enough to adapt to changing world events and shifting priorities.

Project Management 3.a Objective Adapt to rapidly shifting project priorities and/or evolving world events that lead to periodic surges in work load.

3.b Required

3.b.(1) Production of approved technical solutions are fully coordinated, scheduled, and managed. In-progress reviews and other schedule updates and status information are consistently provided to DOS customers and stakeholders.

3.b.(2) Solutions are provided for government-directed initiatives including those with compressed project schedules and/or other restrictions due to compelling circumstances.

3.c Performance

3.c.(1) Project plans and schedules are consistently accurate and complete. Project milestones and deliverables are feasible in the time allotted.

3.c.(2) Projects are managed to address sometimes rapidly shifting project priorities, a varying number of concurrent projects, periodic surges in workload, and/or a need to quickly engage in projects that involve unexpected technological disciplines.

3.c.(3) Projects are initiated quickly with appropriate subject matter expertise.

3.c.(4) As directed, projects are quickly, cleanly and cost-effectively interrupted.

3.d Business

3.d.(1) Revisions to approved milestones, deliverables and due dates require prior government approval.

3.d.(2) The status of ongoing projects must be briefed to government management and staff weekly, at a minimum.

4. Solution Sustainability Onsite DS technical personnel install technical security systems, manage corrective and preventive maintenance, and inventory technical security system equipment. DS technical personnel follow the installation and maintenance procedures found in the DS-approved Deployment Documents and Application Guidelines. DS technical personnel are provided Technical Bulletins and New Product Announcements to keep them apprised of issues and new solutions. DS technical personnel are also provided Tier 3 support, specialized subject matter expertise, and training in response to questions or issues concerning proper installation, operation or maintenance of TSS equipment.

Solution Sustainability 4.a Objective Documentation and Tier 3 support promote independent installation, troubleshooting, repair, and maintenance of technical solutions by on-site technical personnel.

4.b Required

4.b.(1) Technical documentation for DS engineers, technical specialists, and other technical personnel is produced, updated, and maintained. Document repositories and work flow/collaboration websites (currently EaRL, video EaRL and SharePoint) are maintained and updated on a timely basis.

4.b.(2) Requests for subject matter expertise and Tier 3 technical support are received, acknowledged, tracked, resolved, and closed.

Requests are regularly analyzed to determine and address technical and support documentation gaps.

4.c Performance

4.c.(1) Documentation meets or exceeds content and template standards and is usable, responsive, technically accurate and complete.

Documentation is sufficiently clear and detailed to permit DOS technical personnel to effectively and independently install, troubleshoot, repair, and maintain technical solutions.

4.c.(2) Documentation is updated periodically and urgent issues are updated as directed. Updates to reflect current installation, configuration, maintenance, and operations information and to reduce Tier 3 support are completed proactively. Deliverables consistently meet agreed-upon schedules.

4.c.(3) Customer support requests are acknowledged expeditiously and appropriately resolved within agreed-upon time frames.

4.c.(4) Technical support provided is usable, responsive, technically accurate and complete.

4.d Business

4.d.1 Documentation must adhere to DS-approved templates and SOPs.

Changes to procedures and templates must be approved through the DS approval process prior to utilization

5. Secure Key System Review The DS Lock Program reviews and approves lock and key schedules to ensure that designs meet established standards, to reduce errors, and to provide consistent quality.

Secure Key System Review 5.a Objective Complete and accurate key systems facilitate usability and reduce facility vulnerability.

5.b Required

5.b.(1) Key system schedules and designs reflect the correct terminology and formatting, appropriate hardware, project nomenclature, key progression and quantities.

5.c Performance

5.c.(1) Customer support requests are acknowledged and resolved within agreed-upon time frames.

5.c.(2) Support provided is usable, responsive, technically accurate and complete.

5.c.(3) Design reviews of keying schedules for OBO projects and major keying efforts are performed IAW approved DS guidelines.

5.c.(4) Keying issues are coordinated with vendors and customers and resolved within agreed upon timeframes.

5.d Business

5.d.1 Secure key system reviews and support must adhere to the DS-approved SOP in Attachment 22.

6. Customer Service Center The GSE&SC customer service center (GCSC) serves as the primary point of contact for technical information and technical support requests for the DS/C organization and its programs. The GCSC is also the primary interface for customer questions about or issues with GSE&SC orders and Contractor-provided products. The GCSC processes and resolves information and service requests (acts as a typical Tier 1 call center), and, if necessary, creates work orders and routes them to First Responders and other DS programs for follow-up from subject matter experts. The GCSC also reports on the status of product and service issues and work orders, provides support for Global Identification (GLID) Card systems and Security Management System Enterprises (SMSe), and assists in asset creation. The GCSC must be staffed and available 24 hours a day, seven days a week, and 365 days a year.

GSE&SC Customer Service Center 6.a Objective Convenient, responsive, customer service enhances the effectiveness and efficiency of customer operations, increases the uptime of DS technical security systems, and improves customer satisfaction with supply chain and security engineering services.

6.b Required

6.b.(1) Provided services adapt…