Solicitation W91RUS23R0047.pdf

SEE ADDENDUM

(No Collect Calls)

W91RUS23R0047 04-Aug-2023

b. TELEPHONE NUMBER

520-533-5269

8. OFFER DUE DATE/LOCAL TIME

09:00 AM 11 Aug 2023

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W91RUS9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

RHONDA GILL

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011856939

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

ACC-APG - HUACHUCA DIVISION

2133 CUSHING ST

BLDG 61801 RM 3410

FORT HUACHUCA AZ 85613

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W5K9CW 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

W6SQ SIG CNTR GORDON

W6SQ SIG CNTR GORDON

BLDG 2212

10TH AVE

FORT GORDON GA 30905-0000

TEL: 520-538-7188 FAX:

(520) 538-1838FAX:

TEL: (520) 538-1376 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$12,500,000

NAICS:

811310

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF57

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W91RUS23R0047

Section SF 30 - BLOCK 14 CONTINUATION PAGE

INSTRUCTION TO OFFERORS

INSTRUCTIONS TO OFFEROR-COMMERCIAL ITEMS.

OFFEROR IS REQUIRED TO READ ALL INSTRUCTIONS AND COMPLY WITH THE

INSTRUCTIONS.

1. Please fill in (write/type) On the First Page of the Government 1449 Solicitation, Blocks 17a, 30a, 30b, 30c.

2. Fill in ALL Pricing and All Applicable TAXES on ALL Line Items (CLINs). Please TOTAL ALL CLINs, IN YOUR QUOTE to show an overall FINAL Price and include ALL shipping charges as FOB Destination. When submitting your quote in response to this Request for Quote, the offeror shall provide their best pricing, including all discounts. Attachment(s) to the SF 1449 please ensure your cost on the attachment matches your entry, if applicable

3. Include the delivery lead-time; if lead-time differs from solicitation, notate delivery lead time on the quote.

4. Provide the following information with your offer:

e. POC Name: __________________________________

f. POC Phone Number: _________________

g. POC E-Mail: ___________________________

5. The Government will award a Firm Fixed-Price contract resulting from this solicitation on a lowest-priced technically acceptable basis (considering the following two factors:

technical, and price.) All offerors shall be considered in terms of price, lowest to highest, and then the apparent lowest-priced offeror will be evaluated for acceptability under the technical and price factors. If the lowest-price offeror is evaluated as unacceptable, the acceptability of the next lowest-price offeror will be evaluated, continuing this process as necessary. The offer shall meet all terms and conditions of the solicitation and shall detail the offered solution in their quote or attach a data specification sheet.

6. Complete the Following Clauses (located below in the Contract Clauses).

a. FAR clause 52.212-3 “Offeror Representations and Certifications” Commercial Items. Section B of this clause still needs to be completed in its entirety and returned to the contracting office with your quote.

b. FAR Clause 52.204-26 “Covered Telecommunications Equipment or Services- Representation. Section B of this clause still needs to be completed in its entirety and returned to the contracting office with your quote.”

c. FAR Clause 52.204-24 “Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment Section B of this clause still needs to be completed in its entirety and returned to the contracting office with your quote.”

7. Quote/Proposal shall be received electronically to RHONDA.K.GILL.CIV@ARMY.MIL not later than 09:00AM Local AZ time, on Friday 11 August 2023.

8. Questions about the solicitation are to be directed rhonda.k.gill.civ@army.mil All electronically before the due date of 7 August 2023 at 09:00AM Local AZ time.

Additional Information

1. Vendor invoicing shall not be submitted prior to proof of delivery that items have been received.

2. The CLINs in this schedule are being competed as BRAND NAME and must be entered with the made, model, and description of equivalent if so quoted-In accordance with the Federal Acquisition Regulation (FAR) 52.211-6.

3. Per DFARS 252.232-7003 Electronic Submission of Payment Requests, the vendor shall submit combination payment requests (invoice and receiving report) using Wide Area Work Flow (WAWF). Receipt and Acceptance (WAWF-RA) or other methods authorized by the Contracting Officer. Failure to comply could result in delayed payment.

4. Please provide a detailed breakdown or narrative of what is being provided to meet the requirement. Do not copy and paste the line item information from the RFQ to your bid as this could classify a bid unsuccessful in the technical evaluation process. We require detailed descriptive information on all bids.

5. Support Renewals – NO THIRD PARTIES WILL BE ACCEPTED.

6. ONLY THE CONTRACTING OFFICER (KO) CAN MAKE CHANGES TO THE

CONTRACT/DELIVERY ORDER/PURCHASE ORDER.

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 10 Job Project Management

FFP

Description: G2 Custom Federal Cross Domain Professional Services - Transfer Part #: G2CUS TFCDCDT FOB: Destination

PURCHASE REQUEST NUMBER: 0011856939

PSC CD: D399

NET AMT

0002 1 Job G2 Custom Federal Cross Domain Services

FFP

Description: G2 Travel Cost - Cross Domain Access Part #: Travel FOB: Destination

0003 1 Job G2 Travel Cost

FFP

G2 Travel Cost FOB: Destination

STATEMENT OF WORK

1.0 Introduction and Background

Commercial Solutions for Classified (CSfC) is an important part of the Department of Defense (DOD) and National Security Agency’s (NSA) commercial cybersecurity strategy; it is designed to deliver secure cybersecurity solutions quickly by leveraging commercial technologies and products.

The 7th Signal Command (Theater), 7SC(T), installs, operates, and defends network and mission command capabilities for joint, interagency, intergovernmental, and multinational forces within the western hemisphere in support of unified land operations.

The 7SC(T) in conjunction with the Fort Gordon Network Enterprise Center (FGNEC) provides a multilevel access solution with support for Commercial Solution for Classified (CSfC) using an approved connectivity for up to 2000 users.

The CSfC Mobile Access Capability Package will provide the infrastructure to meet the requirements for the 7SC(T) to connect Non- secure Internet Protocol Network (NIPR) and SECRET Internet Protocol Network (SIPR) enclaves more efficiency and securely throughout their facilities and sites. The CSfC solution will integrate with enterprise infrastructure including an approved multilevel access solution provided by a Virtual Desktop Infrastructure (VDI).

This Statement of Work defines the scope of work to be performed by the Contractor, in support of implementation and accreditation of Forcepoint Data Diode (FDD) Commercial Solutions for Classified (CSfC) Continuous Monitoring (CM) implementation for Army 7th Signal CSfC and upgrading and accreditation of the latest version of the Forcepoint Trusted Guard System supporting the Fort Gordon (FG) CSfC/Multiple Independent Levels of Security (MILS) capability.

2.0 Scope

2.1 Forcepoint Data Diode (FDD) Commercial Solutions for Classified (CSfC) Continuous Monitoring (CM) Implementation and Accreditation

2.1.1 Technical Project Management

The contractor will be responsible for the following technical project management tasks prior to and during the period of performance.

Oversight of all contractors Resourcing from the overarching budget of the contract Budgeting off the contracted dollar amount Scheduling and milestone management Project risk communication and management

2.1.2 Pre-Onsite Engineering Services

The contractor will be responsible for documenting the recommended FDD architecture as a System Design Document (SDD) and presenting that to the Government POC for approval.

2.1.3 Pre-Onsite A&A Services

The contractor will be responsible for supporting all customer Authorization and Accreditation (A&A) discussions regarding scheduling, coordination, and Body of Evidence (BoE) expectations. The contractor will also ensure that all pre-coordination needed to be done with the Army Cross Domain Management Office (ACDMO) and/or National Cross Domain Strategy and Management Office (NCDSMO) is either completed or communicated to the customer so that they can complete prior to the implementation/upgrade. The contractor will also provide all necessary documentation inputs and support via any collaboration means to ensure meeting of A&A milestones.

The following FDD Documentation Inputs are identified but are not to be thought as exhaustive. If any additional requirements are identified by the ACDMO or NCDSMO, they are also required:

Input to the Cross Domain Appendix (CDA), or System Security Plan (SSP) Inputs to the Security Control List (tailored to CDS overlay) (SCL) (if required) Inputs to the Security Controls Traceability Matrix (SCTM) (if required) Update Site Based Security Assessment (SBSA) Test Plans (if required) Update SBSA Test Procedures (if required) Software Administrator’s Guides (SAGs)

The contactor must be authorized by the ACDMO and/or NCDSMO to perform the above functions.

2.1.4 Onsite Implementation Services

The following onsite implementation services are identified:

One (1) engineer authorized by Forcepoint and the ACDMO and/or NCDSMO to perform FDD implementation over the course of one (1) week

Deployment of the FDD solution Installation and configuration of two (2) FDDs (including a pitcher and catcher each) Integration of the FDD solution within the FG CSfC/MILS network Integrate and test connectivity between the FG CSfC “Grey”, “Red”, “Black” and the FG Secret Installation Campus Area Network (S-ICAN) Perform functional end-to-end testing with customer approval Provide FDD administrator training

2.1.5 Onsite A&A Services

The following onsite A&A services are identified:

One (1) engineer authorized by Forcepoint and the ACDMO and/or NCDSMO to perform A&A Services over the course of one (1) week

Assist site in creating FDD and TGS SBSA Report and Plan of Action and Milestones (POA&M) findings, if necessary.

Contractor must be authorized by Army CDMO and NCDSMO to perform the above functions.

2.1.6 Post-Onsite Follow-Up Services

The contractor will perform the following post-onsite follow-up services:

Create and deliver Trip Report Update and deliver final revision of SDD

3.0 Administrative Requirements

3.1 Contracting Officer’s Representative (COR)

The KO will provide a COR Designation Letter for this Contract upon award. The Contractor shall acknowledge the COR Designation Letter in writing and return to the KO within 5 business days of receipt.

3.2 Service Contract Reporting.

The requirement for contract manpower reporting shall be IAW FAR clause 52.204, Service Contract Reporting

a. The Contractor shall report ALL Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this task order via a secure data collection site. The Contractor is required to fill in all required data fields completely using the following web address: http://www.sam.gov.

b. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), October 1 through September 30.

While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. For assistance, see the Help page on sam.gov.

3.3 Phase-In

The Contractor shall conduct phase-in procedures beginning 90 calendar days prior to the performance date specified in Section F of the contract. The phase-in shall require coordination with the incumbent Contractor for acceptance of the program. The Contractor shall perform a joint inventory of GFP listed in TE2 with the incumbent Contractor and the designated Government Contracting Officer’s Representative (COR), Government Property Administrator (PA), or Property Book Officer (PBO). All discrepancies and problems shall be noted and submitted to the Government PA for resolution.

3.4 Phase-Out

The services under this contract are considered vital to the Government and must be continued without interruption upon contract expiration. Therefore, the Contractor shall provide phase-out services IAW FAR 52.237-.

3.5 Place of Work and Work Hours

The Contractor's place of duty shall be in a Government provided office environment located at Fort Gordon, GA, unless in a TDY status. ACCESS TO CLASSIFIED

INFORMATION IS LIMITED TO GOVERNMENT WORK LOCATIONS. NO

CLASSIFIED INFORMATION SHALL BE DISCUSSED, PROCESSED, OR STORED IN

THE CONTRACTOR’S FACILITY. The Government requires support from 0700 –

1700, Monday through Friday, excluding Federal holidays. The Contractor shall ensure appropriate coverage from 0700 to 1700. A regularly scheduled lunch break must be taken. The KO must approve, in advance, any deviation from the standard schedule, including any additional duty hours and all overtime supporting this requirement.

3.6 Training

All Contractor personnel shall be trained and have the required certification to provide the support as defined in this SOW. The Government will only provide one-time training to the existing contractor personnel for new technology not previously identified that can be directly correlated to the tasks within the SOW. If trained Contractor personnel are replaced, the Contractor shall be responsible for training the replacement employees at the Contractor’s expense before they begin work on this contract/task order.

3.7 Travel

The Contractor shall provide support at Fort Gordon, GA. The support outside Fort Gordon, GA area will be designated as TDY. The Contractor shall obtain all necessary travel documents to execute travel as required, including but not limited to U.S.

Government-issued passports to support OCONUS travel requirements. The Contractor shall ensure all Contractor employees comply with all guidance, instructions, and general orders applicable to U.S. Armed Forces and DoD civilians and issued by the Theater Commander or his/her representative. This shall include any and all guidance and instructions issued based on the need to ensure mission accomplishment, force protection, and safety. The Government will reimburse the Contractor, in accordance with the Joint Travel Regulation (JTR) and FAR part 31.205-46, for all approved travel incurred during the performance of this task order. The COR will approve all travel requirements before travel begins.

3.8 Security

3.8.1 This requirement will require access to classified and controlled or sensitive information and facilities. Upon performance start date, all Contractor personnel shall possess and maintain during the task order life a SECRET security clearance in accordance with DD Form 254, Contract Security Classification Specification.

Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in this SOW and in effect at the work sites. Contractor personnel may require access to SIPRNET in support of this work effort. SIPRNET access shall only be at specified Government work locations.

3.8.2 Threat Awareness and Reporting Program (TARP) Training. All cleared contractor personnel assigned to this contract/task order shall complete initial and annual TARP training. Completion of training shall be reported to the COR. Detailed requirements on TARP are stated in the DD Form 254.

3.8.3 Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office (PMO), Director of Emergency Services (DES), or Security Office. Contractor workforce shall comply with all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract/task order, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

3.9 Physical Security

The Contractor shall safeguard all Government equipment, information and property provided for Contractor use.

3.10 Key Control

All references to keys include key cards. The Contractor shall ensure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate Government-issued keys.

The Contractor shall include procedures covering key control in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrence of lost or duplicate keys to the COR.

3.11 Lock Combinations

The Contractor shall ensure all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

The Contractor shall include these procedures in the Contractor’s QCP.

3.12 Protection

3.12.1 Army Cybersecurity

3.12.1.1 Army Cybersecurity Minimum Requirement

3.12.1.1.1 Cyber Security Awareness Training

The Contractor shall ensure that all contractor employees and subcontractor employees as a condition of access to Government information systems and networks shall successfully complete the annual Cybersecurity Awareness training as specified in AR 25-2, DA Pam 25-2-6, and as specified by the Government requiring activity. The contractor employees and subcontractor employees shall complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract. Cyber Awareness Training is available at https://cs.signal.army.mil or https://jkodirect.jten.mil/.

3.12.1.1.2 Army IT User Agreement

The Contractor shall ensure that all contractor employees and subcontractor employees sign an Army IT User Agreement (UA) (formerly Acceptable Use Policies (AUP)) at the same time the Cyber Awareness training is completed at the start of work performance on this contract and annually thereafter for the duration of this contract. The Army IT UA is available immediately after completing the training at https://cs.signal.army.mil or downloadable from ATCTS under documents.

3.12.1.1.3 Army Training and Certification Tracking System (ATCTS) Profile Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create an ATCTS user profile at https://atc.us.army.mil, under the unit(s) container designated by the COR. Contractor employees shall document, update, and retain their training and certification status in ATCTS.

3.12.1.1.4 Cyber Security Fundamentals (CSF) Training

The Cybersecurity Fundamentals training (formally known as IAF) is the minimum training requirement for all Cyberspace IT and Cybersecurity functions and is required every three years. Training is available at https://cs.signal.army.mil and automatically uploads in ATCTS.

3.12.2 Army Cyber Workforce

3.12.2.1 Cyberspace Workforce Qualification/Requirement/Certification Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.239.7001 (Information Assurance Contractor Training and Certification) applies to this contract.

This contract is subject to the mandates of DoDI 8140.01, DoD 8570.01-M, and supplementary issuance, which establishes the baseline requirement for personnel performing cyber-IT and cybersecurity functions within DoD.

3.12.2.2 DoD Cyberspace Workforce Framework (DCWF)

The DCWF framework organizes cybersecurity into categories comprised of several specialty areas. Each specialty area consists of multiple work roles. The Contractor shall ensure all contractor employees or subcontractor employees functions under this contract identify with the DCWF work role listed at https://public.cyber.mil/cw/dcwf/work-roles-2. The Contract shall document the DCWF code in ATCTS and appointment letter in accordance with DoDI 8140.01 and DoD 8570.01-M. Contractor personnel performing functions in multiple categories or specialties shall obtain certificates or qualifications to the functions performed in each category and specialty.

3.12.2.3 Baseline Certifications

The Contractor shall ensure all contractor employees or subcontractor employees performing Cyberspace IT and Cybersecurity services/functions under this contract have the baseline certifications corresponding to their functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date.

Contractors shall obtain all other required certifications or qualifications within 6 months of being engaged (e.g., Computing Environment certifications, specialized tools, etc.).

Functions spanning multiple levels require certifications or qualifications of the highest-level functions. The Approved Baseline Certifications table is located at https://cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/.

3.12.2.4 Training and Certification Sustainment

The Contractor shall ensure that all employees’ training, certifications, certification maintenance, continuing education, and sustain training remain active and renewed at the end of the certifications cycle

3.12.2.5 Appointment Letter

Contractor employees performing Cyberspace IT and Cybersecurity services/functions shall be assigned to the position in writing. Contractor employees shall upload a copy of their qualified baseline certification and other appropriate training certifications for their work role to ATCTS in their registered profile and provide copies to the COR for continuous compliance monitoring and reporting. The ATCTS Manager is required to verify the individual’s profile and certification(s), annually for general users and quarterly for privileged users.

3.12.2.6 Network Access and Qualification Requirements

This table provides a summary of each functional category required for this contract aligned with the security investigation, security clearance, network access authorization, and certification qualification to access the level of network or system to perform this contract work functions.

Table 1. Information Technology Access and IA Certification Requirements

Functional Category Network Type

Account Security

Clearance Investigation

Required

Certification Category and Level (IAW

DoD 8570.01-M)

Computing Environment Certifications

Cyber Security SME/Engineer

(A&A) Limited Privileged SECRET Tier 3 (T3) IAT-III Yes

3.12.3 Privately and Contractor Owned Information Technology

The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned or privately-owned systems, devices, or tools to Government systems or networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has been authorized under the Risk Management Framework (RMF) Assess Only process. The non-Government-owned computing systems or devices include items such as, removable media such as external hard drives, optical media such as compact disk (CD)/digital video disk (DVD), flash media such as memory cards, Universal Serial Bus (USB) flash drives, thumb drives, solid-state drives, and multifunction mobile devices such as smartphone, personal digital assistant (PDA), or wireless tablet. No mobile or removable devices or tools should be installed or connected to the Government systems or networks without the COR and ISSM authorizations.

3.12.4 Protection of Sensitive Unclassified Data

The Contractor shall ensure any sensitive information, including, items such as, Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI), proprietary information, and Law Enforcement Sensitive information residing on Portable Electronic Devices (PEDs) or other external media, is protected in accordance with current Government IS guidelines and requirements. The Contractor shall use authorized, approved, and prescribed solutions that comply with current in transit and at rest processes and tools. The PEDs include items such as, laptop, netbook, notebook, or tablet computers, and blackberry or equivalent devices. External media include optional disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), and other portable digital storage devices.

3.12.5 Antiterrorism 5.1 – 5.4

3.12.5.1 Antiterrorism Level I Training

All Contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee to the COR or to the Contracting Officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://jko.jten.mil.

3.12.5.2 iWATCH The Contractor and all associated Subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract start date and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract order start date. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

3.12.5.3 Emergencies and Force Protection Conditions

During declare emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

3.12.5.4 Operations Security

The Contractor is not required to develop an OPSEC Plan. However, the Contractor shall comply with DoD Directive 5205.02E, Army Regulation 530-1, and the requiring activity OPSEC program. Per AR 530-1 Operations Security, the Contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the

COR

3.12.6 Government Property

3.12.6.1. There will be no Government Furnished Property (GFP) provided on this contract/task order.

3.12.6.1.1. Safeguarding Government Property. The Contractor shall safeguard all Government property as defined in the DFARS, FAR and applicable regulations. The Government retains title to all Government-furnished property until properly disposed of, as authorized by law or regulation. The Contractor shall not use any Government property for any purpose other than in the performance of this contract/task order.

3.12.6.1.2. Government Property that is provided to the contractor for use not via the contract/task order will not be considered GFP. This includes fixed equipment that the Contractor is operating and maintaining, does not have full control of, or Government Property that is being made available for the Contractor’s use on a temporary basis or on an as needed basis. The contractor shall protect all Government property from damage, theft and negligence IAW with FAR 52.245-1. The Government may use DA Form 3161, Hand Receipt DA Form 2062, or a locally produced form to provide the property to the Contractor as an audit trail. However, the accountability will remain with the Government.

3.12.6.1.3. Contractor Provided Equipment and Material

3.12.6.1.3.1. Contractor Property. The Contractor shall provide all equipment, parts, safety equipment and clothing, vehicles, tools, materials and items required to perform the requirements of this contract/task order unless provided as GFP. All Contractor provided equipment shall be clearly marked and stored separately from Government property. Upon completion or termination of this contract/task order, the Contractor shall remove all Contractor-owned equipment/property. If the Contractor does not remove Contractor-owned items NLT thirty (30) calendar days after the conclusion of the contract/task order, the Government will properly dispose of the items. The Contractor shall furnish safety protective equipment and clothing required for compliance with NETCOM Regulation 385-1 and other applicable regulations prior to performance start.

3.12.6.1.3.2. Contractor Acquired Property

3.12.6.1.3.2.1. Contractor Acquired Property (CAP) is property acquired, fabricated, or otherwise provided by the contractor for contract/task order performance and to which the Government has title IAW FAR Part 45. CAP items subsequently delivered under this contract/task order shall be considered GFP when retained by the contractor for continued use under this contract/task order and will be added to the GFP TE by a contract modification.

3.12.7 Incidental Property. The Government will provide property incidentals to the place of performance, when the contract requires contractor personnel to be located on a Government site or installation or when teleworking is allowable by the Contracting Officer (KO) in the case of emergency/pandemic situations and the Government considers laptops that are provided with VPN capability as incidental property, and when the property used by the contractor within the location remains accountable to the Government. Items considered to be incidental to the place of performance include normal office type property, for example, office space, desks, chairs, telephones, computers, printers, paper, plotters, and computer peripherals. It does not include any equipment, special test equipment, special tooling, material, or real property.

3.12.7.1 Virtual Private Network (VPN). The Contractor shall use only Government Property to access the Virtual Private Network (VPN). Per DA Pam 25-1-1, the only authorized access from DOD-owned computers, systems, and networks to the Internet is via the NIPRNET. The VPN allows remote DOD computers to meet this requirement by providing a secure tunnel to the NIPRNET. The VPN must be used at all times that the DOD-owned computer is accessing the Internet when using commercial Internet Service Providers. Split-tunneling of VPN connections is prohibited.

3.12.7. 2 No Contractor or Employee-Owned Information Systems (EOIS) are allowed connection or access via the VPN. The NIPRNET is Sensitive Information. AR 25-2, paragraph 4-25c, prohibits the use of EOIS for sensitive information. Non-Army Government agencies will require evaluation on case-by-case bases. Non-DOD hosts will be treated as un-trusted hosts.

3.12.8 Safety

The Contractor shall perform in a manner that assures maximum safety and protection for their employees and all personnel while performing work for this contract/task order.

The Contractor shall exercise surveillance on a continuing basis and shall eliminate or otherwise control existing or potential safety hazards.

3.12.8.1 The Contractor shall participate in the Government’s safety program.

Compliance with provisions pertaining to safety of site facilities and equipment is mandatory. The Contractor shall establish and implement a comprehensive Safety Program Plan for use by contractor and sub-contractor employees. This Plan shall incorporate appropriate elements of 29 CFR 1910 and 1926, AR 385-10, NETCOM Reg 385-1 and applicable OSHA regulatory guidance. The Contractor shall provide the COR and KO with its Safety Program Plan within 30 calendar days of contract/task order award for acceptance. The COR and KO will approve all updates to the Safety Program Plan before implementation.

3.12.8.2 The Contractor shall comply with all federal, state and local policies, directives, laws and regulations. During the performance of tasks requiring protective equipment and clothing, contractor employees shall wear safety items required by OSHA and as specified in the applicable regulations. The Contractor shall be responsible for providing personal protective equipment, clothing and training.

3.12.8.3 The COR may require the Contractor to cease operations associated with the performance of this contract/task order for safety violation reasons. The Contractor shall correct any safety violations, caused by a contractor employee, during non-duty hours at no additional cost to the Government.

3.12.8.4 The Contractor shall ensure all employees receive the safety training required by all federal, state and local laws and policies. The Contractor shall maintain the safety training records and make them available to the COR and KO upon request.

3.12.9 Contractor Identification Requirements In accordance with FAR 37.114(c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials.

Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee’s name, the contractor’s name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees to wear the Contractor ID badges visibly along with the Government issued CAC card and/or special access badges when performing work at Government workplaces. Contractor personnel shall also ensure that all e-mails, documents, or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name. and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

3.12.9.1 Contractor personnel who are retired military shall not use their retired military rank/titles while working in an official role as a Government contractor on this contract.

3.12.10 Common Access Card (CAC)

The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://www.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract/task order for those employees who have a valid and recurring requirement for access to Government facilities or automation systems (reference DD254 for systems access) to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract/task order. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

3.12.11. Access to protected Information

Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent.

Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

3.12.12. Quality Control and Quality Assurance.

3.12.12.1 Contract Quality Requirements. Contract requirements/terms contained in the SOW include those that articulate service and deliverable requirements, and any SOW quality requirements, such as Quality Management Plan, Quality Control Plan (QCP), and so forth. Quality Control (QC) is the responsibility of the Contractor. The Contractor is responsible for the control of its quality to ensure delivery of quality services to the Government in accordance with (IAW) the terms and conditions and the applicable inspection clauses.

3.12.12.2 Quality Control. The Contractor shall develop, implement, and maintain an effective Quality Control System that includes a written QCP. The QCP shall implement standardized procedures/methodology for monitoring and documenting contract performance to ensure all contract/task order requirements are met. Specific performance metrics appear in paragraph TBD , Performance Requirements Summary

(PRS).

3.12.12.2.1 An optimal QCP shall identify potential problem areas and evolve over the life of the contract/task order. The Contractor’s QCP shall contain a systematic approach to monitor operations to ensure acceptable services are provided to the Government.

3.12.12.2.2 The QCP, as a minimum, shall address continuous process improvement;

procedures for scheduling, conducting, and documenting inspection; discrepancy identification and correction; corrective action procedures, to include procedures for addressing Government-discovered nonconformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent recurrence of discrepancies; procedures for trend analysis; and procedures for collecting and addressing customer feedback/complaints.

3.12.12.2.3 The Contractor, upon request, shall provide to the Government its QC documentation.

3. 12.12.2.4 The Contractor shall provide the Government with an electronic copy of its comprehensive QCP in Microsoft Word format or Portable Document Format (PDF) within 30 calendar days after award date to the Contracting Officer and Contracting Officer’s Representative (COR) for approval. After acceptance of the QCP, the Contractor shall receive the Contracting Officer’s acceptance in writing of any proposed change to its QCP.

3.12.13. Quality Assurance. The Government will evaluate the Contractor’s performance under this contract/task order IAW the Quality Assurance Surveillance Plan (QASP). This plan is a Government-only document primarily focused on what the Government must do to assure that the Contractor has performed IAW the requirements of the contract/task order. The Government has the right to conduct inspections and performance evaluation at any time. If any aspect of the performance is not in conformance with the requirements of this contract/task order, the Government has the right to issue to the Contractor a Nonconformance Report (NCR).

3.12.14. Corrective Action. At any time it is determined by the Contracting Officer that the quality control system, personnel, instructions, controls, tests, or records are not providing results that conform to contract/task order requirements, the Contractor shall take action to correct the deficiency. If an NCR is issued, the Contractor shall develop a Corrective Action Plan (CAP) that identifies the root cause, Corrective Action (CA) for the root cause, CA for the specific nonconformance, CA to the root cause to prevent recurrence, and a timeline for completion.

3.12.14.1 Nonconformance Report.

3.12.14.2 An NCR is a letter to a Contractor that identifies nonconformance of contract/task order requirement or identifies business system deficiencies and requests Contractor corrective action with the purpose to both correct the immediate nonconformance/deficiency, and to prevent recurrence. Nothing in the NCR changes any terms or conditions of the contract/task order, or waives any rights the Government has under the contract/task order or in law.

3.12.14.3 An NCR is neither a contract/task order action nor a contract/task order remedy, but it can be a precursor to one (though not required). It is also not a punitive action (though multiple uncorrected problems or ineffective corrective action could lead to contract/task order remedies). It is a tool and process used to document failure(s) to meet contract/task order requirements and to work with Contractors to resolve performance issues, with the goal to prevent the need for contractual remedy. It is also a tool to provide the Contractor an opportunity to correct or replace nonconforming work when it can be accomplished within the delivery schedule.

3.12.14.4 The three types of nonconformance, as defined in FAR 46.101, are Level 1 (Minor), Level 2 (Major), and Level 3 (Critical).

3.12.14.3 NCRs are a part of the performance records, but, at the discretion of the assessing official, may be included in the Contractor Performance Assessment Reporting System (CPARS).

3.12.15. The Contractor shall provide a CAP in response to an NCR within 10 business days of receipt or as instructed in the NCR. The CAP shall include:

3.12.15.1 Actions planned or taken to correct the specific nonconformance.

3.12.15.2 Root cause analysis of the nonconformance.

3.12.15.3 Corrective action planned or taken to eliminate the root cause(s) and prevent recurrence of the nonconformance, to include addressing people, process, and/or tools as necessary.

3.12.15.4 Determination of whether other processes/products/services/work are affected by the root cause(s), including product/service/work already delivered to the Government.

3.12.15.5 Corrective action milestones and target date(s) for implementation.

4. Customer Deliverables The following customer dependencies must be satisfied in a timely manner upon contract award or Authorization to Proceed (ATP) to ensure success and minimize risk to the effort.

Number Title Description Need Date 001 DD Form 254 Department of Defense Contract Security

Classification Specification, DD Form 254, for authorization to perform classified work on data/documents and what locations

ATP

5 Assumptions

5.1 General Assumptions

This scope of work is contingent upon the following assumptions:

The customer will provide a DD254 to authorize the Contractor to perform any work that is classified, or in a classified space, described in this SOW.

Onsite implementation services include up to one (1) engineer authorized by Forcepoint and the ACDMO and/or NCDSMO for one (1) week.

The on-site FDD system administrator training offered herein will be delivered at the time of on- site implementation services, additional travel costs for a separate training trip are not included in this level of effort.

Associated customer support personnel for System, Security, and Network engineering will be available to support integration during the travel window.

Licensing for any software components not furnished by the contractor and will be the responsibility of the customer to procure.

Implementation teams will require non-escorted badges, accounts, and hands on keyboard access.

All travel will be to Fort Gordon.

5.13 A&A Assumptions

This scope of A&A work is contingent upon the following assumptions:

A Lab-Based Security Assessment (LBSA) is not included within the scope of this effort.

The contractor will assist with developing the BoE documentation for FDD.

The coordination/communication with the Authorizing Officials (AO) for the network approvals will be the customer’s responsibility.

Onsite A&A services include up to one (1) engineer authorized by Forcepoint and the ACDMO and/or NCDSMO for one (1) week.

The customer will be responsible to obtain all necessary IA approvals prior to the implementation. This includes approval to connect to the specified networks.

To the extent that is possible, the A&A documentation will be created at the unclassified level. If the creation of classified documentation is required, the customer may need to provide access to the classified environment with appropriate computer equipment and accounts. It may be necessary to increase the LOE based on this requirement.

This SOW includes generation of a customer-supported set of SABI A&A documentation specific to the Forcepoint FDD authorized by the ACDMO and NCDSMO. It does not include site-specific RMF A&A documentation and/or address IA controls that are outside of the Forcepoint FDD.

6. Applicable Documents.

The following publications are mandatory for this contract. The Contractor shall comply with these publications and any publications changes thereafter. The Contractor shall inform the KO of any changes to a publication or documents that impact the cost of the contract. The SOW may set a higher standard of performance than an applicable Army regulation. However, if any provision in the SOW directly conflicts with or sets a standard of performance lower than required by applicable DoD, Army, and NETCOM regulation, publication, policy, or procedure, then the Contractor shall follow the applicable regulation, publication, policy, or procedure.