ATTACHMENT 1 TO RFQ SP330020Q0053 Revised PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

MAINTENANCE AND SUSTAINMENT SUPPORT SERVICES

FOR

LENEL ELECTRONIC SECURITY SYSTEM (ESS), CLOSED CIRCUIT

TELEVISION SYSTEM (CCTV), ACCESS CONTROL SYSTEM (ACS) AT

DEFENSE LOGISTICS AGENCY (DLA) DISTRIBUTION SUSQUEHANNA

SECTION 1 INTRODUCTION

A. The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency that provides worldwide logistics support for the missions of the Military Departments and the United combatant Commands. Physical security measures are necessary at all DLA Distribution sites to protect personnel, real and personal property, resources and information.

B. DLA Distribution Susquehanna has a requirement for a Contractor to provide DoD 8570 cyber support with maintenance and sustainment of the Lenel Electronic Security System (ESS) and the Closed-Circuit Television System (CCTV). Specifically, for the Lenel ESS, the Contractor shall perform support of the Lenel Access Control System (ACS), Intelligence System Controllers (ISC), Lenel OnGuard server applications, client applications, Lenel database(s) (dB) and any other software/firmware associated with Lenel. For the Intelligence System Controller (ISC) the Contractor shall perform support of the configuration processes for connection/setup on the network and provide software/firmware updates/maintenance. The Contractor shall install, configure, administer and maintain the Lenel software (both server and client software) and the associated dB(s). For the CCTV system, the Contractor shall be responsible to support the cameras, CCTV switches, Pelco Network Video Recorders (NVRs) and the CCTV Client software applications. For the cameras, the Contractor shall perform support with the configuration processes for connection/setup on the network and provide software/firmware updates/maintenance. For the NVRs, the Contractor shall support the Operating System (OS), software/firmware updates/maintenance and assist with the configuration process for connection/setup onto the assigned network. The specific items that require the Contractor’s support are identified on the Equipment and Software Inventory List (Attachment #2).

SECTION 2 GENERAL CONDITIONS AND REQUIREMENTS

A. This Section provides general information relating to the conditions of operation and requirements to provide DoD 8570 cyber support with maintenance and sustainment of the Lenel Electronic Security System (ESS) and the Closed-Circuit Television System (CCTV) at DLA Distribution Susquehanna (the specific items that require the Contractor’s support are identified on the Equipment and Software Inventory List).

B. The maintenance support shall include two types: Preventive Maintenance (PM) (scheduled) and On-Call Remedial Maintenance (RM) (unscheduled repair or similar scenario). The Maintenance Task List (Attachment #3) is provided in conjunction with the Equipment and Software Inventory List to identify each piece of equipment and software that requires maintenance support. The Equipment and Software Inventory List is subject to change by the Government when addition(s) and/or deletion(s) are required due to disposal or replacement.

C. The sustainment support includes various systems administration tasks (reference Paragraphs 7.10.A, 7.10.B, and 7.10.C), installing updates/patches for all software/firmware/OS supported by

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 1 of 22 the Contractor (reference Paragraphs 3.4.E, 3.4.F, 3.4.H, 7.6.5.A through 7.6.5.F) and the migration of the ESS applications from the current Windows 2008 Server to a new Windows 2016 Server (Paragraph 2.1.C) or newer compatible OS, Sustainment also includes the cybersecurity support detailed throughout this PWS.

D. With the ongoing effort of building consolidation and expansion, the Government reserves the right to ADD to or DELETE from the maintenance and sustainment contract anytime during the period of the contract as the need arises.

2.1 SCOPE OF WORK

A. This is a non-personal services contract to provide maintenance and sustainment support services for portions of the Lenel ESS and CCTV systems at DLA Distribution Susquehanna as identified in this PWS. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the Contractor. The Government may provide technical direction, which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the Contractor to perform the service requirements set forth in the PWS.

B. The Contractor shall furnish labor, supervision, tools, software/firmware-related materials, transportation, and management necessary to provide sustainment and maintenance support (preventive maintenance services, service calls (as needed), all repair and/or replacement of parts necessary, and other related support) to keep the identified portions of the ESS and CCTV systems covered under this PWS in good operating condition during the contract period. For the Lenel ESS, the Contractor shall be responsible for the Lenel ACS, ISC, Lenel OnGuard server applications, client applications, Lenel dBs and any other software associated with Lenel. For the ISC, the Contractor shall support the software configurations, firmware updates/maintenance and connection/setup onto the network. The Contractor shall install, configure, test, administer and maintain the Lenel software (both server and client software) and the associated dBs. For the CCTV system, the Contractor shall be responsible for the cameras, CCTV switches, Pelco NVRs and the CCTV Client software applications. For the cameras, the Contractor shall support the software configurations, firmware updates/maintenance and connection/setup onto the network. For the NVRs, the Contractor shall support the operating system, software applications, configurations, firmware updates/maintenance and connection/setup onto the network.

C. The current Lenel server is running on a Windows Server 2008 platform. The Government will decommission this server in the future and provide a new Windows Server 2016 or newer. The Contractor shall be responsible for migrating the Lenel applications, dB and other related software from the 2008 server platform to the new server. The Contractor shall be responsible for providing licenses (if applicable), installing/reinstalling software, reconfiguring and testing all Susquehanna ESS items in order to return the ESS system to a fully operational and functional state. The Contractor shall be responsible for hardening the applications in compliance with the latest STIGS and NIST Special Publication 800-82. The Contractor shall provide all documentation including the Software (firmware) Security Plan (SSP) and Program Protection Plan (PPP) required for a favorable cybersecurity assessment (Authority to Connect (ATC) or similar using the DLA Level 1 Cybersecurity Assessment (LCA) Process) for all application installs/upgrades. The Contractor shall work closely with a Government assigned Information System Security Manager (ISSM) reviewing

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 2 of 22 the SSP, PPP and other STIG/NIST requirements. This upgrade is to be considered a priority and must be accomplished within the first 3 months of contract award. Further system specifications and requirements can be found in paragraphs 3.4 and 7.6.5.

D. The Contractor shall provide all applicable support plans for the Lenel products and if available, other OEM products for the CCTV system used at Susquehanna.

E. The Government requires Lenel user training courses for new capabilities installed plus refresher and continuing education courses. The Contractor shall receive and process all training requests from the Government through Lenel within five business days of receipt. The Contractor shall work with the Contracting Officer Representative (COR) and Technical Point of Contact (TPOC) to schedule these classes at least 4 weeks in advance.

2.2 GENERAL OPERATING CONDITIONS

This Section provides general information relating to the conditions of operation and general requirements relating to the maintenance and sustainment of the ESS and CCTV systems at DLA Distribution Susquehanna.

2.2.1 PLACE OF PERFORMANCE

A. DLA Distribution Susquehanna PA (DDSP) located at New Cumberland, PA.

B. The ESS and CCTV systems are located within the DLA Distribution Susquehanna facilities at New Cumberland, PA. DLA Distribution Susquehanna currently has 20 buildings on the east side of the installation and 17 buildings on the west side. DLA Distribution Susquehanna Equipment and Software Inventory List provides the location of all items requiring support under this PWS.

C. Connectivity between buildings consists of underground communication lines/fiber.

2.2.2 PERIOD OF PERFORMANCE

The period of performance for this contract will be for a one (1) year base period with two (2) one-year option periods.

2.2.3 REGULAR WORKING HOURS

DLA Distribution Susquehanna Security Office’s regular working hours are 0600 - 1530 Eastern Standard Time (EST) Monday through Friday, maintenance and non-emergency repairs will be performed during these hours. The Contractor shall respond to emergency calls within 4 hours on contact (phone/email) from the COR/TPOC and if necessary, provide support during non-business hours for emergency repairs.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 3 of 22

2.2.4 FEDERAL HOLIDAYS

A. Federal holidays generally observed by Government personnel include:

Observed Federal Holidays New Year’s Day Martin Luther King Day Presidents Day Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

B. In the event an Executive Order issued by the President of the United States declares Agencies of the Federal Government closed for a regularly scheduled workday, the Contacting Officer (KO) or COR/TPOC will determine and advise the Contractor on whether services are required for that day.

2.3 CONTRACTOR PERSONNEL

2.3.1 PERSONNEL QUALIFICATIONS AND CERTIFICATIONS

A. Contractor personnel must be proficient in reading and capable of communicating effectively in English.

B. All work shall be performed by Contractor personnel specifically qualified and trained to work on the Lenel “On Guard” ESS system and the CCTV system.

C. Contractor personnel performing work on the Lenel “On Guard” ESS shall be certified by Lenel as a Lenel Certified Professional (LCP) or higher. The Contractor shall provide copies of certifications upon request from the COR/TPOC.

D. The Contractor shall be an authorized, licensed service representative and an “OnGuard” Value Added Reseller (VAR) in good standing with Lenel “On Guard” ESS System. The Contractor will be responsible for obtaining all necessary licenses and certifications required to perform maintenance and repair services on ESS and CCTV systems covered under this PWS, and for complying with all applicable Federal, State and local laws. The Contractor shall maintain updated copies of any applicable licenses and certifications for all employees and make them available to the Government COR/TPOC upon request.

E. All Contractor personnel requiring elevated/privileged access to any system or network components shall possess an IT-II clearance and meet DoD 8570.01-M IA Technical (IAT) II baseline certification and Computing Environment (CE) certification (reference DoD 8140.01 Cyberspace Workforce Management and/or the DoD Cyber Exchange, https://public.cyber.mil/ for additional details). The applicable CE must correlate to the OS e.g., Windows OS. In the event of turnover of personnel with the IAT II and CE certifications, the Contractor shall replace IAT II technicians with all appropriate certifications within two weeks (14 calendar days) of turnover date. The Contractor shall provide copies of both DoD 8570.01 base and CE certifications to the KO, COR, and J6 TPOC, for all IAT II personnel and receive approval prior to beginning work. The Contractor is expected to have IAT II certified personnel upon award and throughout the performance period of this contract.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 4 of 22 https://public.cyber.mil/

2.3.2 CONTRACT PROJECT MANAGER

A. The Contractor shall provide a Contract Project Manager who shall be responsible for the performance of the work. The name of the person and alternate(s) who shall act for the Contractor when the manager is absent shall be designated in writing to the KO, COR, and

TPOC.

B. The Contract Project Manager or alternate shall have full authority to act for the Contactor on all contract matters relating to the operations of this contract.

C. The Contract Project Manager or alternate shall be available Monday through Friday, excluding Federal holidays, between the hours of 0600 - 1530 to meet on the installation as required by the COR/TPOC. The Contractor shall provide telephone numbers of the Contract Project Manager and alternate(s) who shall be available by telephone during the times stated above and who shall be available within four (4) hours after normal working hours at the request of the KO or COR/TPOC as this pertains to emergency repairs.

SECTION 3 SECURITY

Work under this contract requires access to a Government ESS. All Contractor personnel must be a US Citizen; therefore, US Citizenship is a requirement. A security clearance is not required to perform work under this contract. The Contractor shall comply with all applicable DOD security regulations and procedures during the performance of this contract. The Contractor is required to have a favorably adjudicated Tier 3 (T3) Background Investigation as required IAW DoDM 5200.02, “Personnel Security Program”. The results must be received prior to commencement of work. An unfavorable adjudication of the T3 investigation will result in immediate termination of access to the workspace and equipment. The following addresses those requirements for Security.

3.1 FOREIGN NATIONAL

No foreign national will be employed on a Government contract requiring access to Government electronic security systems without the consent of the United States Government.

3.2 PERSONNEL CLEARANCE

A. The Homeland Security Presidential Directive 12 (HSPD-12) has established criteria for Contractors who require a Common Access Card (CAC) for either physical access to an Installation or access to Government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and are eligible for a public trust or sensitive position. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary access pending final adjudication of the PSI. The Contractor shall request personnel clearances in accordance with (IAW) instructions found in Technical Exhibit (TE) 1.1 Contractor Personnel Security.

B. A DLA form 1728 (Attachment #6) annotating the appropriate designation shall be submitted for each contract employee.

C. Not later than 15 calendar days prior to contract full performance start date, the Contractor shall provide the KO, COR, and TPOC access rosters of all personnel requiring access to restricted or controlled access areas. The roster shall include each employee’s full name, identification card

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 5 of 22 number (if assigned), branch or section (if applicable), and security clearance (level of clearance and last investigation date, if applicable). The Contractor shall update the roster and provide to the KO, COR, and TPOC no later than (NLT) five (5) workings days prior to the date of required access. The Contractor shall make all modifications to the rosters and provide an update to the KO, COR, and TPOC within 12 hours for employees whose employment has been terminated and for employees who no longer require access to restricted or controlled access areas.

3.3 DOD COMMON ACCESS CARD (CAC)/ACCESS IDENTIFICATION BADGE (ID BADGE)

A. Every Contractor employee shall obtain and possess a DoD Common Access Card (CAC) and/or an Access ID Badge, as required by HSPD-12 and Directed-Type Memorandums (DTM) 08-003.

Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary Information Technology (IT) access pending final adjudication of the PSI, the Contractor shall submit to the KO or COR/TPOC a request for the DoD CAC (See paragraph 3.2, Personnel Clearance).

B. The Contractor shall safeguard all CAC and/or ID Badges. Contractor personnel shall not share CAC and/or ID Badges. Each Contractor employee shall always wear the ID Card(s) conspicuously on his or her outer clothing above the waist while working on the Installation. Personnel may be challenged and removed from the work area or denied access to the host Installation if the ID Card(s) are not worn. The Contractor shall not display or use any badge as a means of personal identification outside the Installation.

C. In the event that a Contractor employee damages his or her CAC and/or ID Card, the Contractor shall report the damaged CAC and/or ID Badge within two (2) working hours after discovery of damage to the KO or COR/TPOC. The Contractor shall arrange for a replacement CAC and/or ID Card. The Contractor shall return all Government CAC and/or ID Card(s) to the Government IAW TE 1.2 Common Access Card (CAC) Procedures. Contractor personnel failing to return their Government CAC and/or ID card are subject to criminal charges under United States Code (USC) Title 18, Chapter 1, Section 499 and 701.

D. Reference TE 1.2 Common Access Card (CAC) Procedures for the Standard Operating Procedures (SOP) for Contractor CAC issuance and accountability.

3.4 INFORMATION SYSTEM SECURITY

A. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary IT access pending final adjudication, but not less than fourteen

(14) working days prior to the employee’s start date, the Contractor shall request Information Technology (IT) eligibility for an employee requiring privileged/elevated access and passwords to the Government data systems. Section 2.3.1 E states the Contractor requirements for personnel that require privileged access.

B. All Contractor personnel provided with access to Government computers and systems shall observe IT security policies and procedures as provided by the KO or COR/TPOC. The Contractor shall notify the KO or COR/TPOC within 12 hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to Government systems.

The Contractor shall observe all copyright agreements. In the interest of protecting Government systems from computer viruses, the Contractor shall not use public domain software nor shall Contractor personnel download software from public bulletin boards or Internet websites. The

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 6 of 22

Contractor shall use only Government software and approved application software in performance of the contract requirements. The Contractor shall purchase software support agreements as needed after approval from the COR/TPOC and J6 TPOC.

C. DLA typically furnishes and maintains OS level support for servers and client workstation hardware; However, the Contractor works very closely with DLA technicians sustaining and maintaining application level items. Any requirement for the Contractor to provide their own server or workstation hardware due to compatibility issues shall be brought to the COR/TPOC and J6 TPOC for approval. Contractor supplied systems must meet DoD Security Technical Implementation Guides (STIGS) requirements, with any exceptions noted.

D. The Contractor shall be responsible for all software maintenance activities, including but not limited to firmware updates, OS patching (as applicable), version upgrades required for compatibility, enhancements/configurations required by cybersecurity policy, migrations and software patches for any software applications/databases or Contractor-supported equipment associated with Susquehanna Lenel ESS and CCTV systems to keep the systems DoD compliant for the duration of the contract period. The Contractor is responsible for procuring (if applicable) and maintaining the LENEL software operating license(s). The solution must be upgradeable and remain compliant to cyber security specifications during the life of the solution.

E. The Contractor shall ensure that systems operate using a manufacturer fully supported OS, software, and firmware throughout the duration of the contract. All Contractor-supported OS, software, and firmware shall be upgraded IAW manufacturer recommendations prior to the manufacturer’s end of mainstream support for the OS, software, or firmware. All systems must remain compliant to cybersecurity specifications during the lifecycle of the solution.

F. Below is the list of DLA’s approved OS, virtual environments, and dB. The preference is for a virtualized solution. Any hardware or software required by the vendor should operate on the following system specifications:

Workstations: Windows 10 Operating System, with minimum system requirements not to exceed: processor: Intel i5 -6200u @ 2.3 GHZ, 2 Cores, Ram: 8GB, Hard Drive: 256 GB.

Servers: Windows Server 2012 R2 or Windows Server 2016, with Server 2016 being the preferred OS (or higher versions).

Redhat Linux Enterprise v7 (or higher versions) in those instances that require a LINUX OS.

For virtualized appliances or virtualized servers, the system shall be capable of running on Vmware ESXi hosts v6.5.0 or Vmware vSphere v6.5.0 virtual server environment (or higher versions).

Database shall operate using SQL Server 2016 or Oracle Database v12.2.01 (or higher versions).

G. The Contractor is responsible for hardening the portions of the ESS and CCTV systems covered under this PWS (as applicable) and keeping them in compliance with the latest STIGS and NIST Special Publication 800-82. The Contractor shall submit all modifications to the COR/TPOC and J6 TPOC for approval prior to implementing any changes.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 7 of 22

H. All control systems shall be considered low-moderate-low (Confidentiality-Integrity-Availability) unless otherwise notified in writing. The ESS and CCTV systems shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security as specified in this PWS. The vendor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a derived security requirement (mitigation to control compliance findings). Guidance on the applicability and enforcement of controls by Purdue Enterprise Reference Architecture (PERA) level can be found in the United Facilities Criteria (UFC) 4- 010-06, Cybersecurity of Facilities-Related Control Systems. The NIST SP 800-82 R2 overlay for Industrial Control Systems (ICSs) shall be used as appropriate for the system.

3.5 REMOVAL OF EMPLOYEES

DLA reserves the right to direct the removal of an employee, whose actions, while assigned to this contract, clearly conflict with the interests of the Government, regardless of prior clearance or adjudication status. DLA also reserves the right to direct the removal of an employee for misconduct, security violations or performance reasons. The reason for removal shall be fully documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor shall assign qualified personnel to perform the duties of this contract. This action does not relieve the Contractor from total performance of the contract tasks specified herein.

3.6 GOVERNMENT-ISSUED BADGES

Contractor shall return all Government issued identification and access badges to DLA Distribution Site Security Specialist upon termination of service.

3.7 ACCESS TO THE HOST INSTALLATION

Contractor personnel access to host installation will be via the Common Access Card (CAC).

3.8 PHASE-IN

A. A phase-in period shall be established to allow the Contractor sufficient time to complete all onboarding actions for personnel required to perform the requirements of the contract and ensure employees who will require access to the Installation and Government Information Technology (IT) systems obtain a Common Access Card (CAC) IAW paragraph 3.3 and 3.4 of the PWS.

B. The phase-in period shall begin upon contract award and shall not exceed one month (30 calendar days).

D. The Contractor shall ensure that all Contractor personnel are ready to begin working on the first day of the contract Period of Performance (PoP).

E. During the one-month phase-in period, Contractor personnel shall complete security and safety training on site. Training will be scheduled through the DLA Distribution site training office and will at a minimum include the following classes. Estimated in class time is 3 hours.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 8 of 22

1. Active Shooter Briefing

2. Safety Briefing

3. Shelter in Place/Evacuation Awareness Briefing

F. During the one-month phase-in period to ensure all Contractor personnel know and understand regulations and policy pertaining to physical, information, operations and personnel security, the Contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements. At a minimum, security training requirements as required by the DLA Issuances and other applicable DOD guidance will be completed annually for the following on-line training:

Estimated in class time is 8 hours.

1. Cyber Awareness Challenge

2. Antiterrorism (AT) Level 1

3. Operations Security (OPSEC)

4. Counterintelligence Awareness Training

5. Personally Identifiable Information Awareness

6. Trafficking in Persons

The security training is web-based, and access will be provided by the Government. The Contractor shall ensure Contractor personnel have taken the required security training to meet DoD guidance and that the personnel continue to maintain their certifications.

SECTION 4 DEFINITIONS AND ACRONYMS

4.1 DoD DICTIONARY

The DoD Dictionary of definitions and terms is available at:

https://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/dictionary.pdf?ver=2019-10-22-121108-363

4.2 DLA ACRONYMS

A list of DLA acronyms is available at: https://dlamil.dps.mil/Pages/AcronymListHome.aspx.

SECTION 5 GOVERNMENT SUPPORT SERVICES

5.1 GENERAL INFORMATION

A. The Government may furnish the following utility services at existing outlets for use in those facilities provided by the Government, and as may be required for the work to be performed under the contract: electricity, natural gas, fresh water, and sewage service. Information concerning the location of existing outlets may be obtained from the COR/TPOC. Utilities specified above will be furnished at no cost to the Contractor.

B. The Contractor privileged account technicians will access ESS system components via Government Furnished Equipment (GFE). All specialized software required by the Contractor must be provided to the Government by the Contractor at the time of the contract award. All Contractor provided software that will be required to be installed on GFE or vendor provided

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 9 of 22 https://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/dictionary.pdf?ver=2019-10-22-121108-363 https://dlamil.dps.mil/Pages/AcronymListHome.aspx hardware will be evaluated and will require approval prior to installation. This includes any utilities required to develop, communicate and make configuration updates to a system.

C. The Government will not be responsible for vendor-supplied equipment.

SECTION 6 CONTRACTOR FURNISHED EQUIPMENT, MATERIALS AND SERVICES

6.1 GENERAL INFORMATION

A. The Contractor shall provide services to provide the support detailed in the PWS plus supply the materials required for software/firmware upgrades, updates, patches and related support plans (if available) for items listed on the Equipment and Software Inventory List.

B. The Contractor must submit manufacturer's descriptive data and certifications for items they provide where there are questions concerning their performance and quality. This applies to all equipment and software installed by the Contractor or current existing equipment and software.

Such submittals shall be delivered to the KO/COR/TPOC within 15 calendar days of request.

Manufacturer's descriptive data and certificates shall include the name of the manufacturer, model number or other identifying information, catalog cut, version, and other identifying data and information describing the performance, capacity, rating, and application / installation instructions, which clearly illustrate that the proposed item meets all applicable standards.

SECTION 7 SPECIFIC TASKS

7.1 MANAGEMENT

The Contractor shall manage the total work effort associated with the maintenance, sustainment, and all other services required herein to assure fully adequate and timely completion of these services.

Included in this function is a full range of management duties including, but not limited to, planning, scheduling, report preparation, establishing and maintaining records, and quality control. The Contractor shall provide an adequate staff of personnel with the necessary management expertise to assure the performance of the work in accordance with sound and efficient management practices.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 10 of 22

7.2 WORK CONTROL

The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor, and equipment are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein. For the items listed on the Equipment and Software Inventory List and IAW the Maintenance Task List, the Contractor shall establish a detailed PM schedule. The detailed PM schedule shall clearly indicate by device the dates the Contractor plans to perform PM. Within 14 calendar days after the date of contract award, the Contractor shall submit the detailed PM schedule to the COR, TPOC and J6 TPOC. The COR/TPOC will accept or propose an alternate PM schedule within five (5) calendar days. The status of any item of work must be provided within four (4) hours of the inquiry during regular working hours, and within 48 hours after regular working hours.

7.3 WORK SCHEDULE

The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, customer discomfort, or other scenarios. For preventative maintenance tasks, the Contractor shall notify the COR and TPOC at least five (5) working days in advance of any work to be performed. Notification shall include the type of work to be done and the estimated completion date. The Contractor shall reschedule any work that the COR and TPOC deems necessary to avoid unacceptable disruptions in the Government's business.

7.4 WORK RECORDS/REPORTS

The Contractor shall maintain management, maintenance, repair records, prepare management, maintenance, and repair reports as set forth herein. All records and copies of reports shall be turned over to the COR and TPOC monthly. A complete work (history) file for each building security system shall be maintained by the Contractor. Files shall contain a listing of all equipment in each building and structure by nomenclature and manufacturer's model number, as well as all manufacturer's literature, brochures, and pamphlets; maintenance, operator's, and parts list manuals; warranty information; a copy of all completed Service Call Work Authorization forms, and Preventive Maintenance checklist forms; and other information pertaining to the security protection systems. All documents shall be filed within ten (10) working days of the completed transaction, with the exception of Preventive Maintenance checklist forms, which shall be filed with the COR, TPOC and a copy to the J6 TPOC within two (2) working days after the completion of each preventive maintenance inspection.

7.5 STAFFING

The Contractor shall continuously maintain an adequate staff with suitable management expertise to assure work is scheduled and completed in accordance with these specifications. The Contractor shall maintain an adequate craft work force to complete work in accordance with the time and

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 11 of 22 quality standards specified.

7.6 GENERAL REQUIREMENTS AND PROCEDURES

This Section provides general information relating to the general requirements and procedures relating to the contract services to be performed by the Contractor.

7.6.1 STANDARDS

A. All workmanship shall meet the standards specified herein and shall be accomplished in conformance with approved and accepted standards of the industry; equipment manufacturers; all applicable DoD, DLA, local, state, and federal standards; and all applicable building and safety codes.

B. When the Contractor completes work on a system or piece of equipment, that system or piece of equipment shall be free of missing components or defects, which would prevent it from functioning as originally intended and/or designed. Corrective or repair/replacement work shall be carried to completion including operational checks and cleanup of the job site. Except where otherwise noted, replacements shall match existing in dimensions, finish, color, and design.

C. During and at completion of work, debris shall not be allowed to spread unnecessarily into adjacent areas nor accumulate in the work area itself. All such debris, excess material, and parts shall be cleaned up and removed at the completion of the job and/or at the end of each day work is in progress.

D. Upon completion of all work, the Contractor shall contact the COR and TPOC to report the status of the system and document details of the service in the on-site service request log.

7.6.2 REPLACEMENT, MODERNIZATION, RENOVATION

During the term of the contract, the Government may replace, renovate, or improve systems and equipment at the Government's expense and by means not associated with this contract. All replaced, improved, updated, modernized, or renovated systems and equipment shall be maintained and/or repaired by the Contractor at no additional cost to the Government unless such changes result in an increase or decrease in contract requirements. Changes, replacements, or deletions which result in an increase or decrease in contract requirements will result in adjustments to the contract price in accordance with the "CHANGES" clause.

7.6.3 MANUFACTURER’S OR INSTALLER’S WARRANTY

Equipment, components, and parts, other than that installed under this contract, shall not be removed or replaced or deficiencies corrected while still under warranty of the manufacturer or the installer without prior approval of the COR/TPOC and J6 TPOC. All defects in material or workmanship, defective parts, or improper installation and adjustments found by the Contractor shall be reported to the COR and TPOC so that necessary action may be taken. The Contractor shall be knowledgeable of the equipment, parts, and components that are covered by warranty and the

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 12 of 22 duration of such warranties. Available warranty information will be furnished to the Contractor by the

COR/TPOC.

7.6.4 AS-BUILT DRAWINGS

A. All changes to or additions to the supported security systems, software and equipment made by the Contractor shall be recorded by the Contractor and provided to the COR, TPOC and J6 TPOC within fourteen (14) calendar days of the completed work. This data shall include, but is not limited to, dimensioned drawings, spreadsheets, and other related documents detailing the change/addition.

7.6.5 SOFTWARE UPDATES, APPLICATION UPGRADES, AND PASSWORDS

A. The Contractor shall provide all software/firmware updates when an upgrade/patch is released from the Original Equipment Manufacturer (OEM) and approved by the COR/TPOC and J6 TPOC.

B. The Contractor shall maintain an accurate software configuration and coordinate through the Lenel VAR or applicable OEM.

C. Any software updates will need to be coordinated directly with the COR/TPOC and J6 TPOC. All Contractor provided software required to be installed will be evaluated and will require approval from the J6 TPOC prior to procuring and installation. This includes any utilities required to develop, communicate, and make configuration updates to a system.

D. The Contractor shall provide all scan results, STIG, SSP, LCA checklists, system diagrams, Plan of Actions and Milestones (POA&Ms) and PPP documentation required for a favorable cybersecurity assessment (Authority to Connect (ATC) or similar) for the portions of the ESS and CCTV systems covered under this PWS including ESS and CCTV software applications, CCTV appliance related installs/upgrades and other applicable items.

E. The Contractor shall provide documentation identifying they changed all default passwords and disabled or removed all unnecessary accounts to the COR, TPOC, and J6 TPOC. The COR, and TPOC should receive a complete listing of all new passwords.

F. The Contractor shall be responsible for ensuring all software and databases associated with Lenel and all operating systems, software and databases associated with the CCTV systems are and remain in compliance with all DoD, DLA and DISA cybersecurity guidance throughout the PoP.

7.7 WORK OUTSIDE REGULAR WORKING HOURS

Except as may otherwise be specified, all work shall be performed during the Government's regular working hours. If the Contractor desires to carry on work on Saturday, Sunday, holidays, or outside regular working hours, he/she must submit application to the COR/ TPOC for approval fourteen (14) calendar days prior to work performed.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 13 of 22

7.8 REMEDIAL MAINTENANCE (SERVICE CALL WORK)

7.8.1 REQUIREMENT AND PROCEDURES

Service calls are defined as maintenance and repair work requirements which are identified by building occupants or generated by the COR/TPOC. The Contractor shall perform service call work as necessary to determine the cause of system and equipment malfunctions, eliminate the cause(s), and restore the system or equipment to compliant working condition.

7.8.2 SERVICE CALL REQUESTS

The COR/TPOC will advise the Contractor by phone or email of all service call requests received during and after regular working hours. A description of the problem or requested work, date and time received, location, classification, and other appropriate information will be placed on a Service Call Request.

7.8.3 RESPONSE TO SERVICE CALLS

The Contractor shall have adequate procedures for receiving and responding to service calls 24 hours per day, seven days a week, including weekends and holidays. The Contractor shall provide a copy of the procedures to the KO/COR/CORT/TPOC. A single local or toll-free telephone number and/or email address shall be provided by the Contractor for receipt of all service calls. All telephone calls shall be answered within 30 minutes by an individual fully familiar with the Contractor's work, control procedures, and the terms and conditions of this contract. Service calls and/or emails shall be considered received by the Contractor at the time and date the telephone call is placed, or email is sent by the COR/TPOC. In non-emergency type situations, the Contractor shall send a technician to repair the malfunctioning equipment/system/software on-site within twenty-four

(24) hours or at the beginning of the next business day. The Contractor shall respond immediately (within 30 minutes). Remotely accessing the system, if applicable, is acceptable and/or, if applicable to the situation, must be on the job site and working within four (4) hours after receipt of an emergency service call. If the Contractor is having trouble with remote access, they should call the DLA Enterprise Help Desk at 855-352-0001 to determine cause/resolution and report to the COR/TPOC. The Contractor shall work continuously without interruption and shall resolve the issue before departing the job site unless approved by the COR/TPOC.

7.8.4 COMPLETED CALLS

Within one (1) working day after completion of each service call, the Contractor shall add the following information to the work authorization form and return to the COR and TPOC:

• Description of work completed.

• Description of residual or additional follow-on work required.

• Brief description of material and parts used, including quantities.

• Date and time work began.

• Date and time work completed.

• Hours of labor (by trade) expended.

• Signature or initials of the Contractor's craftsman performing the work (or Supervisor, indicating that the work has been completed.)

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 14 of 22

7.8.5 MATERIALS AND EQUIPMENT

The Government will supply all replacement parts for the ESS ACS cameras, NVRs and CCTV switches required in the performance of RM. The Contractor shall request replacement parts for these items through the COR and TPOC.

7.9 PREVENTIVE MAINTENANCE (PM) AND TESTING

7.9.1 REQUIREMENT AND PROCEDURES

A. As previously stated, the Contractor shall support the Susquehanna Lenel ESS and CCTV systems. Contractor shall perform support of the Lenel Access Control System (ACS), Intelligence System Controllers (ISC), Lenel OnGuard server applications, client applications, Lenel database(s) (dB) and any other software/firmware associated with Lenel. For the Intelligence System Controller (ISC) the Contractor shall perform support of the configuration processes for connection/setup on the network and provide software/firmware updates/maintenance. The Contractor shall install, configure, administer and maintain the Lenel software (both server and client software) and the associated dB(s). For the CCTV system, the Contractor shall be responsible to support the cameras, CCTV switches, Pelco Network Video Recorders (NVRs) and the CCTV Client software applications. For the cameras, the Contractor shall perform support of the configuration processes for connection/setup on the network and provide software/firmware updates/maintenance. For the NVRs, the Contractor shall support the Operating System (OS), software/firmware updates/maintenance and support the configuration processes for connection/setup onto the assigned network. The Contractor shall perform preventive maintenance services as recommended in the manufacturer’s maintenance manual and the Maintenance Task List, which consists primarily of inspections, verifications, updates and other support. The Government will provide available maintenance manuals; however, if the Government does not have the maintenance manual, the Contractor shall be responsible for obtaining the manual. The Contractor shall submit a schedule with recommended intervals, required materials and equipment for all PM tasks to the COR/TPOC for approval within 14 days of contract award. Any modifications, changes, add-ons, or deletions shall be documented and provided to the COR/TPOC for approval in advance.

B. Environmental compliance and Contractor personnel transportation used for PM shall be included in the contract unit price for PM services.

7.10 SYSTEM ADMINISTRATION

A. The Contractor shall provide system administration support and business users support for the Lenel applications to include, but not limited to, installing new client software on GFE laptops, restarting services, updating software versions and assisting the business user with program disruptions as identified. The Contractor shall provide applicable DoD 8570 support to the business users configuring new/replacement ESS devices in the Lenel On-Guard system. Government roles/permissions for functions within the application are already existing in the Lenel system and do not need modifications currently. The Contractor shall also provide system administration for the database associated with Lenel, as applicable. The Contractor shall ensure that the applicable roles/permissions are assigned to the system/application users IAW the DoD 8570 (elevated/privileged access is only for personnel meeting the DoD 8570 and CE certification requirements) and DLA Access Management policies.

B. The Contractor shall provide system administration support and business user support for the CCTV system/applications to include but not limited to installing new client software on GFE laptops, ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 15 of 22 restarting services, updating software versions and assisting the business user with program disruptions as identified. The Contractor will provide applicable DoD 8570 support to the business users configuring new/replacement devices on the CCTV system. Government personnel utilizing existing role structure within the CCTV application/system, managing storage and other related work as applicable. The Contractor shall ensure that the applicable roles/permissions are assigned to the system/application users IAW the DoD 8570 (elevated/privileged access is only for personnel meeting the DoD 8570 and CE certification requirements) and DLA Access Management policies.

C. Upon COR, TPOC or J6 TPOC request, the Contractor shall provide various information for the items listed on the Equipment and Software Inventory List and take any required follow-up action to support to Government data calls, taskers and other scenarios.

7.11 QUALITY CONTROL PLAN

A. The Contractor shall establish and maintain a complete Commercial Quality Control Plan to ensure the requirements of the contract are provided as specified.

B. The plan shall include an inspection system covering both preventive and remedial maintenance repairs required by this contract. The plan must ensure that quality service levels are maintained throughout contract performance.

C. The Contractor shall maintain records of all inspections conducted by the Contractor and any necessary corrective actions taken. This documentation and all records and schedules, as described in the PWS, that are the responsibility of the Contractor, are the property of the Government and shall be made available to the Government as indicated in 7.12 and upon request, during the term of the contract.

7.12 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

A. The QASP (Attachment #7) is a Government developed document used to evaluate Contractor actions while implementing the PWS. The QASP is designed to provide an effective surveillance method for monitoring and evaluating the Contractor’s performance for each of the performance objectives, to ensure that the Contractor performs in accordance with the performance metrics set forth herein, and to ensure that the Government receives the acceptable performance levels of service.

B. The COR and TPOC performs surveillance activities under direction of the Contracting Officer (KO). The QASP will also afford the KO and the COR and TPOC a productive mechanism to preclude major deficiencies in Contractor performance, provide input for the annual Contractor performance evaluations, make the determination of exercising contract options, and ensure the Government only pays for acceptable level of services received. The Contractor and not the Government is responsible for management and quality control actions to meet the terms of the contract. The role of the Government is to carry out quality assurance surveillance actions to ensure contract standards are achieved. This QASP may be revised periodically as determined by the COR, TPOC and KO. The Contractor shall be provided a 30-day notice of revision. When the Contractor performance fails to achieve the acceptable performance level and is clearly the fault of the Contractor, the COR/TPOC will prepare a Contract Deficiency Report (CDR) and forward it to the KO to issue to the Contractor. In response to the CDR, the Contractor shall explain within seven business days, in writing, why performance was unacceptable, how performance will be returned to acceptable levels and how recurrence of the problem will be prevented in the future. The KO will evaluate the Contractor’s explanation and determine the appropriate actions.

ATTACHMENT 1 REVISED TO RFQ SP330020Q0053 Page 16 of 22

(1) QASP Checklist

Date of Inspection:

Performance Objective

Contractor accomplished performance objective satisfactorily

Contractor did not accomplish performance objective satisfactorily (Provide a brief description)

Perform preventive maintenance services per established schedule for all equipment identified in this Contract, IAW PWS Paragraph 7.9.1.

Service call response in accordance with PWS paragraph 7.8.3

C. Performance objectives for the Contractor:

(1) The Contractor shall perform maintenance support with oversight and approval of the COR/TPOC.