Attachment 1 - Basic IDIQ PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Logistics Modernization Integration Support (LMIS) Program for the Defense Logistics Agency (DLA)

SECTION C-1: INTRODUCTION

1.0 Background

The Defense Logistics Agency (DLA) is the largest logistics support agency in the United States (U.S.) Department of Defense (DOD). The DLA Director reports to the Under Secretary of Defense for Acquisition, Technology and Logistics (USD AT&L) through the Assistant Secretary of Defense for Logistics and Materiel Readiness (ASD L&MR). DLA provides worldwide logistics support, acquisition, and technical services to the military services, other federal and civilian agencies, and partner nations in peacetime and wartime.

The primary mission of DLA is to provide supplies and services to United States Military forces worldwide. Within the general scope of DLA’s mission involves managing and supporting DOD warehouse operations via a worldwide enterprise consisting of over 34 distribution centers and facilities. The scope of operations involves over 10,000 personnel who manage a $105 billion inventory of over 2.4 million items and process approximately 15 million transactions annually for over 243,000 customers.

Industry leading commercial distribution organizations are spearheading cutting-edge technology advancements in material handling equipment (MHE), systems, and worker enhancement tools in order to achieve and maintain competitive efficiencies in the global marketplace. Advancements in emerging goods-to-person technologies such as robotics and worker enhancement tools (voice / augmented reality, Real Time Locating Services (RTLS), etc.) provide DLA an opportunity to better support the 21st Century Warfighter.

To achieve operational efficiencies, DLA is planning the implementation of both proven and cutting-edge technologies and automation in Distribution Operations to enhance logistics support capabilities and produce more reliable, cost-effective solutions. Furthermore, the Agency’s Distribution function must embrace emergent process design and the enabling automation technology.

The Government has determined that a multiple award Indefinite Delivery/Indefinite Quantity (IDIQ) contract is the best type of contract vehicle to accomplish the high volume and variety of distribution modernization projects anticipated by DLA. An IDIQ contract of this nature can act as the primary support vehicle for DLA’s LMIS Program requirements with the resultant contracts allowing for centralized ordering. As such, the IDIQ is anticipated to be well suited to accommodate acquiring solutions comprised of the innovative, cutting-edge MHE, systems and mechanization; individual, wearable, and autonomous technologies; facilities development related to installation of equipment, operational, technical, sustainment, and maintenance support and activities required by DLA.

The multiple award IDIQ contract approach will enable DLA to complete the Requirements Analysis and Design Specification phases of each project in a more cost-effective, efficient manner. It will also provide a competitive pool of Contractors who are, or will become familiar with, procedures and regulations governing work performed for DLA.

DLA intends to use a multiple award IDIQ contract to support the modernization, integration, and sustainment of state of the art/best of breed solutions comprised of MHE, systems and mechanization; individual, wearable, and autonomous technologies; and Warehouse Execution Systems (WES) and/or Warehouse Control System (WCS) required by the DLA Modernization Program. Individual Delivery Orders (DOs) will be competed among all successful Offerors and subsequent contracts are anticipated to support DLA requirements originating within the Contiguous United Stated (CONUS) and Outside the Contiguous United States (OCONUS).

1.1 Objective/Purpose

The DLA LMIS Program will provide a singular, consolidated acquisition mechanism through which the DLA Distribution Modernization Program can maximize its opportunities to achieve the following Program Objectives:

Increased production efficiency through technology, equipment, hardware, and software solutions Reduced operating costs and improved realization of Return on Investments (ROI) Enhanced audit readiness and accountability of operations Strengthened Cybersecurity and Information Assurance (IA) for deployed MHE Process improvement and simplification Streamlined warehouse control, management, and operations

1.2 Requirement

DLA Distribution has a requirement to upgrade its Distribution Centers, warehouses, logistics, and operations with cyber secure, state of the art/best of breed solutions comprised of MHE, systems and mechanization; individual, wearable, and autonomous technologies.

The intent is to leverage commercial off the shelf (COTS) and emerging technologies to improve its capabilities to support the Warfighter to the utmost extent practicable. This includes implementation as well as sustainment of proven and cutting edge MHE, hardware, software and systems.

SECTION C-2: GENERAL CONDITIONS AND

REQUIREMENTS

2.0 Scope

DLA intends to leverage the capabilities and activities provided via the LMIS Program to deliver solutions that meet the requirements of the DLA Distribution Modernization Program to the utmost extent practicable. As such, the scope of the LMIS Program and this IDIQ will require awardees of individual DOs to render a wide variety of supplies and services necessary for the innovative, cutting-edge MHE, systems and mechanization; individual, wearable, and autonomous technologies; operational, technical, sustainment, and maintenance support and activities; and lifecycle management required by the DLA Distribution Modernization Program. Places of performance for the services and supplies rendered by awardees of individual DOs are expected to be at DOD Installations located within CONUS and OCONUS. Each DO awarded under the LMIS Program will describe the types of supplies and services to be rendered. All DOs issued under the IDIQ will be performance based acquisitions using a Performance Work Statement (PWS), but may include detailed additional technical information / requirements as identified in this PWS.

At a high level the tasks required to provide supplies and services in support of the LMIS Program are based upon the following five (5) DLA Distribution Modernization Strategic Areas of Emphasis:

1) Major Industrial Automation

2) Material Handling Equipment

3) Workforce Mobility

4) Application, Data and Analytics

5) Warehouse IT Infrastructure

Utilizing the aforementioned DLA Distribution Modernization Strategic Areas of Emphasis, the supplies and services expected to be rendered by individual DO awardees may include (but not be limited to) the following:

MHE Hardware and Software Automated Storage and Retrieval

Systems (AS/RS) Vertical material lifts and Vertical

Lift Modules (VLM) In-line strapping machines In-line stretch wrap machines Man aboard wire guided or rail guided MHE systems Mono-rail MHE systems Automated transporter docks

(requires an associated transporter truck)

Control systems Programmable Logic Controllers

(PLC)

Distributed Control Systems (DCS) Supervisory Control and Data

Acquisition (SCADA) systems

Warehouse Execution Systems

(WES)

Warehouse Control Systems (WCS) Industrial Control System (ICS)

Software Power conveyors Ergonomically designed personnel systems Pick to belt systems Sortation equipment Dimension and/or weight systems Product or process identification systems Preservation, Packaging, Packing and Marking (PPP&M) lines Receiving lines Inspection lines Shipping lines Box and Machine Shop Automation

Equipment

Mobile material handling lifts or

MHE

Multi-shuttle systems Robotic part pickers and other MHE robotic systems Autonomous MHE’s – forklifts, tuggers, pallet jacks Bar code scan tunnels Dynamic Weighing and Offering

System (AWOS) with automated print and apply label capability

Pallet mole (or equivalent) systems Automated truck unloading systems Photo verification systems for parts/shipments Other miscellaneous MHE as required Fire Protection Building Modification Electrical Systems

NOTE: The preceding list represents a compilation of the potential types of equipment, automation and facilities development related to equipment installation requirements identified by the DLA Modernization Program. The equipment and technologies represented may be leveraged in support of one or more LMIS projects via awarded DOs. Additionally, the Government expects integration (including but not limited to software modification / configuration to ensure equipment and technologies operate successfully with DLA’s Warehouse Management System (WMS)) and sustainment efforts will be necessary. These efforts may need to occur to complete many of the requirements listed below. The representative list does not capture all requirements and therefore cannot be considered as all-inclusive nor exhaustive.

Following the award of the IDIQ, the specific scope of each effort will be based upon the unique requirements to be set forth and described within individual DOs, but will align into one of the following two (2) Delivery/Task Pools described within Section C-6 of this PWS:

“Enterprise Facility Modernization” and “Material Handling Capability”.

2.1 Description of Supplies and Services

The Contractor must provide all supervision/management, personnel, materials, supplies, software, equipment, tools and transportation (except for those items specified as Government property incidental to the place of performance) necessary to perform the DLA LMIS Program tasks defined in this PWS. This work may include (but is not limited to) the following:

Program Integration and

Management Project Management Concept Development Requirements Analysis Design Development

Integration and Testing Installation and Implementation Change Management and Training Operational, Sustainment, Maintenance, and Lifecycle Support Disposition

DOs placed against the base IDIQ Contract will define the requirements for each individual

LMIS project. The Contractor must complete each project within timeframes negotiated between the Government and Contractor for each DO.

Supplies provided under the auspices of this IDIQ will be described by the Government within each DO to the highest component level and maximum extent practicable for supporting the DLA LMIS Program; however, the Contractor will have the ultimate responsibility for providing acceptable supplies to meet the requirements described therein.

Unless otherwise specifically stated, all supplies provided by the Contractor must be in new condition and of the most suitable grade for the intended purposes. The Government reserves the right to perform any necessary inspections to ensure conformance of supplies rendered by the Contractor to stated requirements.

All services performed under the auspices of this IDIQ must be non-personal in nature and will provide support to the DLA LMIS Program. The Government will not exercise any supervision or control over the contract staff performing the services described herein. Such contract service providers will be accountable solely to the Contractor who, in turn, is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the Contractor.

The Government may provide technical direction to assist the Contractor in accomplishing the work detailed in the PWS; however, the Government will not control the methods used and work performed by the Contractor to meet the requirements set forth within it. The Contractor must submit to the Contracting Officer (KO) or the Contracting Officer's Representative (COR) (if assigned) all documentation generated as a result of the work performed.

2.2 Operating Conditions

2.2.1 Place of Performance

The basic IDIQ contract will be issued through DLA Distribution in New Cumberland, PA.

However, the primary place of performance for work performed under this contract will be at various DLA Distribution Centers throughout DOD Installations and the DLA Distribution Enterprise, both within CONUS and OCONUS. Each individual DO placed under this contract will identify the location of work for that specific DO.

2.2.2 Period of Performance

The Period of Performance for the basic IDIQ is not to exceed five (5) years from the date of contract award. Additionally, each individual DO will include a Period of Performance (PoP) specific to that project.

2.2.3 Federal Holidays

A. Federal holidays generally observed by Government personnel include the following:

Observed Federal Holidays

New Year’s Day Labor Day Martin Luther King Day Columbus Day Presidents’ Day Veterans Day Memorial Day Thanksgiving Day Independence Day Christmas Day

B. If the holiday falls on a Saturday, it will be observed on the preceding Friday. If the holiday falls on a Sunday, it will be observed on the following Monday. The Contractor will not be required to perform services on these days.

C. The Contractor is not expected to work on Government observed Federal holidays. In the event an Executive Order issued by the President of the United States declares Agencies of the Federal Government closed for a regularly scheduled workday, the Contracting Officer or COR (if assigned) will determine and advise the Contractor on whether or not work can be performed on that day.

2.2.4 Hours of Operation and Access to the DOD Installations

A. Duty hours and access to Government locations will be specified in individual DOs. The normal hours of operation for most DLA Distribution Centers is Monday through Friday, 07:00-15:30 local time, excluding Federal Holidays. Contractor personnel must be on site during the normal hours of operation unless otherwise specified within the awarded DO. However, some Distribution Centers are 24-hour operations. Consequently, some work must be performed outside of the normal hours of operation. Such work must be coordinated with the Contracting Officer or COR (if assigned) for the individual DO.

B. The Contractor may be allowed (as required to minimize interruption of production operations) to perform work outside of regular hours. Where work is desired to be performed other than during regular hours, the Contractor must request permission from the Contracting Officer or COR (if assigned) at least two (2) working days in advance in order for the necessary arrangements to be made.

C. The Contractor must ensure that all personnel (Staff, Subcontractor, delivery, installation, maintenance, etc.) are cleared for Installation access in accordance with (IAW) each DOD Installation’s security protocols. This must be accomplished prior to the coordination of any delivery or installation of equipment, materials, and supplies.

D. Due to changing traffic requirements brought on by construction, changing missions, and security concerns within DOD Installations, access is subject to change sometimes with little or no warning. Inbound and outbound traffic restrictions may be employed or exist.

In the event of sudden access changes to the DOD Installation, the Contractor must immediately notify the Contracting Officer or COR (if assigned) upon discovery so the Government can appropriately mitigate impact on Contractor performance.

E. Force Protection Conditions (FPCONs) may affect access to the DOD Installations. The DOD Installation or higher National Command Authorities establish the FPCON and the Installation Commander is responsible for implementing the proper response to progressive levels of terrorist threats. FPCONs are normally displayed at most entrance gates, building entrances and office entrances. The Contractor must adhere to and operate IAW any restrictions imposed as a result of a FPCON. Measures implemented under the various levels of terrorist threat may affect the Contractor’s normal operations.

Contractors must ensure that execution of their operations are coordinated with the Contracting Officer or COR (if assigned) during heightened security measures (including (but not limited) to identification of any anticipated delay(s) in contractual performance).

2.2.5 Vehicle Registration

A. The Contractor will be required to register Contractor vehicles used in performance of the contract requirements and ensure that Contractor employee vehicles driven on the DOD Installation (to include motorcycles) are registered with the DOD Installation security office and are in conformance with State and local laws / regulations in effect at the time of registration so long as they are employed by the Contractor. Evidence of a valid driver’s license, vehicle registration card, and insurance are required for registration.

Contractor employees must maintain current registration and proof of insurance on all Privately-Owned Vehicles (POV) brought on DOD Installations. The Contractor must maintain current registration and proof of insurance on all Contractor-owned vehicles brought on the DOD Installations.

B. The Contractor and its employees must abide by DOD Installation parking regulations.

All vehicles must be parked in designated parking areas only. The Contractor and its employees must conform to Federal, State and DOD Installation driving regulations.

2.2.6 Travel

Travel may be required in support of the individual DOs. Requests for travel must submitted to the Contracting Officer or COR (if assigned) for the individual DO in writing and contain the dates, locations, and estimated travel costs. All travel (except local based upon the place of performance for each DO) must be approved in advance by the Contracting Officer or COR (if assigned). Local travel (based upon the place of performance for each DO) will be accomplished at no additional cost to the Government and is not directly reimbursable. Any travel not pre-approved by the Contracting Officer or COR (if assigned) is solely at the risk of the contractor. The Contractor must ensure that all travel is consistent with the Joint Travel Regulations (JTR). Reimbursements for transportation costs will be limited to allowable expenses for Government directed travel. The Contractor will be responsible for any costs incurred as a result of authorized travel which were in excess of that allowed under Federal Acquisition Regulation (FAR) Part 31.205-46, Travel Costs and the appropriate regulations therein. The Contractor is expected to provide the necessary administrative services to assist with Contractor travel (when required) at no additional cost to the Government.

2.3 Government Interaction

A. The Contractor’s primary interaction with the Government will be through the Contracting Officer, COR (if assigned), and/or the Government Program/Project Manager. In all cases the Government will perform the following functions:

Contracting Officer’s Representative (COR) duties and responsibilities Quality assurance evaluations of the Contractor’s performance Provide the primary interface between the Contractor and the DOD Installation, local customers, and DLA Distribution Perform other inherently Governmental functions or other functions not part of this contract as prescribed in FAR subpart 7.5

B. The COR (if assigned) will be identified by separate letter for each individual DO. The COR will monitor all technical aspects of the contract and assist in contract administration. The COR is authorized to perform the following functions:

Assure that the Contractor performs the technical requirements of the contract Perform inspections necessary in connection with contract performance Maintain written and oral communications with the Contractor concerning technical aspects of the contract Issue written interpretations of technical requirements, including Government drawings, designs, and specifications Monitor the Contractor's performance, conduct quality assurance evaluations, and notify the Contracting Officer and Contractor of any efficiencies and deficiencies Assist in identifying and incorporating process improvements Coordinate availability of Government Property (GP) Provide access and site entry of Contractor personnel Perform other inherently Governmental functions, or other functions, not part of these support services

A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price and estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the contract.

C. The Government and the Contractor will have personnel working in the same area. The Government will provide general instructions on limitations and deadlines. Contractor personnel will independently carry out the tasks identified in this PWS. Completed work will be spot-checked by the Government for adherence to procedures, accuracy, and completeness.

D. All Contractor personnel must comply with the requirements described within 1.5.C.

2.4 Personnel

A. The Contractor must provide the names and telephone numbers (to include mobile telephone and pager, as applicable) for all Key Personnel in writing at the start performance and/or the transition period. Upon notification all Key Personnel must be on-site to meet with Government personnel within one (1) hour during normal duty hours and within a mutually agreed upon time period between the Contractor and Government for each DO outside of normal duty hours, when not in an excused absence status. In the event of the replacement of any Key Personnel, the Contractor must submit proposed substitution(s) to the Contracting Officer or COR (if assigned), in writing for approval.

Substitutions of Key Personnel are not authorized until approved by the Government.

B. The Contractor must report all contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract to the Government via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data must be reported no later than October 31 of each calendar year. Contractors may direct questions to Contracting Officer or COR (if assigned) and/or to the help desk at http://www.ecmra.mil.

C. All Contractor personnel attending meetings, answering Government telephones, corresponding by e-mail, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating the mistaken impression in the minds of members of the public, as well as Federal employees, that they are Government officials. The Contractor must also ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel may be required to obtain a Common Access Card (CAC) IAW paragraph 2.5.1 Personnel Clearance of this PWS. All Contractor employees must wear ID badges conspicuously on his or her outer clothing above the waist at all times and must identify themselves as Contractors while in the work place and at meetings.

2.4.1 Key Personnel

A. The Contractor must employ the experienced personnel necessary to perform all work required under this contract and its subsequent DOs. The Contractor, or Contractor and Subcontractor Team, must have the necessary qualifications to provide these services.

The Contractor must identify all key personnel by name, position, and firm ((if other than prime contractor, show the address (city/state) where the firm is located)). Exclusive of the Program Management, Contract Management, and Financial Management functions, the Contractor may utilize Subcontractors or Consultants identified in the accepted proposal, or who are subsequently approved by the Contracting Officer, to perform any of the functions required by the tasks detailed in this PWS and its subsequent DOs.

Project Managers can be either Contractor Employees or personnel from the Subcontractor Team.

B. Resumes for Key Personnel must be presented to the Government with the appropriate dates and responses to required qualifications as noted in the corresponding position description. The resumes will be evaluated to ensure that the individuals meet the desired qualifications and experience necessary to perform the roles and responsibilities required of the tasks detailed in this PWS. Any substitution of personnel following contract award must also meet the qualification requirements of the PWS. Any permanent substitution of Contractor personnel at time of award or any time thereafter must be approved in writing by the Contracting Officer and requires the submission of resumes and letters of intent for this purpose.

1. Program Manager (PgM).

The Contractor will designate one (1) individual as the Program Manager (PgM) to serve as the single point of contact (POC) for coordination of program issues with the Contracting Officer. The PgM will be responsible for the overall management of the base IDIQ contract and all subsequent DOs including cost, schedule, and technical quality. The PgM must be competent, experienced, and knowledgeable in the full range of automated and non-automated MHE, systems and mechanization; individual, wearable, and autonomous technologies; and warehouse control, execution, management systems, racking and storage project activities identified in this document. The PgM will take immediate corrective action when performance is not acceptable to the Contracting Officer. The PgM will oversee the development and implementation of record keeping, administrative, safety and quality control programs.

2. Quality Assurance/Quality Control (QA/QC) Manager.

The Contractor will designate one (1) individual trained within its organization to be responsible for overall management of Quality Assurance and Quality Control (QA/QC) and have the authority to act in all QA/QC matters. The QA/QC Manager should have appropriate education and experience in MHE, systems and mechanization; individual, wearable, and autonomous technologies; and warehouse control, execution and management systems racking and storage project activities.

The QA/QC Manager is responsible to ensure compliance with the requirements identified in this PWS and all subsequent DOs.

3. Project Manager(s) (PM).

The Contractor will designate an individual as the Project Manager (PM) for each individual DO. The specific education, experience, and qualification requirements for the PM will be identified in each DO. The Contractor will designate an alternate individual to act in absence of the PM. The PM will be the single POC for the performance of all Project level Tasks, and will be responsible to the PgM for the management and execution of the Tasks IAW the approved DO and all Federal, State, and local laws and regulations.

The PM may act as the PgM, with the approval of the Contracting Officer or COR (if assigned), provided the nature, complexity, and level of effort (LOE) of the Project level Tasks will not interfere with or diminish performance of the Program level Tasks. The PM must also maintain close communications and coordination with the Contracting Officer or COR (if assigned) for the duration of each DO, including weekly and/or monthly progress and detailed cost reporting through the PgM. The Contractor may designate additional PMs for individual DOs if the nature, complexity, and LOE of the DOs warrants a dedicated PM.

2.4.2 Personnel Recruitment and Qualifications

A. The Contractor must implement a continuing recruiting program such that the Contractor can respond to urgent and phased surge and mobilization requirements. Personnel assigned to or utilized by the Contractor in the performance of this contract will (at a minimum) meet the experience, educational, or other background requirements set forth below and must be fully capable of performing in an efficient, reliable, and professional manner. If the Contracting Officer questions the qualifications or competence of any person performing under the contract, the burden of proof that the person is qualified as prescribed herein will be upon the Contractor. The Contracting Officer will be the final authority in deciding whether any particular Contractor employee possess the skills needed to accomplish work in an efficient, reliable, and professional manner.

B. The Contractor will not employ any person who is not a citizen or legal resident alien of the United States and who does not have the requisite security check as set forth in paragraph 2.5.1 Personnel Clearance of this PWS.

C. The Contractor must ensure that all Employees (Prime and Sub-Contract Labor) submit to and pass a controlled substance screening test prior to performing work on this Contract.

D. All Contractor personnel will demonstrate the following knowledge and skills prior to performing work on this contract:

1. The ability to read, write, speak, and proficiently communicate using the English language in oral and written communications.

2. The ability to work independently and well with others in a team environment.

3. Possess the experience and proficiency necessary to work with the latest version of MS Office Suite necessary to perform the requirements set forth in this PWS and subsequent DOs.

2.4.3 Removal of Contractor Personnel

The Contracting Officer retains the right to order the removal of Contractor personnel whose performance and/or actions, while assigned to this contract, negatively impact the mission and DLA operations. Upon notification by the Government of a request to remove Contractor personnel, the Contractor will coordinate to remove the individual(s) immediately from the work environment, pending a final decision. The Contracting Officer will clearly document the reason for Contractor personnel removal. When and if such removal occurs, within three (3) working days the Contractor must assign qualified personnel to fill any vacancy(ies) created at no increased cost to the Contract.

2.5 Security

A. The Contractor must implement and adhere to the DOD Installation and/or DLA Site mandated Physical Security Program and Standard Operating Procedures (SOP). The Contractor must ensure the physical security of all Government property, accountable stock, and that any information provided under this contract is secured and protected against theft, sabotage, or other acts constituting illegal destruction. In addition, the Contractor and its personnel will become familiar with, and comply with, all DOD, DLA, and National Institute of Standards and Technology (NIST) regulatory guidance including (but not limited to) the following:

Publication Title

OASD (HD&GS) DOD Antiterrorism (AT) Officer Guide DODI 2000.12 DOD Antiterrorism (AT) Program DODI O-2000.16 DOD Antiterrorism (AT) Program Implementation, Volumes 1-2 DODM 5200.01 DOD Information Security Program, Volumes 1-4 DODM 5200.02 DOD Procedures for the DOD Personnel Security Program DOD 5200.2-R DOD Personnel Security Program DOD 5200.8-R DOD Physical Security Program DOD 5205.02-M DOD Operational Security (OPSEC) Program Manual DOD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) DOD 5220.22-R Industrial Security Regulation DOD 5220.22-S COMSEC Supplemental to Industrial Security Manual for

Safeguarding Classified Information DODI 8500.01 Cybersecurity DODI 8510.01 Risk Management Framework (RMF) for DOD Information

Technology (IT) DOD 8570.01-M Information Assurance Workforce Improvement Program NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and

Organizations NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security NIST SP 800-160 Systems Security Engineering (SSE) DLAM 5200.08 Physical Security Manual, Volumes 1-2 DLAI 1010.01 Drug Free Workplace DLAI 4306 Physical Security Program DLAI 5105 Reporting of Criminal Incidents DLAI 5200.01 Information Security (INFOSEC) Program

Publication Title DLAI 5205.02 Operations Security (OPSEC) Program DLAI 6401 Information Assurance (IA) Management Controls DLAR 4145.11 Safeguarding of DLA Sensitive Inventory Items, Controlled

Substances, and Pilferable Items of Supply

B. The Contractor or any representative of the Contractor entering DOD locations to perform contract requirements will abide by all security regulations and may be subject to security checks. Contractor personnel and property will be subject to search and seizure upon entering, while on, and upon leaving the DOD locations pursuant to installation regulations.

C. Contractor personnel will conduct and present themselves IAW acceptable professional business etiquette and workplace decorum at all times. The Contractor will remove any individual from the site whose continued presence or employment on this contract is deemed by the Contracting Officer or COR (if assigned) to be contrary to the public interest, deemed to adversely affect health, morale, welfare, or good order and discipline on the installation, or inconsistent with the best interests of national security. IAW USC Title 18, Crimes and Criminal Procedure, Part I, Crimes, Chapter 67, Military and Navy, Section 1382, the Installation Commander has the authority to bar individuals from the DOD Installation.

D. In the event of a strike by Contractor personnel, the Contractor will be responsible for the cost of any increased security as determined necessary by the DOD Installation or DLA Site Commander/Director. Additionally, the Contractor will be responsible to continue performance of the contract requirements at no additional cost to the Government.

E. The Contractor will report any security violations to the Contracting Officer or COR (if assigned) within one (1) hour of discovery. A security violation includes (but is not limited to) any knowing, willful, or negligent action that could reasonably be expected to result in an unauthorized disclosure of classified information (to include a loss or gain of classified material).

F. The Contractor will report immediately to the Contracting Officer or COR (if assigned) any suspected, alleged, or actual criminal incidents IAW DLAI 5105 Reporting of Criminal Incidents.

2.5.1 Personnel Clearance

A. The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 August 2004 has established criteria for Contractors who require a Common Access Card (CAC) for either physical access to an installation or access to Government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and are eligible for a public trust or sensitive position. The Contractor must request personnel clearances IAW instructions found in Technical Exhibit (TE) 1.1, Contractor Personnel Security. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary access pending final adjudication of the PSI (see Contractor Investigative Requirements in the Technical Library). The required investigation for contractors in a position of trust requiring IT III access is a T1 or equivalent. A T1 is the investigation completed on an individual when the person begins employment under a federal contract. It is not a security clearance. The T1 for the IT III access addresses the past five years of an employee’s life. If the employee is placed in a position with a higher level of trust, a different level of investigation will apply. The Contractor will follow the following procedures for obtaining a T1.

1. Each Contractor employee must complete a SF 85, Questionnaire for Non-

Sensitive Positions, using the Electronic Questionnaire for National Security Positions (e-QIP) located on the Office of Personnel Management (OPM) website, http://www.opm.gov/e-qip/.

2. The Contractor must require assigned personnel to this contract to provide electronic fingerprinting (if available) or two fingerprint cards (FBI Form FD

258) to the Contracting Officer or COR (if assigned) who will forward them to the DLA Intelligence for processing.

3. The SF 85 and fingerprint cards are submitted with the Contractor Investigative

Request (CIR) annotating the appropriate designation and a DD Form 2875 (see paragraph 2.5.3, Information System Security).

NOTE: A CIR form annotating the appropriate designation will be submitted for each contract employee.

B. The Contractor must provide to the KO or designee not later than (NLT) fifteen (15) calendar days prior to contract full performance start date, access rosters of all appropriately cleared personnel who require access to restricted or controlled access areas. The roster will include each employee’s full name, identification card number (if assigned), branch or section (if applicable), DOD Installation / DLA Facility information, and security clearance (level of clearance and last investigation date, if applicable). The Contractor will update the roster and provide to the Contracting Officer or COR (if assigned) NLT five (5) workings days prior to the date of required access. The Contractor will make all modifications to the rosters and provide an update to the Contracting Officer or COR (if applicable) within twelve (12) hours for employees whose employment has been terminated and for employees who no longer require access to restricted or controlled access areas.

C. The Contractor will be required to comply with all DOD Installation entrance and security requirements. The DOD Installation will vet all contractors, including Subcontractor, for criminal warrants before a contractor will be allowed to enter the installation or garrison.

D. Badges will be issued for the contract performance period not to exceed 179 day increments. A check will be made periodically by Government security personnel on the status of these badges. Normally, on projects longer than 180 days, the COR will submit a request for new badges to ensure contract personnel are vetted semi-annually.

E. The Prime Contractor will be required to escort suppliers, vendors, or other one-time or occasional visitors to the project site. Notification will be given a minimum of three (3) working days prior to arrival and include the name of the company, the Prime Contractor Company name responsible for the vendor, and the vendor representative if available.

Security may refuse entry without this notification.

F. The Prime Contractor will ensure that all access control requirements are followed IAW the DOD Installation/DLA Site mandated Physical Security Program and SOP. Any questions or concerns will be routed to the Contracting Officer or COR (if assigned) for clarification.

G. Awardees in both pools will have to hold or be able to obtain a DSS Facility Clearance for specific funded delivery orders to process its employees for Personnel Security Clearances. Further information for obtaining a Facility Clearance is available at the Defense Security Service website http://www.dss.mil/isp/fac_clear/fac_clear_check.html.

2.5.2 DOD Common Access Card (CAC) / Access to Identification Badge

A. Every Contractor employee physically performing work at the place of performance or requiring access to the DOD network(s) for each DO will obtain and possess a DOD Common Access Card (CAC) and/or an Access ID Badge, as required by HSPD-12 and Directed-Type Memorandums (DTM) 08-003. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary Information Technology (IT) access pending final adjudication of the PSI, the Contractor must submit to the Contracting Officer or COR (if applicable) a request for the DOD CAC, IAW TE 1.2, CAC Procedures. Within thirty (30) calendar days after the start date of full contract performance and re-occurring monthly thereafter throughout the duration of the contract, the Contractor will complete the CAC reporting IAW CDRL A001, Monthly Contractor Employee CAC Report.

B. The Contractor must safeguard all CAC and/or ID Badges. Contractor employees will not share CAC and/or ID Badges. Each Contractor employee must wear the ID Card(s) conspicuously on his or her outer clothing above the waist at all times while working on the installation. Personnel may be challenged and removed from the work area or denied access to the Host Installation if the CAC and/or ID Card(s) are not worn. The Contractor will not display or use any badge as a means of personal identification outside the installation.

C. In the event that a Contractor employee damages or loses his or her CAC and/or ID Card, the Contractor must report the damaged CAC and/or ID Badge within two (2) working hours after discovery to the Contracting Officer or COR (if assigned). The Contractor must arrange for a replacement CAC and/or ID Card. The Contractor will return all Government provided CAC and/or ID Card(s) to the Government IAW TE 1.2 CAC Procedures. Contractor personnel failing to return their Government CAC and/or ID Card are subject to criminal charges under United States Code (USC) Title 18, Chapter 1, Section 499 and 701.

D. The Contractor must return all Government-furnished CAC and ID Badges to the Contracting Officer or COR (if assigned) within twelve (12) hours of the completion of the contract or upon termination of an individual’s employment, whichever comes first.

Contractor personnel failing to return their Government CAC or ID Badge are subject to criminal charges under United States Code (USC) Title 18, Chapter 1, Section 499 and 701.

2.5.3 Cybersecurity and Information Systems Security (INFOSEC)

A. The contractor must coordinate with Government resources and participate / assist in all tasks or activities necessary for any solution(s), system(s), and subsystem(s) provided to comply with DoDI 8510.01 “Risk Management Framework (RMF) for DoD Information Technology (IT)” and ensure a favorable Assessment and Authorization (A&A) decision for Platform Information Technology (PIT) (an Authority to Operate (ATO)) and/or an Authority to Connect (ATC) to all requisite Government networks, B. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for IT access, but not less than fourteen (14) working days prior to the employee’s start date, the Contractor must request Information Technology (IT) eligibility for an employee requiring access to the Government network, computing environment, system(s), subsystem(s), and/or components for the AMHE solutions. All positions requiring access to the Government network, computing environment, system(s), subsystem(s), and components will require a IT clearance category eligibility consummate to the services rendered. The Contractor must submit a CIR and a DD Form 2875 (see CIR and System Authorization Access Requests (SAAR) document in Technical Library) for temporary IT eligibility, with final IT eligibility contingent upon receiving favorable adjudication (see paragraph 2.5.1, Personnel Clearance). If the Contractor requires a waiver for IT eligibility, the Contractor must submit justification for the eligibility to the Contracting Officer or COR (if assigned). The Government will notify the Contractor if and when a waiver is approved.

The following is a description of the IT eligibility categories.

IT I: Those positions in which the incumbent is responsible for planning, directing, and implementing a security program; and directing, planning, and designing a computer system including hardware and software. The incumbent is also able to access a system during the operation or maintenance in such a manner that the system would be gravely damaged or the incumbent would realize significant personal gain.

IT II: Those positions in which the incumbent is responsible for directing, planning, designing, operating, or maintaining a computer system and whose work is technically reviewed by a higher authority of the IT I category to ensure integrity of the system.

IT III: All other positions involved in computer activities not covered in IT I and

IT II.

For certain key and non-key personnel, obtaining privileged access to the Government network/system may be required for fully successful Contractor performance on a portion of the deliverables and tasks described within each DO. In this context, “privileged access” is defined in accordance with DoDM 8570.01-M, Appendix 1, AP1.22 as an authorized user who access to the system/subsystem with the capability of control, monitoring, and/or administration functions. These authorized users include (but are not limited to) system administrators, database administrators, etc. This definition includes (but is not limited to) an authorized user who:

Has access to configure and/or update the control functions of the information system beyond a normal user level (IE: software/firmware configuration, administration of user accounts, etc)

Has access to change the control parameters (IE: routing tables, path priorities, addresses) of key information system equipment or software.

Has the ability and authority to control and change program files and other users’ access to data.

Has direct access to operating system level functions (also called unmediated access) that would permit system controls to be bypassed or changed.

Has access and authority for installing, configuring, monitoring, or troubleshooting the security monitoring functions of information systems.

All Contractor personnel requiring privileged access to work on the network / computing environment system, subsystem, and components will be required to possess applicable DoDM 8570.01-M baseline and Computing Environment (CE) certifications as well as clearance eligibility for a IT-I (a clearance requiring a Single Scope Background Investigation) or IT-II (a clearance requiring a National Agency Check with Law and Credit (NACLC) or NACLC equivalent) as applicable prior to contract award and the start of performance. Specifically, users requiring access as a “Server Administrator” to install, configure, test, and maintain the OT solution(s) and/or system(s) environment will be required to obtain and maintain a clearance eligibility for IT-I. Users requiring access as a “Desktop / Device Administrator” to install, configure, test, and maintain HMI terminals for the OT solution(s) and/or system(s) will be required to obtain and maintain a clearance eligibility of IT-II.

These certifications and security clearance eligibilities must be maintained throughout the duration of Contractor performance.

C. All Contractor personnel provided access to Government computers and systems must observe IT security policies and procedures as provided by the Contracting Officer or COR (if assigned). The Contractor must notify the Contracting Officer or COR (if assigned) within twelve (12) hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to Government systems.

D. The Contractor must observe all copyright agreements. In the interest of protecting

Government systems from computer viruses, the Contractor will not use public domain software nor will Contractor personnel download software from public bulletin boards or Internet websites. The Contractor will use only commercial off-the-shelf (COTS), Contractor-developed, or Government software in performance of the contract requirements. Should the introduction of a computer virus or malicious destruction of computer software, stored information, or hardware result from the use of public domain software or from software taken from a public bulletin board or Internet website, the Contractor will be required to repair the damage and incur all costs at no expense to the Government and without impact on delivery schedules.

2.5.4 Safeguarding Information

A. The Contractor will not allow access or disclosure of classified information or information regarding the operations of DLA to any outside Government agency, non- Government agency, or individual unless specifically authorized by the Contracting Officer or COR (if assigned). The Contractor will provide documents and files requested by such parties to the Contracting Officer or COR (if assigned) within one (1) hour of receipt of the authorized request. All data and files created as byproduct of contract performance are considered the property of the Government and the Contractor must turn all files over to the Contracting Officer or COR (if assigned) at the completion or termination of this contract.

B. The Contractor may be required to access data and information that is proprietary to a Government agency or contractor or that is of such nature that its dissemination and use other than as specified in this contract would be averse to the interests of the Government or others. The Contractor and its personnel will not divulge or release data or information developed or obtained under performance of this contract except to Government personnel who are authorized to receive the information or upon written approval of the Contracting Officer or COR (if assigned). The Contractor will not use, disclose, or reproduce proprietary data that bears a restrictive legend other than as specified in this contract.

C. The contractor must maintain, transmit, retain in strictest confidence, and prevent the unauthorized duplication, use, and disclosure of information.