Attm. # 1 Performance Work Statement (PWS).pdf

ATTACHMENT # 1

PERFORMANCE WORK STATEMENT (PWS)

MAINTENANCE SUPPORT SERVICES

FOR

LENEL ONGUARD ELECTRONIC SECURITY SYSTEM (ESS), CLOSED CIRCUIT

TELEVISION (CCTV) SYSTEM, MASS NOTIFICATION SYSTEM (MNS) AND GLOBAL

FACILITIES MANAGEMENT SYSTEMS (GFMS) KEY CONTROL SYSTEM

DLA INSTALLATION MANAGEMENT SAN JOAQUIN (DM-FJ)

LOCATED AT

DEFENSE LOGISTICS AGENCY (DLA) DISTRIBUTION SAN JOAQUIN (DDJC)

SECTION 1 INTRODUCTION

A. The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency that provides worldwide logistics support for the missions of the Military Departments and the United combatant Commands under conditions of peace and war.

B. DM-FJ located at DDJC has a requirement for a Contractor to provide maintenance, sustainment, inspection, testing, and repair services for the Lenel OnGuard Electronic Security System (ESS), Closed Circuit Television (CCTV) system, Federal Signal Mass Notification System (MNS), and

Global Facilities Management Systems (GFMS) Key Control System.

Note: Throughout this document, any mention of ESS will encompass any and all devices or materiel associated with ESS, CCTV, Federal Signal Mass Notification System (MNS), and

GFMS Key Control Systems.

SECTION 2 GENERAL CONDITIONS AND REQUIREMENTS

A. This Section provides general information relating to the conditions of operation and general requirements relating to the maintenance, sustainment, testing and repair services for the Lenel

OnGuard Electronic Security System (ESS), Closed Circuit Television (CCTV) system, Federal

Signal Mass Notification System (MNS) and Global Facilities Management Systems (GFMS)

Key Control System at DM-FJ located at DDJC.

B. The maintenance service shall include two types of service: Preventive Maintenance (PM) scheduled, Corrective Maintenance (CM) unscheduled, general system administration, and continued sustainment support. DM-FJ’s equipment inventory lists and PM frequency are provided in Attachment #’s 1-6 to identify each piece of equipment that requires maintenance services and the PM schedule requirements. DM-FJ’s equipment inventory lists and the PM frequency are subject to change by the Government when equipment addition(s) and/or deletion(s) are required due to equipment disposal or replacement.

C. With the ongoing effort of building consolidation and expansion, the Government reserves the right to ADD to or DELETE from the ESS PM, CM, general system administration, and continued sustainment support contract anytime during the period of the contract as the need arises.

D. The Contractor shall provide cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following as applicable to specific task orders mentioned in section 7.10 of this PWS (most current version):

i. 44 U.S.C. § 3542, January 2012.

ii. Committee on National Security Systems Instruction 1253, Security Categorization and

Control Selection for National Security Systems, March 15, 2012, as amended.

iii. Federal Information Processing Standards Publication 199, Standards for Security

Categorization of Federal Information and Information Systems, February 2004.

iv. Federal Information Processing Standards Publication 200, Minimum Security

Requirements for Federal Information and Information Systems, March 2006

v. Federal Information Security Management Act (P.L. 107-347, Title III), December 2002.

vi. Department of Defense Instruction 5000.02, Operation of the Defense Acquisition

System, January 7, 2015

vii. Department of Defense Instruction 5200.39, Critical Program Information (CPI)

Identification and Protection within the Research, Development, Test, and Evaluation

(RDT&E)

viii. Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to

Achieve Trusted Systems & Networks, July 27, 2017

ix. Department of Defense Directive 8140.01, Cyberspace Workforce Management, August

11, 2015.

x. Department of Defense Instruction 8330.01, Interoperability of Information Technology

(IT), Including National Security Systems (NSS), May 21, 2014

xi. Department of Defense Instruction 8500.01, Cybersecurity, dated 14 March 14.

xii. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for

DoD Information Technology, dated 12 Mar 14.

xiii. Department of Defense 8570.01-M, Information Assurance Workforce Improvement

Program, Change 3 dated 24 Jan 2012

xiv. Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense

Acquisition System, July 9, 2004

xv. DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management

Framework (RMF) into the System Acquisition Lifecycle

xvi. Defense Acquisition Guidebook (DAG)

xvii. Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19 Mar

14, subject: Real Property Related ICS Cybersecurity.

xviii. Defense Information Systems Agency (DISA) Secure Technical Implementation Guides

(STIGs)

xix. National Institute of Standards and Technology Special Publication 800-30, Guide for

Conducting Risk Assessments, September 2012.

xx. National Institute of Standards and Technology Special Publication 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A

Security Life Cycle Approach, February 2010.

xxi. National Institute of Standards and Technology Special Publication 800-39, Managing

Information Security Risk: Organization, Mission, and Information System View, March

2011.

xxii. National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, April

2013.

xxiii. National Institute of Standards and Technology Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security, February 2015

xxiv. UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

xxv. United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control

Systems

xxvi. All replacement parts must be new and in compliance with NDAA John S. McCain

National Defense Authorization Act for Fiscal Year 2019.

2.1 SCOPE OF WORK

A. The Government and the Contractor understand services provided under this contract by the

Contractor are non-personal services and no employer-employee relationship exists between the

Government and the Contractor. The Government may provide technical direction which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the Contractor to perform the service requirements set forth in the PWS.

B. The Contractor shall furnish all labor, supervision, tools, materials, equipment, transportation, and management necessary for PM services, emergency service calls and all repair and or replacement of parts necessary to keep all portions of the ESS, CCTV, MNS and GFMS systems covered by this requirement in good operating condition during the contract period.

C. This is a non-personal services contract to provide maintenance support services for the ESS, CCTV, MNS, and GFMS systems at DM-FJ located at DDJC. The Government shall not exercise any supervision or control over the contract service providers performing the services herein.

Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

D. The Federal Signal MNS communicates via Frequency Modulation (FM) radio approved by the

Federal Communications Commission (FCC) IAW 48 CFR § 252.235-7003.

E. The contractor must provide and maintain all current required cybersecurity artifacts and deliverables, including but not limited to: data flow diagrams, network diagrams, ports, protocols, and services management (PPSM), current and annual Security Technical Implementation Guides

(STIG) maintenance, Federal Information Processing Standards (FIPS) 199 assessment, System

Concept of Operations (CONOPS), hardware and software lists, Assured Compliance Assessment

Solution (ACAS) Scan remediation’s, any immediate patch management as identified by vulnerability management, and any other requested documentation.

2.2 GENERAL OPERATING CONDITIONS

This Section provides general information relating to the conditions of operation and general requirements relating to the PM, CM, general system administration, and continued sustainment support of the Lenel OnGuard ESS, CCTV system, Mass Notification System, and Global

Facilities Management Systems (GFMS) Key Control System at DM-FJ located at DDJC.

2.2.1 PLACE OF PERFORMANCE

A. Work will be performed at the DM-FJ located at DDJC located in Tracy, CA.

B. The ESS, CCTV, MNS and GFMS systems, to include all components are located within the

DDJC. The area covers of approximately 460 acres of Controlled access open storage and sixty-four (64) Controlled or Restricted access buildings, three (3) of which are Classified Storage.

C. The Lenel OnGuard connectivity between buildings consists of underground communication lines.

2.2.2 PERIOD OF PERFORMANCE

The period of performance for this contract will be for a one (1) year base period with two (2) one-year option periods.

2.2.3 REGULAR WORKING HOURS

Regular working hours for the DM-FJ are 0700-1530 Monday through Friday. Scheduled PM, unscheduled CM, general system administration, and continued sustainment support will normally be performed during these hours unless a maintenance window is approved by the

COR/COTR.

2.2.4 FEDERAL HOLIDAYS

A. Federal holidays generally observed by Government personnel include:

Observed Federal Holidays

New Year’s Day Martin Luther King Day

Presidents Day Memorial Day

Independence Day Labor Day

Columbus Day Veterans Day

Thanksgiving Day Christmas Day

B. In the event an Executive Order issued by the President of the United States declares Agencies of the Federal Government closed for a regularly scheduled workday, the KO/COR will determine and advise the Contractor on whether services are required for that day.

2.3 CONTRACTOR PERSONNEL

2.3.1 PERSONNEL QUALIFICATIONS AND CERTIFICATIONS

A. Contractor personnel must be proficient in reading and capable of communicating effectively in

English.

B. All work shall be performed by Contractor personnel specifically qualified and trained to work on the Lenel OnGuard ESS system, CCTV, Federal Signal MNS and Global Facilities Management

Systems (GFMS) Key Control System.

C. Contractor personnel performing work on the Lenel OnGuard ESS shall be certified by Lenel

OnGuard as a Lenel OnGuard Certified Professional (LCP) or higher at the onset of the Period of

Performance (PoP). The Contractor shall be an authorized, licensed service representative and an

“OnGuard” Value Added Reseller (VAR) in good standing with Lenel OnGuard “On Guard”

ESS. The Contractor will be responsible for obtaining all necessary licenses and certifications required to perform PM, CM, general system administration, and continued sustainment support services on Lenel OnGuard ESS, CCTV, Federal Signal MNS and Global Facilities Management

Systems (GFMS) Key Control System systems, and for complying with all applicable DoD, Federal, State, and local laws. The Contractor shall maintain updated copies of any applicable licenses and certifications for all employees and make them available to the Government upon request.

D. All contractor personnel requiring elevated/privileged access to any system or network components, either during provisioning or post award, shall obtain an IT-II clearance and meet

DoD 8570.1-M IA Technical (IAT) II baseline and Computing Environment (CE) certifications, applicable to the existing computing environment. Provide a copy of all current certifications to the Contracting Officer, COR and Contracting Officer’s Technical Representative (COTR) at time of award and remain in good standing during the contract period of performance.

Additional information about baseline and CE can be found at: https://public.cyber.mil/policies-guidance/

2.3.2 CONTRACT PROJECT MANAGER

A. The Contractor shall provide a Contract Project Manager who shall be responsible for the performance of the work. The name of the person and alternate(s) who shall act for the

Contractor. When the Contract Project Manager is absent, then that shall be designated in writing to the KO, COR, and COTR.

B. The Contract Manager or alternate shall have full authority to act for the Contractor on all contract matters relating to the operations of this contract.

C. The Contract Manager or alternate shall be available Monday through Friday, excluding Federal holidays, between the hours of 0700 and 1530 to meet on the installation as required by the COR to discuss problem areas. The Contractor shall provide telephone numbers of the Contract

Manager and alternate(s) who shall be available by telephone during the times stated above and who shall be available within four (4) hours after normal working hours upon request of the KO or COR. This pertains to emergency repairs.

2.3.3 SENIOR SYSTEMS ADMINISTRATOR

A. Ensures the stable operation of the in-house computer software systems and network connections.

This includes planning, developing, installing, configuring, maintaining, supporting, and optimizing all network software and communication links.

B. Analyzes and resolves end user software program and connectivity issues. Provides end user training. Provide recommendations on technology direction to align with business vision. Will be https://public.cyber.mil/policies-guidance/ https://public.cyber.mil/policies-guidance/ required to provide both local and remote maintenance support to various operational systems deployed at more than one location.

C. Support includes general maintenance, upgrades, and new installs of servers and applications.

Applies advanced technical knowledge of application networking, including load balancing applications, and ensuring fault tolerance. Performs vulnerability management on system within the purview of this contract.

D. Minimum Experience: Seven (7) years of progressive experience in the field of Information

Processing, six of which are specialized in numerous specialized Information Processing disciplines involving a range of hardware/software solutions, four of which are concentrated, hand-on experience in installing, configuring, maintaining, and resolving issues with various software.

E. See attachment #7, System and Client Administrator Roles for a full description of requirements.

The Contractor employee shall, at a minimum, have certification that meets DoD 8570.01-M

IAT-II Information Assurance Technical (IAT) and Computing Environment certifications.

Certification requirements prior to interacting with DLA systems/devices.

2.3.4 CLIENT/SYSTEM ADMINISTRATOR

A. The Systems Administrator manages the day-to-day operations by monitoring system performance, configuration, maintenance and repair. Ensures that records of system downtime and equipment inventory are properly maintained. Trains staff in how to use software and hardware. Performs troubleshooting as required. Establishes, maintains and manages user accounts. Installs, modifies and maintains systems and utility software. Diagnoses and recommends fixes to problems or potential problems with the network and its hardware, software and systems.

B. The Client Administrator provides installation, configuration, maintenance, repair and user support for Windows 10 client devices. Trains staff in how to use software and hardware.

Performs troubleshooting as required. Installs, modifies and maintains systems and utility software. Diagnoses and recommends fixes to problems or potential problems with the network and its hardware, software and systems. Ensures the stable operation of the client computer software systems and network connections. This includes planning, developing, installing, configuring, maintaining, supporting, and optimizing all network software and communication links. Analyzes and resolves software program and connectivity issues. Installs, configures and maintains hardware and software. Assists in system design, development, and implementation.

C. The System Administrator may perform the functions of the Client Administrator, provided they have the minimum 8570 and computing environment certifications listed in attachment #7, System and Client Administrator Roles for both positions.

D. See attachment #7, System and Client Administrator Roles for a full description of requirements.

The Contractor employee shall, at a minimum, have certification that meets DoD 8570.01-M

IAT-II Information Assurance Technical (IAT) and Computing Environment certifications.

Certification requirements prior to interacting with DLA systems/devices.

SECTION 3 SECURITY

Work under this contract requires access to a Government Electronic Security System (ESS). All

Contractor personnel must be a US Citizen; therefore, US Citizenship is a requirement. A security clearance is not required to perform the work under this contract at this time; however, an IT II clearance is required. Please refer to Section 2.3.1.E. The Contractor shall comply with all applicable DoD security regulations and procedures during the performance of this contract.

Contractor is required to have a National Agency Check with Written Inquiries (NACI) as required in accordance with DoDI 5200.08. The results must be received prior to commencement of work. A

NEGATIVE NACI DETERMINATION WILL RESULT IN IMMEDIATE TERMINATION OF

ACCESS TO THE WORKSPACE AND EQUIPMENT.

3.1 FOREIGN NATIONAL

No Foreign National will be employed on a Government contract requiring access to Government

Electronic Security Systems without the consent of the United States Government.

3.2 PERSONNEL CLEARANCE AND SECURITY REQUIREMENTS

A. The Homeland Security Presidential Directive 12 (HSPD-12) has established criteria for

Contractors who require a Common Access Card (CAC) for either physical access to an

Installation or access to Government Information Technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and are eligible for a public trust or sensitive position. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary access pending final adjudication of the

PSI. The Contractor shall request personnel clearances in accordance with (IAW) instructions found in Technical Exhibit (TE) 1.1 Contractor Personnel Security.

B. A Contractor Investigative Request (CIR) form annotating the appropriate IT level designation shall be submitted for each contract employee.

C. Not later than 15 calendar days prior to contract full performance start date, the Contractor shall provide the KO and COR access rosters of all personnel requiring access to restricted or controlled access areas. The roster shall include each employee’s full name, identification card number (if assigned), branch or section (if applicable), and security clearance (level of clearance and last investigation date, if applicable). The Contractor shall update the roster and provide to the KO and COR NLT five (5) workings days prior to the date of required access. The Contractor shall make all modifications to the rosters and provide an update to the KO and COR within 12 hours for employees whose employment has been terminated and for employees who no longer require access to restricted or controlled access areas.

D. A majority of the work to be performed under this requirement is unclassified however, a security clearance may be required. All contractor personnel proposed to work on the network or any IT

Capabilities/Functions (at a minimum) will be required to have IT-II, a clearance requiring a

National Agency Check with Law and Credit (NACLC) or NACLC equivalent.

Citizenship. Each Contractor employee shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence, or who presents evidence from the

Immigration and Naturalization Service that employment will not affect his or her immigration status.

Privileged Access for 8570. Contractor employees (including those of sub-contracts) are required to obtain CAC prior to starting work. Lost or stolen Contractor employee badges must be immediately reported to Government security. A replacement CAC will be issued.

All contractor personnel requiring elevated /privileged access to any network or system components, either during provisioning or post award, shall obtain an IT-II clearance, and meet

DoD 8570.1-M IA Technical (IAT) II baseline and computing environment certifications, provide a copy of all current certifications to the Contracting Officer at time of award and remain in good standing during the contract period of performance.

Please see Attachment # 8 for detailed minimum qualification requirements for 8570 elevated privilege Contractor employees.

3.3 DoD COMMON ACCESS CARD (CAC)/ACCESS IDENTIFICATION BADGE (ID Badge)

A. Every Contractor employee shall obtain and possess a DoD Common Access Card (CAC) and/or an Access ID Badge, as required by HSPD-12 and Directed-Type Memorandums (DTM) 08-003.

Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary Information Technology (IT) access pending final adjudication of the persistence investigation (PSI), the Contractor shall submit to the KO or COR a request for the DoD CAC (See paragraph 3.2, Personnel Clearance).

B. The Contractor shall safeguard all CAC and/or ID Badges. Contractor personnel shall not share

CAC and/or ID Badges. Each Contractor employee shall wear the ID Card(s) conspicuously on his or her outer clothing above the waist at all times while working on the Installation. Personnel may be challenged and removed from the work area or denied access to the host Installation if the

ID Card(s) are not worn. The Contractor shall not display or use any badge as a means of personal identification outside the Installation.

C. In the event that a Contractor employee damages his or her CAC and/or ID card, the Contractor shall report the damaged CAC and/or ID Badge within two (2) working hours after discovery of damage to the KO or COR. The Contractor shall arrange for a replacement CAC and/or ID Card.

The Contractor shall return all Government-furnished CAC and/or ID Card(s) to the Government

IAW (Attachment # 9) TE 1.2 Common Access Card (CAC) Procedures. Contractor personnel failing to return their Government CAC and/or ID card are subject to criminal charges under

United States Code (USC) Title 18, Chapter 1, Section 499 and 701.

D. Reference (Attachment # 2) TE 1.2 CAC Procedures for the Standard Operating Procedures

(SOP) for Contractor CAC issuance and accountability.

3.4 INFORMATION SYSTEM SECURITY

A. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary IT access pending final adjudication. But not less than fourteen (14) working days prior to the employee’s start date, the Contractor shall request

Information Technology (IT) eligibility for an employee requiring access (CAC Enabled) and passwords to the Government data systems. Section 2.3.1.E states the Contractor requirements for personnel that require privileged access.

B. All Contractor personnel provided with access to Government computers and systems shall observe IT security policies and DLA procedures as provided by the KO, COR, or COTR. The

Contractor shall notify the KO or COR within 12 hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to Government systems.

C. The Contractor shall observe all copyright agreements. In the interest of protecting Government systems from computer viruses, the Contractor shall not use public domain software nor shall

Contractor personnel download software from public bulletin boards or Internet websites. The

Contractor shall use only Government software and approved application software in performance of the contract requirements. The Contractor shall purchase software support agreements as required to support the tasks in this PWS after approval from the KO.

D. The Contractor shall be responsible for all software maintenance activities for the appliance including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

The Contractor will be responsible for all physical maintenance activities for the appliance including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite), motherboards, daughter cards etc. for the duration of the contract period.

All systems and hardware must be upgradeable and remain compliant to cyber security specifications during the lifecycle of the solution. Any operating systems, virtual environments, databases, and maintenance software required by the Contractor shall be able to operate on

Windows 10, with minimum system requirements: processor: Intel i5 -6200u @ 2.3 Gigahertz

(GHz), Dual-Core, Random-Access Memory (RAM): 8 Gigabytes (GB), Hard Drive: 256 GB.

Approval must be received from the J6 COTR prior to use.

System(s) shall operate using a Contractor fully supported Operating System (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the OS, software, or firmware. This Contractor supplied OS, Hardware, and Software will be validated and approved prior to procurement. The preference is for a virtualized solution.

Windows Server 2012 R2 or Windows Server 2016 with Server 2016 being the preferred OS (or higher versions).

The Contractor is responsible for keeping any Defense Information Systems Agency (DISA)

Security Technical Implementation Guides (STIGS) up to date and remain in compliance with the

National Institute of Standards and Technology (NIST) Special Publication 800-82. Contractor will submit all modifications to the COR and COTR for approval prior to implementing any changes. All Contractor supplied equipment must be validated and approved prior to procurement and also remain in compliance with any DISA STIGs and NIST Special Publication 800-82.

3.4.1 REMOVAL OF EMPLOYEES

DLA reserves the right to direct the removal of an employee, whose actions, while assigned to this contract, clearly conflict with the interests of the Government, regardless of prior clearance or adjudication status. DLA also reserves the right to direct the removal of an employee for misconduct, security violations or performance reasons. The reason for removal shall be fully documented in writing by the Contracting Officer. When and if such removal occurs, the

Contractor shall assign qualified personnel to perform the duties of this contract. This action does not relieve the Contractor from total performance of the contract tasks specified herein.

3.5 GOVERNMENT-ISSUED BADGES

Contractor shall return all Government issued identification, access badges, and vehicle passes to

DLA Distribution Site Security Specialist upon termination of service.

3.6 ACCESS TO THE INSTALLATION

Contractor personnel access to the installation will be via the Common Access Card (CAC).

3.7 PHASE-IN

A. A phase-in period shall be established to allow the Contractor sufficient time to complete all hiring actions for personnel required to perform the requirements of the contract and ensure employees who will require access to the Installation and Government Information Technology

(IT) systems obtain a CAC IAW paragraph 3.3 and 3.4 of the PWS.

B. The phase-in period shall begin at the effective date of the contract and shall not exceed thirty

(30) days, at which time full performance shall commence.

C. The Contractor shall ensure that all Contractor personnel are ready to begin working on the first day of full performance.

D. During the thirty (30) day phase-in period, Contractor personnel shall complete security and safety training on site. Training will be scheduled through the DLA Distribution site training office and will at a minimum include the following classes. Estimated in class time is three (3) hours.

i. Active Shooter Briefing

ii. Safety Briefing

iii. Shelter in Place/Evacuation Awareness Briefing

E. Prior to the thirty (30) day phase-in period to ensure all Contractor personnel shall know and understand regulations and policy pertaining to physical, information, operations, and personnel security, the Contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements. At a minimum, security training requirements as required by the DLA Issuances and other applicable DOD guidance will be completed annually for the following on-line training:

Estimated in class time is 8 hours.

i. Cyber Awareness Challenge

ii. Antiterrorism (AT) Level 1

iii. Operations Security (OPSEC)

iv. Counterintelligence Awareness Training

v. Personally Identifiable Information Awareness

vi. Trafficking in Persons

The security training is web-based, and access will be provided by the Government. The

Contractor shall ensure Contractor personnel have taken the required security training to meet

DoD guidance and that the personnel continue to maintain their certifications.

SECTION 4 DEFINITIONS AND ACRONYMS

4.1 DoD DICTIONARY

The DoD Dictionary of definitions and terms is available on the Internet at http://www.jcs.mil/Doctrine/dod_dictionary/

The DLA Dictionary of acronyms is available on the internet at https://dlamil.dps.mil/Pages/AcronymListHome.aspx

SECTION 5 GOVERNMENT SUPPORT SERVICES

5.1 GENERAL INFORMATION

A. The Government will furnish the following utility services at existing outlets for use in those facilities provided by the Government, and as may be required for the work to be performed under the contract: electricity, natural gas, fresh water, and sewage service. Information concerning the location of existing outlets may be obtained from the COR. Utilities specified above will be furnished at no cost to the Contractor.

B. The Contractor will access existing Government Furnished Equipment (GFE). All specialized software required by the Contractor must be provided to the Government by the Contractor at the time of the contract award. All Contractor provided software required to be installed on GFE will be evaluated and will require approval prior to installation. A GFE request form has been submitted prior to this PWS award for approval. This includes utilities required to develop, communicate, and make configuration updates to a system.

http://www.jcs.mil/Doctrine/dod_dictionary/ https://dlamil.dps.mil/Pages/AcronymListHome.aspx

SECTION 6 CONTRACTOR FURNISHED EQUIPMENT, MATERIALS AND SERVICES

6.1 GENERAL INFORMATION

A. The Contractor shall provide all equipment, materials, and services to perform the requirements of this contract. With the exception of the application and database servers which are supplied by

DLA J64.

B. The Contractor shall provide new parts and components when providing the services described herein. The Government will not accept factory reconditioned parts. All replacement units, parts, components, and materials to be used shall be compatible with that existing equipment on which it is to be used. Shall be of equal or better quality than original equipment specifications; shall comply with applicable Government, commercial, or industrial standards such as National Board of Underwriters or Underwriters' Laboratories, Inc. National Electrical Manufacturer's

Association, and used in accordance with original design and manufacturer’s intent. If the original manufacturer has updated the quality of parts for current production, parts supplied under this contract shall equal or exceed the updated quality.

C. The Contracting Officer may require the Contractor to submit manufacturer's descriptive data and certifications for materials and equipment used. This applies to all equipment hardware and software installed by the Contractor or existing equipment hardware and software. Such submittals shall be delivered to the Contracting Officer within fifteen (15) calendar days of request. Manufacturer's descriptive data and certificates shall include the name of the manufacturer, model number or other identifying information, catalog cut, and other identifying data and information describing the performance, capacity, rating, and application/installation instructions which clearly illustrate that the proposed item meets all applicable standards.

D. The Contractor is responsible for coordinating with the DLA Distribution San Joaquin’s

Accountable Property Officer (APO) for inspection of property, components, replaced parts and material prior to disposal to determine suitability as potentially accountable property.

SECTION 7 SPECIFIC TASKS

7.1 MANAGEMENT

The Contractor shall manage the total work effort associated with the maintenance, Cyber compliance efforts, sustainment, repair, and all other services required herein to assure fully adequate and timely completion of these services. Included in this function are a full range of management duties including, but not limited to, planning, scheduling, report preparation, establishing and maintaining records, and quality control. The Contractor shall provide an adequate staff of personnel with the necessary management expertise to assure the performance of the work in accordance with sound and efficient management practices.

7.2 WORK CONTROL

The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The

Contractor shall plan and schedule work to assure material, labor, and equipment are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein. Based on the devices and PM schedule requirements identified in

Attachment # 6, Preventative Maintenance Frequency, the Contractor shall establish a detailed

PM schedule. The detailed PM schedule shall clearly indicate by device the dates the Contractor plans to perform PM. Within fourteen (14) calendar days after the date of contract award, the

Contractor shall submit the detailed PM schedule to the COR and COTR. The COR and COTR will accept or propose an alternate PM schedule within five (5) calendar days. Schedule and status reports shall be provided when requested by the Contracting Officer. The status of any item of work must be provided within four (4) hours of the inquiry during regular working hours, and within 48 hours after regular working hours.

7.3 WORK SCHEDULE

The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, customer discomfort, etc.

The Contractor will supply a back-out plan for all scheduled changes and shall notify the COR and COTR at least five (5) working days in advance of any work to be performed. Any scheduled outages shall be scheduled within a prior agreed upon maintenance window. Notification shall include the type of work to be done and the estimated completion date. The Contractor shall reschedule any work that the Contracting Officer deems necessary to avoid unacceptable disruptions in the Government's business.

7.4 WORK RECORDS/REPORTS

The Contractor shall maintain management, maintenance, and repair records, and prepare management, maintenance, repair, ad-hoc reports as set forth herein. All records and copies of reports shall be turned over to the Contracting Officer, COR, and COTR within seven (7) calendar days after contract completion. A complete work (history) file for each building security system shall be maintained by the Contractor. Files shall contain a listing of all equipment in each building and structure by nomenclature and manufacturer's model number, as well as all manufacturer's literature, brochures, and pamphlets; maintenance, operator's, and parts list manuals; warranty information; a copy of all completed Service Call Work Authorization forms, and PM checklist forms; and other information pertaining to the security protection systems. All decommissioned/replaced parts/items that are tracked in the inventory shall be approved by the

COR/COTR before disposal. All documents shall be filed within ten (10) working days of the completed transaction, with the exception of PM Inspection Record forms, which shall be filed within two (2) working days after the completion of each PM inspection. The Government will have access to these files upon request. The entire file shall be turned over to the Government upon completion of the contract.

7.5 STAFFING

The Contractor shall continuously maintain an adequate staff with suitable management expertise to assure work is scheduled and completed in accordance with these specifications. The

Contractor shall maintain a certified work force to complete work in accordance with the time and quality standards specified.

7.6 GENERAL REQUIREMENTS AND PROCEDURES

This Section provides general information relating to the general requirements and procedures relating to the contract services to be performed by the Contractor.

7.6.1 STANDARDS

A. All workmanship shall meet the standards specified herein and shall be accomplished in conformance with approved and accepted standards of the industry; equipment manufacturers; all applicable activity, local, state, and federal standards; and all applicable building and safety codes.

B. When the Contractor completes work on a system or piece of equipment, that system or piece of equipment shall be free of missing components or defects which would prevent it from functioning as originally intended and/or designed. CM or repair/replacement work shall be carried to completion including operational checks and cleanup of the job site. Except where otherwise noted, replacements shall match existing in dimensions, finish, color, and design.

C. During and at completion of work, debris shall not be allowed to spread unnecessarily into adjacent areas nor accumulate in the work area itself. All such debris, excess material, and parts shall be cleaned up and removed at the completion of the job and/or at the end of each day work is in progress.

D. Upon completion of work, the Contractor shall contact the COR to report the status of the system and document details of the service in the on-site service request log.

7.6.2 REPLACEMENT, MODERNIZATION, RENOVATION

During the term of the contract, the Government may replace, renovate, or improve systems and equipment at the Government's expense and by means not associated with this contract. All replaced, improved, updated, modernized, or renovated systems and equipment shall be maintained and/or repaired by the Contractor at no additional cost to the Government unless such changes result in an increase or decrease in contract requirements. Changes, replacements, or deletions which result in an increase or decrease in contract requirements will result in adjustments to the contract price in accordance with the "CHANGES" clause.

7.6.3 MANUFACTURER’S OR INSTALLER’S WARRANTY

Equipment, components, and parts, other than those installed under this contract, shall not be removed or replaced or deficiencies corrected while still under warranty of the manufacturer or the installer without prior approval of the COR and COTR. All defects in material or workmanship, defective parts, or improper installation and adjustments found by the Contractor shall be reported to the COR and COTR so necessary action may be taken. The Contractor shall be knowledgeable of the equipment, parts, and components that are covered by warranty and the duration of such warranties.

Available warranty information will be furnished to the Contractor upon request.

7.6.4 AS-BUILT DRAWINGS

A. Existing as-built drawings will be available to the Contractor for information only. The

Government makes no representation as to the completeness or accuracy of these drawings.

B. All changes to or additions to the depot security systems and equipment made by the Contractor shall be recorded by the Contractor and provided to the KO within fourteen (14) calendar days of the completed work. This data shall include, but is not limited to, dimensioned drawings and for sketches.

C. All as-built drawings will be returned to the KO or COR/COTR prior to contract closeout.

7.6.5 SOFTWARE UPDATES, APPLICATION UPGRADES, AND PASSWORDS

The Contractor shall provide all software updates when an upgrade or patch is released from the

Original Equipment Manufacturer (OEM). The Contractor shall maintain an accurate software configuration and coordinate thru the Lenel OnGuard Value Added Reseller (VAR) for all equipment. The contractor is responsible for upgrades, migrations, or enhancements required to remain compliant with current patching and versioning releases. All releases must be coordinated with J6 for approval prior to implementation.

All software recommendations and updates are to be coordinated directly with the COR/COTR. All

Contractor provided software will be evaluated and will require approval from the COTR prior to installation/upgrade. This includes any utilities required to develop, communicate and make configuration updates to a system.

The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The DLA KO, PM or COTR shall approve in writing the Contractor’s recommendation. The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation. The Contractor shall disable or remove all default and guest accounts prior to the File Allocation Table (FAT). Once changed, new accounts will not be published except that new account information and passwords will be provided by the Contractor via protected media. At delivery, the Contractor shall disable, remove, or modify all Contractor-owned accounts or negotiate account ownership with the DLA KO, PM, and COTR. Contractor updates shall not re-enable or re-install any of these accounts.

The Contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet Advanced Encryption Standard (AES) 256 and comply with FIPS 140.2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The Contractor shall provide user account-based logout and timeout settings.

The Contractor shall implement two-factor authentication using DoD CAC where technically feasible, with exceptions noted in the proposal. The Contractor shall provide a configurable account password management system that allows for selection of password length, frequency of change, setting of required password complexity, number of login attempts, inactive session logout, screen lock by application, and denial of repeated or recycled use of the same password. The Contractor shall not store passwords electronically or in Contractor-supplied hardcopy documentation in clear text unless the media is physically protected.

7.7 WORK OUTSIDE REGULAR WORKING HOURS

Except as may otherwise be specified, all work shall be performed during the Government's regular working hours. If the Contractor desires to carry on work on Saturday, Sunday, holidays, or outside regular working hours, he/she must submit application to the COR for approval.

7.8 SERVICE LEVEL AGREEMENT (SLA)/ACCEPTABLE QUALITY LEVEL (AQL)

7.8.1 REQUIREMENT AND PROCEDURES

Service calls are defined as PM, CM, general system administration, and continued sustainment support work requirements which are identified by building occupants or generated by the designated COR, or Security Specialist. The Contractor shall perform service call work as necessary to determine the cause of system and equipment malfunctions, eliminate the cause(s), and restore the system or equipment to satisfactory working condition.

7.8.2 SERVICE CALL REQUESTS

The COR, DLA Facilities Maintenance, or Security Specialist will advise the Contractor by phone or email of all service call requests received during and after regular working hours. A description of the problem or requested work, date and time received, location, classification, and other appropriate information will be placed on a Service Call Request.

7.8.3 RESPONSE TO SERVICE CALLS

The Contractor shall have adequate procedures for receiving and responding to service calls 24 hours per day, seven days a week, including weekends and holidays. A single telephone number shall be provided by the Contractor for receipt of all service calls. All telephone calls shall be answered within 30 minutes by an individual fully familiar with the Contractor's work control procedures and the terms and conditions of this contract. Service calls shall be considered received by the Contractor at the time and date the telephone call is placed, or email is sent by the COR. The

Contractor shall respond immediately and must be on the job site and working within four (4) hours after receipt of an emergency service call. The Contractor shall work continuously without interruption and shall resolve the emergency condition before departing the job site.

7.8.4 COMPLETED CALLS

Within one (1) working day after completion of each service call, the Contractor shall add the following information to the work authorization form and return to the COR:

• Description of work actually completed.

• Brief description of material and parts used, including quantities.

• Date and time work began.

• Date and time work were completed

• Hours of labor (by trade) expended.

• Signature or initials of the Contractor's craftsman performing the work (or supervisor), indicating that the work has been completed.

7.8.5 MATERIALS AND EQUIPMENT

A. The Contractor shall maintain sufficient off-the-shelf materials and equipment on hand to support service call work requirements. The Contractor shall provide a list of equipment/inventory that may take, or has a history of taking, longer than two (2) weeks to procure/receive to the

Government on an annual basis. The Contractor shall maintain, at a minimum, two (2) of each item identified on this list at all times. Lack of availability of materials or equipment shall not relieve the Contractor from the requirement to complete service call work within the time limits specified above.

B. Replacement parts required in the performance of a CM shall be invoiced to the Government in accordance with the terms and conditions of this contract (FAR 52.212-4 Alternate I).

7.8.6 MONITOR SECURITY CONTROLS

The Contractor shall throughout the period of performance, conduct cybersecurity activities as needed, with guidance and approval from the ISSM, including:

• Implement Information Assurance Vulnerability Alerts (IAVAs)

• Apply software patches and updates

• Update and maintain antivirus/Host-Based Intrusion Detection Signatures (HIDS)

• Apply Warning Orders and Operation Orders

• Update or replace hardware

• Apply firmware updates

• Perform reauthorization as needed per the DoD Risk Management Framework (RMF) for IT requirements

• Maintain local site infrastructure, facility, physical, and procedural security requirements

7.9 PREVENTIVE MAINTENANCE (PM) AND QUARTERLY TESTING

7.9.1 REQUIREMENT AND PROCEDURES

A. The Contractor shall perform PM services on all equipment in accordance with the manufacturer’s recommendations, which consist primarily of inspection, testing, cleaning, lubrication, adjustment and calibration. To verify proper system operation; minimize malfunction, breakdown, and deterioration of systems and equipment, the Contractor shall perform PM services in accordance with the information specified in Attachment # 6, Preventative

Maintenance Frequency. The Contractor shall submit a schedule for all PM tasks. Any modifications, changes, add-ons, or deletions shall be submitted to the COR/COTR for approval and once approved and implemented, documented in as-built drawings and provided to the site.

B. All replacement parts, materials, environmental compliance and Contractor personnel transportation used for PM shall be included in the contract unit price for PM services.

7.9.2 BATTERY MAINTENANCE

Battery voltage and charge levels will be checked during the quarterly testing. Any battery incapable of maintaining a 75% charge will be replaced immediately.

7.9.3 QUARTERLY COMPLETE SYSTEM TEST OF INTRUSION DETECTION SYSTEM (IDS)

All quarterly testing on the IDS shall be scheduled to be performed during normal working hours.

7.10 MANDATORY REPORTS AND DELIVERABLES

The Contractor shall create and distribute reports and deliverables as described below for the

Government to administer performance of the contract requirements and to manage and interface with other Government activities or agencies. The table below is a listing of required reports outlined in the contract. The Contractor shall submit all reports to the KO, COR, and COTR for review and final distribution.

Report Number 001

Title: Monthly Contractor Employee Common Access Card (CAC) Report

PWS Ref.: Para 3.3 DOD Common Access Card (CAC)/Access Identification

Badge (ID Badge)

Description: The report shall be prepared IAW TE 1.2 and shall include:

1. Employee's name

2. Date of CAC issuance

3. Date of CAC expiration

4. Verification of whether each listed employee still requires a

CAC

5. Changes that have…