SP4702-24-Q-0009 FINAL.pdf

+,-./0/1/23 3.45,+

6231+761 32* 8* 797+:;,<<,61/=, :71, 2+:,+ 3.45,+

0>&$%(?(&?-?%%%@

A* 02B/6/171/23 3.45,+ C* 02B/6/171/23 /00., :71, 5DEFG

HIJIKLM

:5H%%%8

N* 374, >OIMDP

C)&?C@(?$'%&

Q* 1,B,>R23, 3.45,+

STU

VUWWXYZ

Y[WW\]

2<<,+ :71,;

B267B 1/4, /00.,:

5̂

62:, 0>&$%(

:602 62B.45.0?:/=/0/23?)

>2 52_ 8@@% 62B.45.0 2R

&8()'?8@@% .07 àb cdef ghijefecekl ef )%%.3+,01+/61,:

2+ 0,1 70/:,P m nkop fqgrr sjfeltff djsuklt fqgrr sjfeltff

924,3?293,:

047BB

5.0/3,00

S9205] ,B/H/5B, .3:,+ 1R, 924,3?293,:

047BB

5.0/3,00 >+2H+74

S7]

0,+=/6,?:/075B,:

=,1,+73?293,:

047BB

5.0/3,00

AC)C()37/60P

0/v,�0173:7+:P$25 Million :,B/=,+̂ <2+ <25 :,01/37?

1/23 .3B,00 5B26w /0 47+w,:

:/062.31 1,+40

)8N* 1R/0 6231+761 /0

+71,:

2+:,+ .3:,+ :>70 S)A 6<+

)8Q* +71/3H

4,1R2:

2< 02B/6/171/23 oni ens onx

)A* :,B/=,+

62:, )C* 7:4/3/01,+,:

62:, )$N* 6231+7612+;

2<<,+2+

<76/B/1̂

62:, ctrtxdklt lkb

)'N* >7̂ 4,31

9/BB

5, 47:, )$Q* 6R,6w +,4/11736, /0 :/<<,+,31 73:

>.1 0.6R 7::+,00 /3

2<<,+

)'Q* 0.54/1 /3=2/6,0 7::+,00 0R293 /3 5B26w )'N .3B,00 5B26w

5,B29 /0 6R,6w,:

/1,4 32*

06R,:.B, 2< 0.>>B/,0;0,+=/6,0

-.731/1̂

.3/1

(8*

.3/1 >+/6, 742.31

0DD

0EODyzKD

{|\X }X~X�\X [���U�

�ZZ[Y�

����Z�U�[W

��XXZ\

TXYX\\[���

(A* 7662.31/3H 73:

7>>+2>+/71/23 :717 (C* 1217B 797+:

742.31 {�U� �U~Z� |\X ��W��

($N* 02B/6/171/23 /362+>2+71,0 5̂ +,<,+,36, <7+ A(*()(?)� A(*()(?&* <7+ A(*()(?8 73:

A(*()(?A 7+, 71176R,:*

7::,3:7 7+, 7+, 71176R,:

($Q* 6231+761;>.+6R70, 2+:,+ /362+>2+71,0 5̂ +,<,+,36, <7+ A(*()(?&* <7+ A(*()(?A /0 71176R,:*

7::,3:7 7+, 7+, 71176R,:

6231+7612+ /0 0/H3 1R/0 :26.4,31 73:

+,1.+3 62>/,0 /00./3H 2<</6,* 6231+7612+ 7H+,,0

<.+3/0R 73:

:,B/=,+

7BB

/1,40 0,1 <2+1R 2+ 21R,+9/0, /:,31/</,:

752=, 73:

73̂ 7::/1/237B 0R,,10 0.5�,61 1R, 1,+40 73:

623:/1/230 0>,6/</,:

797+:

2< 6231+761P

2<<,+

:71,:

̂2.+ 2<<,+ 02B/6/171/23

S5B26w A]� /36B.:/3H 73̂ 7::/1/230 2+ 6R73H,0 9R/6R 7+, 0,1 <2+1R R,+,/3� /0 766,>1,:

/1,40P

8%N* 0/H371.+, 2< 2<<,+2+;6231+7612+ 8)N* .3/1,:

0171,0 2< 74,+/67 {���T��|}� V�T�}�V��T� ����V�}�

8%Q* 374, 73:

1/1B, 2< 0/H3,+ {���X U� ����Z� 8%E* :71, 0/H3,: 8)Q* 374, 2< 6231+761/3H 2<</6,+ {���X U� ����Z� 8)E* :71, 0/H3,:

ftt fhdt�jrt

<2+ 02B/6/171/23 /3<2+471/23

67BBP

0,, 06R,:.B, 11:59 PM

S+,=* >�D�E�LQDy

QG

H07 <7+ S&' 6<+] A8*()(

7.1R2+/v,:

<2+ B267B +,>+2:.61/23 >+,=/2.0 ,:/1/23 /0 .075B, 0,, 7::,3:.4

,:9205

Jan 23, 2024

Feb 6, 2024

,-./0.10�2314�5667�8������9�:��;�<.=>

������������������9�����

�A��

��B����C � ����D���C���� ��

��E���� � ��F����� ����D���C���� ��

��G��

��H���I���������� ����D���C���� ��

�K�� L� �����

�M���9���

���������NOPQRST

���� C����� �� @�E����

@�E����

U��NVVWXXWYYT @�F��

@�B����

�N[\]̂SQ\RT

SP4702-24-Q-0009 Page 2 of 140

SECTION A - SOLICITATION/CONTRACT FORM

Offers are required to be received by February 06, 2024 at 11:59 PM Eastern Standard Time. Late offers will not be considered for this procurement.

DESCRIPTION OF PRODUCTS AND SERVICES

Services:

Maintenance of the Electronic Security Systems (ESS) for the Defense Supply Center Columbus

(DSCC).

PERIOD OF PERFORMANCE

Base Year: 365 days from date of award

The Government shall not be responsible or liable for any costs incurred by any parties in the preparation and submission of any technical quote or price quote in response to this RFQ.

SUBMISSION OF QUESTIONS

Should the vendor have any questions with regards to the RFQ, they should submit them via email, to Becky Gogolin at Becky.Gogolin@dla.mil. All questions must be received by 11:59 PM EST January 30, 2024.

VENDOR PROPOSAL INSTRUCTIONS AND REQUIREMENTS

1. Period for Acceptance of Offers: The offeror agrees to hold the prices in its offer firm for 90 calendar days from the date specified for receipt of offers, unless another time period is specified in an addendum to the solicitation.

2. Offeror Submittal Requirements: in order to be further considered for award, offeror shall submit the following as part of their quote:

a. Signed 1449.

b. Completed pricing documents and CLINS.

c. Acknowledgement of any solicitation amendments.

d. Confirm compliance with requirements included in the drawings and specifications.

e. If applicable, include GSA Contract number with relevant information to contract.

3. The Government will issue a single purchase order resulting from this RFQ to the responsible vendor whose quote conforming to the RFQ will be most advantageous to the Government, price and other factors considered. Therefore, it is important that your initial quote submittal is on the most favorable terms and complies with all instructions contained in this request. The Government also reserves the right not to issue an award as a result of this request if such an award is determined to be contrary to the best interests of the Government.

4. Exceptions to any terms and conditions of the RFQ may make the quote unacceptable.

QUOTE PREPARATION COSTS

SP4702-24-Q-0009 Page 3 of 140

SP4702-24-Q-0009 Page 3 of 140 mailto:Becky.Gogolin@dla.mil mailto:Becky.Gogolin@dla.mil

DLA POC’s

Contracting Officers Representative:

Alan Albrecht Alan.albrecht@dla.mil 614-692-8939

Contract Specialist:

Becky Gogolin Becky.Gogolin@dla.mil 614-981-1791

Contracting Officer:

Mitchell Hatfield Mitchell.Hatfield@dla.mil 614-692-9443

WIDE AREA WORKFLOW (WAWF)

All invoices shall be submitted through the Wide Are Workflow (WAWF) system. No other means of invoice acceptance or contract payment are allowed under this contract. See Clause 252.232-7006 for additional details.

ATTACHED DOCUMENTS

Service Contract Wage Rate Determination Quality Assurance Surveillance Plan (QASP)

Common Access Card (CAC) Procedures

Performance under this contract may require the contractor to obtain a Common Access Card (CAC). If CACs are issued under this contract, the contractor shall complete and comply with the following steps to obtain, control, and turn-in Government-issued CACs, as well as establish procedures to control and account for contractor CACs at all times. This process is only for the issuance and accountability of CACs. Contractors may be required to provide additional forms and follow additional procedures for other forms of access and/or background/security checks depending on local site/installation requirements.

1. The contractor has each contractor employee requiring a CAC complete and sign Sections I and II of the DD Form 1172-2. The instructions for completing the DD Form 1172-2 are located at http://www.cac.mil/docs/1172-2-Instructions.pdf.

a. For Section II, Block 22 - If the contractor employee signs and the DD Form 1172-2 it is then forwarded by the contractor. This provides verification for the employee information. If the contractor is submitting a DD Form 1172-2 for him/herself (e.g., the owner), with no higher authority above them for verification, then the signature in Block 22 must be notarized to verify identity.

2. The contractor forwards the DD Form(s) 1172-2 via hand-carry, secure mail, or encrypted email to (NOTE: The contractor may forward these forms individually or as a group):

SP4702-24-Q-0009 Page 4 of 140

SP4702-24-Q-0009 Page 4 of 140 mailto:Patrick.McCorkle@dla.mil mailto:Patrick.McCorkle@dla.mil mailto:Mitchell.Hatfield@dla.mil mailto:Mitchell.Hatfield@dla.mil mailto:William.Hurley@dla.mil mailto:William.Hurley@dla.mil http://www.cac.mil/docs/1172-2-Instructions.pdf http://www.cac.mil/docs/1172-2-Instructions.pdf

a. The Contracting Officer’s Representative (COR) for the contract, if a COR was designated.

b. The Contracting Officer (CO) for the contract, if no COR was designated.

3. Each contractor employee must verify his/her account information upon receipt of an email from the Government containing a username and password for the Trusted Associate Sponsorship System (TASS). The web link for TASS is included in the email.

4. Each contractor employee will receive an email via TASS when his/her account has been approved. The email will notify the employee to obtain a Government-issued CAC from the nearest Real-Time Automated Personnel Identification System (RAPIDS) office. The email will also provide a link that identifies the locations of RAPIDS offices.

5. Each contractor employee shall obtain his/her issued CAC from the RAPIDS office.

6. The contractor, within one (1) business day of issuance, provides written notice via email to the COR (or the CO, if no COR was designated) for each contractor CAC issued identifying the contractor employee’s name, the date of issuance, and the date of expiration of the CAC. This notification may be made individually for each contractor employee or together for a group of contractor employees.

7. The contractor establishes procedures to control and account for Government-issued contractor CACs at all times, to include the following:

a. Ensure contractor CACs issued for this contract are only used for the purpose of performing under this contract.

b. Ensure contractor CACs are secured in a manner that precludes unauthorized use and that recognizes the CAC is the property of the U.S. Government.

c. Ensure contractor employees do not abuse or place holes in their CACs.

d. Ensure contractor employees do not display their CACs in public.

8. If a contractor CAC is lost or stolen:

a. The contractor employee shall immediately notify the contractor that the contractor CAC has been lost or stolen.

b. The contractor shall immediately notify the COR (or the CO, if no COR was designated), detailing the circumstances regarding the lost or stolen contractor CAC, as follows:

i. In person, followed within one (1) business day by a written notice via email, or

ii. In writing, via email, or

iii. By telephone, followed within one (1) business day by a written notice via email.

c. The contractor shall report the lost or stolen CAC card to the local DLA Police/host installation police, who will provide the contractor a police report. If there is no local DLA Police/host installation police, or no police report is provided, the contractor shall provide information to the COR/CO, as applicable, detailing the circumstances of how the CAC was lost or stolen. The COR/CO will provide a memorandum for the contractor employee to support issuance of new CAC.

d. The contractor has the contractor employee bring the report/memorandum to the nearest RAPIDS office. If the CAC can be reissued within 24 hours, bring the report/memorandum to the nearest CAC office for reissue. If the CAC cannot be reissued in 24 hours, follow the steps for a new CAC, beginning at Step 1.

9. If the expiration date for a contractor CAC is prior to completion of the contract and the

SP4702-24-Q-0009 Page 5 of 140

SP4702-24-Q-0009 Page 5 of 140 contractor employee is to continue working under the contract and still requires a CAC, the contractor:

a. Notifies the COR as follows:

i. In person, followed within one (1) business day by a written notice via email, or

ii. In writing, via email, or

iii. By telephone, followed within one (1) business day by a written notice via email

b. No less than two (2) weeks prior to the current CAC’s expiration date, completes and complies with the steps above beginning with Step 2 for issuance of a new contractor CAC for the employee.

c. Brings the expiring CAC to the RAPIDS office for turn-in and receives new CAC.

d. Notifies the COR once a new CAC has been issued.

10. The contractor/contractor employee turns in any found CACs immediately, via handcarry, to the nearest Federal law enforcement office.

11. The contractor immediately collects all contractor CAC(s) from the contractor employee(s) at:

a. Contract completion or termination

b. Termination/Reassignment of an employee (this includes any reason the employee is no longer working for the contractor under the contract or otherwise no longer requires a

CAC)

12. The contractor:

a. For contract completion or termination – within one (1) business day after collecting the contractor CAC(s), arranges for turn-in via one of the below methods:

i. If the COR/CO is co-located or near enough that in-person transfer of CACs can be arranged, the contractor:

1. Arranges to meet the COR (or the CO, if no COR was designated) to turn-in the collected contractor CAC(s).

2. Hand-carries all collected contractor CACs for turn-in to meet the COR

(or the CO, if no COR was designated).

3. Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt with the COR (or the CO, if no COR was designated). The contractor is provided a copy of the receipt.

ii. If in-person transfer of CAC cannot be arranged, the contractor:

1. Sends, via certified mail, the CACs to the COR/CO. The contractor includes in the package the Government-Issued Contractor CAC Turn-In Receipt, with signed acknowledgement of contractor turn-in.

2. Notifies COR/CO that CACs have been sent via certified mail.

3. Receives a completed copy of the receipt from the COR/CO once the

COR/CO has received the CACs.

b. For termination/reassignment of an employee:

i. Immediately notifies the COR (or the CO, if no COR was designated) that the employee is no longer working for the contractor under the contract or otherwise no longer requires a CAC, as follows:

1. In person, followed within one (1) business day by a written notice via email, or

2. In writing, via email, or

3. By telephone, followed within one (1) business day by a written notice via email.

ii. Follows the turn-in procedures above for contract completion or termination, as applicable.

SP4702-24-Q-0009 Page 6 of 140

SP4702-24-Q-0009 Page 6 of 140

Contractor Reporting Requirements: The contractor is required to submit, on a monthly basis, to the COR (or the CO, if no COR was designated) a report of all employees working on the contract who have been issued CAC cards and a verification of whether each listed employee still requires a CAC. The report must note where changes have occurred (additions or deletions) since the previous month. Contractor employees who already have a CAC related to another DLA or DoD contract must be included in the monthly report. Contractor shall note the issuing organization and the CAC expiration date. Contractor is still responsible for notifying the COR/CO when the individual is no longer working under the subject contract.

The above procedures have been established as a DLA security measure. Contractors are advised that failure to comply with any of the above requirements will be considered a violation of the terms and conditions of the contract and the Contracting Officer may take action to remedy such violations.

Specifically, failure to safeguard, follow these procedures, including reporting requirements, or turn-in CACs within the established timeframes may result in the following actions, which are in addition to other actions the Contracting Officer may take under governing law and regulation and the terms and conditions of the contract:

• Immediate work stoppage (issuance of a stop work order), not to be lifted until resolution of CAC issue

• Disapproval of invoices and delay of payment

• Withholding of final payment (in accordance with FAR 52.204-9)

• Documentation of CAC Non-Compliance in the Contractor Performance Assessment Reporting

System (CPARS)

SP4702-24-Q-0009 Page 7 of 140

SP4702-24-Q-0009 Page 7 of 140

BID FORM

Maintenance of ESS Systems for DSCC Columbus

BASE YEAR

(1) Full Time Network Administrator

(as outlined in Section Q of PWS) =$_____________

(120) Hours Overtime Network Administrator =$_____________

(as directed by Government POC)

Labor Rate: $___________

OT Labor Rate: $___________

(2) Full Time Field Technicians =$_____________

(as outlined in Section Q of PWS)

(120) Hours Overtime Field Technicians =$_____________

(as directed by Government POC)

SP4702-24-Q-0009 Page 8 of 140

SP4702-24-Q-0009 Page 8 of 140

Labor Rate: $___________

OT Labor Rate: $___________

Repair Parts & Material NTE =$200,000

(as directed by Government POC)

TOTAL BASE YEAR _________________

SP4702-24-Q-0009 Page 9 of 140

SP4702-24-Q-0009 Page 9 of 140

Performance Work Statement (PWS)

1.0 Title: Maintenance of ESS Systems for DSCC Columbus

2.0 Introduction:

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency providing worldwide logistics support to the missions of the Military Departments and the Combatant Commands.

In support of these missions, DLA Installation Management (DM) maintains a presence at DLA locations for the life, health, and safety systems including Electronic Security Systems (ESS) and Electronic Key Control (EKC).

DM serves as the functional proponent for all ESS and EKC requirements, policy, and procedures.

ESS encompasses Intrusion Detection Systems (IDS), Access Control Systems (ACS), and Closed-Circuit Television (CCTV) systems, for DLA facilities, personnel, and property. EKC controls and logs the access to key cabinets located around the installation that authorized users can operate to remove specific keys for facility access.

The ESS and EKC, includes all subcomponents, are located within the DLA Defense Supply Center Columbus, Ohio (DSCC) and currently reside on the DLA network.

3.0 Background:

This Performance Work Statement (PWS) outlines requirements for Preventative Maintenance (PM), Corrective Maintenance (CM), Emergency Maintenance (EM), software upgrades for associated equipment/hardware for the Lenel OnGuard, Lenel Milestone, Keystone, and Morse Watchman Key System at DSCC.

The Contractor shall provide installation and/or maintenance support to include but not limited to daily operations testing, cybersecurity support and artifacts, upgrades, patches, migrations, enhancements, inspection, and corrective and preventive maintenance. The Contractor shall assist with supporting information, protection needs and system security requirements for Commercial off-the-Shelf (COTS) ESS and EKC solutions.

4.0 Scope and Tasks:

A. Service Plan The contractor shall provide a program management plan. The plan shall clearly establish the scope of work to include Preventative Maintenance (PM), Corrective Maintenance (CM), Emergency Maintenance (EM), software upgrades for associated equipment/hardware for the Lenel OnGuard, Lenel Milestone, Keystone, and Morse Watchman Key System at DSCC. At a minimum, the plan shall include all personnel to conduct services, the licenses and certifications for each individual, the methods, and tools to be used to conduct service for each building, and a schedule.

SP4702-24-Q-0009 Page 10 of 140

SP4702-24-Q-0009 Page 10 of 140

B. Work Effort The Contractor shall manage the total work effort associated with the PWS herein to assure timely completion of all PWS items including, but not limited to, planning, developing, and implementing project plans, scheduling, report preparation, communication and coordinating with stakeholders, escalation procedures, establishing and maintaining records, monitoring, and quality control. The Contractor shall provide fully qualified personnel with the necessary management expertise, training, and certifications to assure the performance of the work in accordance with sound and efficient management practices.

C. Work Control The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor and equipment of all contracted items are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein.

The Contractor shall submit a Quality Control Plan (QCP) within ten business days of contract start date to the COR and updated monthly in the MSR. This plan shall describe the Contractor’s methodology of compliance with the Deliverables and Performance Requirements Summary outlined above. The COR will notify the Contractor of concurrence or required modifications to the QCP within ten business days of receipt. The Contractor shall make appropriate modifications within five (5) business days of the COR’s notification and provide a revised QCP within five (5) business days.

The Contractor shall provide operations, sustainment, and maintenance support including mechanical Preventative Maintenance (PM), Corrective Maintenance (CM), and technical services support of software/hardware including any required manufacturer support plan products. Specifically, the Contractor shall provide the personnel, equipment, spares, mechanical hardware, software/firmware including licensing required for fully operational ESS and EKC systems including, but not limited to, testing, inspection, maintenance, services, patching, upgrading, migrating, and/or enhancing ESS and EKC systems.

Preventative Maintenance (PM) includes a recurring set of scheduled services and actions which the Contractor shall provide to keep systems fully operational and compliant.

Corrective Maintenance (CM) is the non-recurring unscheduled repairs or services required to make the systems fully operational.

SP4702-24-Q-0009 Page 11 of 140

SP4702-24-Q-0009 Page 11 of 140

Emergency Maintenance (EM) is any activity that requires immediate action. DSCC security personnel are the first line of defense for responding and assessing mission critical situations. DSCC security personnel must assess what the problem is and determine the correct response prior to the ESS Support contractor being notified. The contractor shall:

1. Respond to requests for emergency maintenance.

2. Perform troubleshooting functions of the IESS (Hardware and Software).

3. Contact the DISA Global Service Desk and request an incident be opened and assigned to J62BK – OT Security for ESS issues as necessary.

4. Coordinate with the Information Technology Operations Center (ITOC) as necessary.

5. Locate the cause of the faults, replace defective components/equipment, and make necessary adjustments to the system (Hardware and Software).

6. Follow-up with the DSCC security POC detailing the emergency, arrival time to the site, and repair/corrections needed to return the system to full functionality.

7. Follow-up with the DSCC security POC upon completion of the repair.

Technical services support includes daily operations support, version upgrades, patching, security updates, enhancements, data migrations, and/or network migrations required for ESS and EKC systems. All required cyber updates and patches shall be done through Preventative Maintenance including Information Assurance Vulnerability Alert (IAVMs), Cyber Task Order (CTO), Assured Compliance Assessment Solution (ACAS) scan remediations or any other cyber requirements to include updating or creating any supporting cybersecurity documentation required for assessment and accreditation.

1. Operations The Contractor shall support daily operations of systems including system monitoring, break/fix triage support, incident management, project management, configuration management and PM/CM required in day-to-day operations support. Contractor shall provide an Incident Response Plan (IRP) for incident management to the COR and J6 TPOC for approval.

2. Sustainment The Contractor shall develop and implement a Sustainment Plan for all systems, subsystems, and equipment IAW with original equipment manufacturer and/or Federal/DoD/DLA policies and procedures. The Sustainment Plan shall include the periodic maintenance, repair, replacement, and overhaul of existing systems, hardware, and software including planned version upgrades of the application and Operating System (OS). The Contractor shall provide the Sustainment Plan which includes the technology road map, the PM

SP4702-24-Q-0009 Page 12 of 140

SP4702-24-Q-0009 Page 12 of 140

DBG0003

Highlight schedule, and Corrective Maintenance (CM) approach to the COR for approval within five (5) days of contract award. The CM approach should include:

1. Position qualified and certified personnel, test equipment, and other pertinent information needed to quickly diagnose and make repairs.

2. Plan, perform, and document system confidence tests, periodic inspections, and preventive maintenance of the application and servers.

3. Identify critical system operations and implement strategies to prevent potential failures or administrative downtime from creating a critical system outage.

4. Provide after-hours support response times within 4 hours for tickets/issues.

5. Since these applications are health and safety systems, they require high uptime ~ 99.6%, 24/7, 365 and the Contractor should maintain and support as such.

6. Analyze fault histories and fault trends to proactively predict and mitigate repetitive issues.

7. Respond to and take corrective action to resolve vulnerabilities identified by the Contractor or the Government. Lead the efforts to resolve the vulnerabilities associated with the ESS applications, servers, clients, or equipment, coordinate resolution with appropriate DLA Technical Reps that support OS, hardware, etc. as required.

8. Provide ongoing training for Government personnel as requested in support of the existing ESS/EKC.

SP4702-24-Q-0009 Page 13 of 140

SP4702-24-Q-0009 Page 13 of 140

9. As a software upgrade becomes available, the Contractor shall develop a plan for the upgrade and present that plan to the COR for approval. The COR will present this plan to the J6 Technical Point of Contact (TPOC) for routing for J62 approval. Once approved, the Contractor shall execute their plan to install the upgrade(s) and return the ESS system(s) to an operational state.

10. The Contractor will be responsible for all IAT- II level version upgrades, patching, device enhancements, device replacements that reach end of life/support and for device replacements of hardware equipment that does not meet cyber standards/requirements including migrations required for ESS and EKC systems compliance.

The Contractor shall perform preventive maintenance service on all equipment which consists primarily of inspection, testing, cleaning, lubrication, adjustment, and calibration to verify proper system operation; minimize malfunction, breakdown, and deterioration of systems and equipment.

The Contractor shall perform PM services in accordance with the information specified in Appendix A - Equipment Listing.

All replacement parts, materials, environmental compliance, and Contractor personnel transportation used for PM shall be included in the contract unit price for PM services.

BATTERY MAINTENANCE

Battery voltage and charge levels will be checked as part of the maintenance visit. Any battery incapable of maintaining a 75% charge will be replaced immediately.

QUARTERLY COMPLETE SYSTEM TEST OF INTRUSION DETECTION SYSTEM (IDS)

All quarterly IDS testing shall be scheduled to be performed during normal working hours. All Restricted and Controlled Areas and duress alarms will be tested quarterly.

MONTHLY ARMS VAULT TEST OF THE INTRUSION DETECTION SYSTEM (IDS)

All monthly Arms Vault IDS testing shall be scheduled to be performed during normal working hours.

Preventative maintenance test of all ESS will be conducted annually.

SP4702-24-Q-0009 Page 14 of 140

SP4702-24-Q-0009 Page 14 of 140

Preventative maintenance of Morse Watchmans Keypro Touch will be in accordance with manufacturers requirements.

3. Maintenance The Contractor shall perform Preventive Maintenance (PM) services on all equipment which consists primarily of routine recurring inspection, testing, cleaning, lubrication, adjustment, and calibration to verify proper system operation to minimize malfunction, breakdown, and deterioration of systems and equipment.

The Contractor shall submit and maintain an up-to-date schedule with status for all PM tasks. Any modifications, changes, additions, or deletions shall be submitted to the COR for approval and once approved and implemented, documented in as-built drawings, and provided to the site.

D. Enterprise Configuration Management (ECM) The Contractor shall adopt DLA Enterprise Configuration Management (ECM) plans ensuring all hardware and software changes are approved by the J6 TPOC and coordinated with the COR. The Contractor shall use the DLA Business Capability Management (BCM) ServiceNow, Change Implementation Plans (CIPs), and provide technical expertise in Enterprise Change Requests (ECRs) that addresses product management and version control for software (changes) and hardware (changes). The Contractor shall support business processes documentation such as Scheduled Maintenance Requests and Information Technology Operations Center (ITOC) notice (INFOSPOT) and all other control items such as customer notifications. The Contractor shall evaluate all changes to the approved system requirements baseline for risk to security, and for schedule and cost impact, provide evaluations in writing and with sufficient detail to allow for review and approval by the configuration governance structure as required. CIPs and ECRs are normally required 21 business days in advance of required change.

E. Configuration Audit A configuration audit is an inventory of all existing hardware, software, data, drawings, devices, and technical documentation and is a function of Configuration Management. The Contractor shall perform an initial configuration audit and provide to the COR within ten (10) business days of performance start. Asset lists shall be provided upon request and include product details such as hosting location, model, versioning, product type, and other details about the product, software, hardware, or device. The Contractor shall report updates to asset list(s) within the monthly status reports. Additionally, a data dictionary is required.

The contractor shall:

1. Manage the site inventory of equipment and material spares using a Microsoft Excel spreadsheet for tracking purposes. The government will use this spreadsheet to monitor purchases, repairs, and disposals. The Contractor is responsible for coordinating with the DSCC Accountable Property Officer (APO) for inspection of property, components, replaced parts and material prior to disposal to determine suitability as potentially accountable property, and for coordinating this with the J6 TPOC. Items will not be disposed of without concurrence from the COR

SP4702-24-Q-0009 Page 15 of 140

SP4702-24-Q-0009 Page 15 of 140

2. Maintain the following categories on the Microsoft Excel spreadsheet.

a. Item configuration number

b. Item nomenclature (Common Name)

c. Current Item Quantity

d. Item low level (Lowest quantity allowable before ordering replacements)

e. Warranty expiration date

f. Date order placed.

g. Date order received (on-site)

3. The contractor shall NOT include any contractor consumables as part site inventory. Examples of contractor provided consumables are, electrical tape, cleaning rags, brushes, etc. Approved consumables for site inventory are cleaners, lubricants, fuses, lamps, etc.

4. Validate and maintain the inventory of security system hardware.

5. Validate and maintain an inventory of all system software, license information, versions, and system and security patches.

6. Keep, appropriately secured, copies of site-specific support documentation to include software license information, versions and patches, technical manuals, and design plans at the government facility.

7. Review and validate technical drawing as part of the configuration audit.

8. Validate the existence of technical manuals as part of preventive maintenance

9. Summarize actions taken to validate and update drawings and technical documentation as part of the contractor’s monthly status report to the government.

F. Schedule The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, and/or customer discomfort. Non-scheduled visits will be coordinated with the COR at least five (5) working days in advance and notify the COR if the work being performed may cause interference. Notification shall include the type of work to be done and the estimated completion date/time. The Contractor shall reschedule any work that the KO/COR deems necessary to avoid unacceptable disruptions in the Government's business.

SP4702-24-Q-0009 Page 16 of 140

SP4702-24-Q-0009 Page 16 of 140

The Contractor shall create, maintain, and submit project plan(s)/schedule(s). Initial plans and schedules are due within five (5) business days after award and will be updated monthly (on 1st Monday of month) until the final inspection is completed. The Contractor shall create, maintain, and submit project plan(s)/ schedule(s) 15 business days following a request for any upgrade, installation, or replacement of device(s) and or application(s). Microsoft Project is the preferred software/format for project plans/schedules.

Project plans/schedules shall include Task ID, Task Name, Actual Start, Actual Finish, Baseline Start, Baseline Finish, % complete, resource name/title, with the critical path defined utilizing predecessors and/or successors. The Government may return unacceptable plans and schedules for re-work, and the Contractor shall update and re-submit project plans and schedules within five (5) business days of request.

The Contractor shall coordinate a post award Kickoff meeting prior to the initiation of work and conduct monthly In Process Review (IPR) meetings. These meetings will be held with the Contractor, CPM, KO, Contract Specialist (KS), COR, and the J6 TPOC to discuss an overview of Contractor’s plans to manage scope, schedule, and resources. The Contractor will discuss stakeholders’ expectations, details of contract execution including incident management, triage support, technology road map plans including current and future software/hardware landscape general conditions, project schedule/plan, work schedules, coordination, security, safety, deliverables, permits, and other matters pertinent to work accomplishments shall be discussed in this meeting. Contractor shall attend other meetings as required in support of contract tasks.

G. Hours of Operation Regular working hours for DLA DSCC are 0730-1600 Monday through Friday. Maintenance and repairs will be performed during these hours unless coordinated with COR/TPOC.

Work under this order will be performed during normal working hours when practical. However, due to operational requirements, schedules, and the availability of required resources and/or downtime of those resources, overtime (OT) may be required. OT allowances are in accordance with the identified labor categories and estimated labor hours specified in the Government pricing model. Prior to OT hours being worked, the contractor shall obtain COR concurrence for the specific hours per labor category and applicable dates. Specifically, the contractor shall not exceed the estimated OT allowable hours as identified at time of task order award.

H. Federal Holidays The Contractor is normally not required to provide services on Federal holidays observed at DLA unless requested by the KO/COR. The following holidays are observed:

Observed Federal Holidays

New Year Day Martin Luther King Day Presidents Day Memorial Day Juneteenth Day Independence Day

SP4702-24-Q-0009 Page 17 of 140

SP4702-24-Q-0009 Page 17 of 140

Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

When one of the above holidays falls on Sunday, the following Monday will be observed as a legal holiday. When the federal holiday falls on a Saturday, the preceding Friday is observed as the holiday.

In the event an Executive Order issued by the President of the United States declares Agencies of the Federal Government closed for a regularly scheduled workday, the Contacting Officer (KO) or designee will determine and advise the Contractor on whether services are required for that day.

I. Records/Reports The Contractor shall maintain management, maintenance, repair records, and reports. All records and copies of reports shall be turned over to the COR within seven (7) calendar days prior to contract completion.

The Contractor shall maintain a separate set of redline drawings, elementary diagrams, and wiring diagrams of the system to be used for As-Built Drawings and shall keep this set accurately and neatly up to date with all changes and additions throughout the contract. All changes to or additions to security systems and equipment will be updated quarterly, with update pages provided to the COR. As-Built Drawings shall be developed and maintained by the Contractor and depict actual conditions. As-Built Drawings are to be submitted to the COR in 11X17 hard copy, original Auto Computer Aided Design (AutoCAD) and Adobe Portable Document Format (PDF) format and shall not be overlays.

J. Cybersecurity Requirements The Contractor shall provide cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following, as applicable, to specific task orders (most current version):

System Identification Reference Documents:

a. Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems, July 29, 2022

b. Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

c. Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

d. Federal Information Security Management Act (P.L. 107-347, Title III), December 2002

e. Department of Defense Instruction 5000.02, Operation of the Defense Acquisition System, January

23, 2020

f. Department of Defense Instruction 5200.39, Critical Program Information (CPI) Identification and

Protection within the Research, Development, Test, and Evaluation (RDT&E) Incorporating Change 3, Effective October 1, 2020

System Compliance, Instructions and Guidelines Reference Documents:

a. 44 U.S.C. § 3542, January 2012

SP4702-24-Q-0009 Page 18 of 140

SP4702-24-Q-0009 Page 18 of 140

b. Department of Defense Instruction 8500.01, Cybersecurity, Incorporating Change 1, Effective October

7, 2019

c. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD

Information Technology, July 19, 2022

d. Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to Achieve

Trusted Systems & Networks, Incorporating Change 3, October 15, 2018

e. DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework

(RMF) into the System Acquisition Lifecycle

f. Defense Acquisition Guidebook (DAG)

g. Department of Defense Directive 8140.01, Cyberspace Workforce Management, October 5, 2020

h. Department of Defense Instruction 8330.01, Interoperability of Information Technology (IT), Including

National Security Systems (NSS), September 27, 2022

System Cybersecurity Implementation Reference Documents:

a. Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense Acquisition System, July 9, 2004

b. National Institute of Standards and Technology Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security, February 2015

c. UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

d. United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems

Personnel Requirements Reference Documents:

a. Department of Defense DoD 8570.01-M, Information Assurance Workforce Improvement Program, change 3 dated 24 Jan 2012

b. DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management Program, dated 15 Feb 2023

FRCS Guidelines Reference Documents:

a. Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19 Mar 14, subject:

Real Property Related ICS Cybersecurity

b. Defense Logistics Agency Risk Management Framework Standard Operating Procedures, April 2021

c. Office of the Assistant Secretary of Defense Facility Related Control Systems (FRCS) Master List Memo, October 2020

d. Defense Logistics Agency Approved Cybersecurity Computing Environment List, October 2021

e. Department of Defense Control Systems Security Requirements Guide Version 1, Release 1, July 14,

2. The Contractor shall provide the following accreditation artifacts:

a. System Diagrams

SP4702-24-Q-0009 Page 19 of 140

SP4702-24-Q-0009 Page 19 of 140

Architecture Network Diagram

Authorization Boundary Diagram

Data Flow Diagram

Purdue Diagram

b. Comprehensive Hardware Inventory Report

c. Comprehensive Software Inventory Report

d. Concept of Operations (CONOPS)

e. Plan of Actions and Milestones (POAM)

f. Software Upgrade and Support Plan (SUSP)

g. Ports, Protocols, and Services Management (PPSM) Documentation for Registration

h. Federal Information Processing Standard 199 (FIPS-199) Cybersecurity Strength Requirements

i. PII Confidentiality Impact Level (PCIL) Categorization Worksheet

j. Enterprise Configuration Management Plan

k. Security Technical Implementation Guide (STIG) and Security Requirement Guides (SRG) Mitigations

1. Cybersecurity Strength Requirements The Contractor shall provide the following cybersecurity strength requirements including, but not limited to the following:

The Contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

SP4702-24-Q-0009 Page 20 of 140

SP4702-24-Q-0009 Page 20 of 140

The Contractor shall satisfy the Risk Management Framework (RMF) requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2002”.

The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

FIPS 199 / CNSSI 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA J6 PM, functional lead, and the Information System Security Manager (ISSM) and provide all required FIPS 199 documentation as requested to support security categorization.

The Contractor shall provide a recommendation on system categorization based on sound technical expertise in accordance with FIPS 199 then work in coordination with the prescribed DLA System Owner (SO) and ISSM to support the categorization IAW FIPS 199, CNSSI 1253 and OSD Facility Related Control Systems (FRCS) Master List including DLA specific systems, then document the results of the security categorization in the System DLA FIPS 199 document and the Concept of Operations (CONOPs).

Assigned DLA PM will coordinate with the Contractor to identify and document Confidentiality, Availability, Integrity (CIA) of the system in a DLA FIPS 199 document for approval by DLA ISSM personnel.

2. Completion Of System Hardening (Scan/Fix/Scan) Testing and Analysis The Contractor shall harden systems using a scan, fix, scan methodology remediating findings IAW current DOD, DLA, and Defense Information Systems Agency (DISA) standards. This includes automated and manual STIG application, Assured Compliance Assessment Solution (ACAS) scanning, and any other hardening efforts required to make the system ready to connect to a DOD network. Whenever findings occur, as required periodically, and/or following any major system change, the Contractor shall scan/fix/scan until all issues have been fixed and/or properly and acceptably mitigated. Any Critical or High impact level findings that cannot be fixed are to be reported to the J6 TPOC/ISSM immediately along with a valid reason the vulnerability cannot be fixed and a POAM. Once the Contractor has completed hardening efforts, system monitoring and audits shall occur to ensure STIG compliance is maintained.

3. Cybersecurity Assurance Requirements

The Contractor shall design, develop, and integrate cybersecurity solutions supporting the Department of Defense and all other applicable Government agencies.

This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), Assessment and Incorporate (A&I), or FRCS Assess Only Risk Assessment (FRCS AORA) decision, as well as obtaining an Authority to Connect (ATC) to DLA’s network. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official (AO).

SP4702-24-Q-0009 Page 21 of 140

SP4702-24-Q-0009 Page 21 of 140

Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

The solution shall comply with the security control requirements documented in National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a particular derived security requirement (mitigation to control compliance findings). This information shall be submitted in writing to the DLA J6 PM for cybersecurity approval as soon as the alternative is identified.

K. Application Network and Infrastructure All system/network components and applications shall be compatible with all applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal to the Government and approved by J6 Cybersecurity. Exceptions incurring risk found unacceptable to the DLA Authorizing Official are not permitted.

All network components and applications shall be IPv4 and IPv6 compatible.

Network components shall allow configuration of IEEE 802.1x or port security for authentication.

The Contractor shall provide a complete list of all ports, protocols and services required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

The Contractor shall identify any system wireless communication capability, enabled, or disabled. All wireless communications shall meet applicable STIG requirements to include FIPS 140-2 certification. Any requirement to use wireless or cellular must be approved in writing by DLA J6, coordinated with the J62B PM and documented with the DLA Frequency Manager.

L. Information and Operational Technology Infrastructure Requirements

In general, the DLA expects to furnish the IT Infrastructure to host the OT solution(s) and/or system(s) (including VLANs, and Virtual Machines (VMs)) unless there is a hardware, compatibility, or mission issue preventing it. As such, the Contractor must clearly identify “what” anticipated Government IT Infrastructure is required to host and operate the OT solution(s) and/or system(s) within the design documentation submitted for Government approval at time of award. These anticipated designs will be incorporated into the system CONOPs. The Contractor will be responsible for all installation, SP4702-24-Q-0009 Page 22 of 140

SP4702-24-Q-0009 Page 22 of 140 configuration, and deployment of the OT solution(s) and/or system(s) (including but not limited to) its subsystem(s), application(s), and patch cabling, if required.

Any requirement for the Contractor to provide their own IT Infrastructure, standalone server, or management workstation hardware due to compatibility issues must be documented in the Contractor’s proposal and approved by J6 prior to contract award. All Contractor provided IT Infrastructure must meet DoD STIG requirements. If the Contractor provides their own IT Infrastructure for the OT solution(s) and/or system(s), upon AO approval of the security authorization package (and prior to final OT solution(s) and/or system(s) acceptance or go-live), all Contractor provided IT Infrastructure will become the property of the Government.

All specialized software provided by the Contractor to the Government must have the applicable license key(s) as well as sales/transaction records, ownership control(s), manuals, technical publications, documentation, and any other information supporting ownership accompanying it. At the time of Contractor hand-off of Contractor owned IT Infrastructure to the Government, all design information for Enterprise Architecture (EA) for the “as built” OT solution(s) and/or system(s) will be provided. Any Contractor provided operating system (OS), software, and firmware throughout the duration of the contract will be upgraded by the Contractor prior to the Contractor’s end of mainstream support for the OS, software, or firmware.

DLA’s preference is for maximized virtual IT Infrastructure. As such, the Government will provide the virtual infrastructure to support deployment of Contractor supplied virtual servers or virtual appliance (OVA files). DLA will provide a virtual server up to the following:

CPU: 4

RAM: 16GB

Disk 1 (OS Drive): 100 GB

Disk 2 (Data Drive): 100 GB

Any requirements exceeding these specifications shall be submitted in writing and approved by the DLA J6 with supporting documentation prior to contract award.

Other PWS contractor content considerations as applicable:

1. Level 1-2 OT and Level FRCS Role-based authorization tools requirements and…