SP7000-20-Q-1018 Attachment 2 - Statement of Work.pdf

Attachment 2 – Statement of Work

STATEMENT OF WORK

PRODUCTION CD/DVD/BLU-RAY DUPLICATOR EQUIPMENT

INDEFINITE DELIVERY / INDEFINITE QUANTITY (IDIQ) CONTRACT

INTRODUCTION-

Defense Logistics Agency (DLA) Data Production Operations seeks to enter into a multi award Indefinite Delivery / Indefinite Quantity (IDIQ) contract for the purchase of CD/DVD/BLU-RAY Duplicator (“equipment”) and the following associated ongoing services:

- Delivery and installation of the equipment;

- Warranties and repair of the equipment;

- Networking functionality of the equipment;

- Information Technology (IT) Security Accreditation and technical support for the equipment.

- Training on using/daily operations of the equipment, to include hardcopy User Manuals.

The IDIQ will be for a 60 month ordering period. Delivery orders will be issued for the initial equipment purchases and warranties from date of installation plus up to 60 months. The orders will be for a one year base and 4 one year options.

Equipment is to be delivered to and associated ongoing services provided at approximately 35 DLA Data Production Operations facilities located throughout the Contiguous United States, Alaska, Hawaii, District of Columbia, and Guam (See Attachment 5 - Facility Locations.) The estimated total ordered quantities are as follows:

4 Bay = 45 6 Bay = 15 12 Bay = 10 Total 70

GENERAL INFORMATION

1.0 DLA Data Production Operations requires the equipment and associated ongoing services at approximately 35 locations throughout the Contiguous United States, Alaska, Hawaii, District of Columbia and Guam. DLA Data Production Operations locations are contained in Attachment 5 - Facility Locations. It is estimated, but not guaranteed, that DLA Data Production Operations will order approximately 70 devices.

CD/DVD Blu-Ray Duplicator

1.1 Require a CD/DVD/BLU-RAY duplicator with Thermal Label Printer that can function in an automated process without interruption of the burning/labeling process. The system should have software capable of label creation for barcodes, it should have a minimum of 375 disk input/output capacity. The system must have the capability to produce two to three different CD/DVD requirements simultaneously.

This system should be flexible enough to perform jobs from CD to DVD to BLU-RAY on the fly without any hardware adjustments and capable to support dual layer. Any integrated controller or workstation must support Windows 10 or the latest approved DLA operating system.

1.2 Specific equipment capability requirements are set forth in Attachment 3 - Equipment Specification Requirements, minimum features section.

1.3 DLA Data Production Operations requires offerors to propose a CD/DVD/Blu-Ray duplicator to be used for processing CD/DVD/Blu-Ray data imagery jobs. The offeror will be responsible for installation and any necessary configuration to ensure a complete data processing and data burning solution for all above mentioned media. Service Option Next Business Day Onsite service for 5 years.

MAINTENANCE WARRANTY AND REPAIRS

2.0 Maintenances and repairs refer to five-year warranty (brand name or equal); the device must be registered with the manufacture for the extended maintenance/warranty as offered by the specific vendor/manufacturer.

2.1 Basic on-site repair service includes spare parts for verified hardware and software failures. Parts required or system replacement are provided with overnight shipment of required replacements. Service is performed by a technical support group through remote phone support.

IT CONFIGURATION

All devices/components shall be maintained and kept current with DLA required and approved operating systems and drivers.

3.1 All contractor-provided software (including Operating System drivers) must be supported by the contractor and the software’s original manufacturer at all times during its use by the government. If it becomes apparent that either the contractor or original manufacturer will no longer support any contractor-provided software, the contractor must provide and install other software in coordination with delegated DLA Point of Contact (POC) that is still supported by the contractor and the software’s original manufacturer.

3.2 Contractor solution must be capable of functioning in a common security environment,given that DLA Data Production Operations is required to add additional software that is standardized within DLA Data Production Operations including but not limited to McAfee Epolicy Orchestrator (multiple modules including AntiVirus and Host Intrusion Prevention), Arcsight Logger, Active Client Software and Axway Desktop Validator.

3.3 Any embedded OS included with the proposed equipment must have a DLA supported OS equivalent to the below (or the latest approved OS)

• Windows 10

• Server 2012 or 2016

• Solaris 11

3.4 All devices/components shall meet DoD information security specifications when interfacing with classified materials to ensure no remnants of the classified data exists after the classified process has been completed. Guidelines can be found at https://iase.disa.mil. The contractor shall indicate the specific steps needed to ensure classified data is never disclosed. Any proposed process must include the use of removable hard drives and receive delegated DLA POC approval, which will occur during the certification and accreditation process.

3.5 All devices shall be configured in compliance with all applicable DoD Security Technical Implementation Guides (STIG) (Ref: http://iase.disa.mil/stigs). Any remaining deficiencies that cannot be resolved shall be identified to DLA Data Production Operations delegated DLA POC prior to the Certification and Accreditation testing phase for evaluation of acceptance.

3.6 As part of the installation process, the contractor will label all equipment, with the appropriate classification as defined by DLA Data Production Operations. DLA Data Production Operations will provide the appropriate instructions and classified or unclassified labels.

3.7 DLA Data Production Operations will provide a configuration standard / settings document for each hardware model that the vendor shall utilize when installing hardware at a designated site. This https://iase.disa.mil/ http://iase.disa.mil/stigs configuration standard / settings document will be developed for each asset / model in conjunction with the vendor post-award at DLA Data Production Operation facilities in Mechanicsburg or New Cumberland, Pennsylvania.

3.8 Section 508 Accessibility Standards - The user interface shall comply with Section 508of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 Code of Federal Regulations (CFR) 1194. The standard 1194.21 (Software applications and operating systems) has been determined to be applicable to this contract.

IT CERTIFICATION & ACCREDITATION, INSTALLTION AND TECHNICAL

SUPPORT

4.0 Upon award DLA Data Production Operations shall identify the specific pieces of equipment and software that require network testing, security accreditation, and approval. Within 21 calendar days of notification, the contractor shall deliver the identified equipment and software, at no cost to the Government, to the DLA Data Production Operations production facility at Mechanicsburg, PAfor testing of its compliance to the requirements set forth in the Statement of Work. The equipment must be free of vulnerabilities and be configured in a compliant manner with any known STIG deficiencies identified prior to the testing commencement for evaluation of acceptance. The DLA Data Production Operations Information Assurance Manager will determine the acceptance or rejection of any residue risk as part of the Certification and Accreditation process.

4.1 Testing will be performed for a maximum period of 20 calendar days. This testing will determine if the equipment meets all of the requirements of the Statement of Work, can function as delivered, and will develop a standard configuration that the contractor will use for all installations. All testing will be conducted by DLA Data Production Operations with the contractor’s assistance and the acceptance of the award does not occur until testing has been completed.

4.2 Testing will include but is not limited to vulnerability scanning, port scanning and STIG compliancy checks. Upon notification of a discrepancy, the contractor will have 7 calendar days to provide corrective action. The contractor shall, at no additional cost, provide onsite engineering assistance and other support necessary to configure, setup, and test the equipment. Delivery orders will be processed; however, until successful completion of the IT Certification and Accreditation phase as determined by DLA Data Production Operations, no actual equipment delivery shall be made until the contracting officer provides a notice to proceed.

4.3 The contractor shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/ ) and take appropriate actions if its equipment is subject to a known vulnerability. In addition, DLA Data Production Operations will notify the contractor as security vulnerabilities are identified concerning the installed equipment. When vulnerability is identified, the contractor shallprovide patches within 30 calendar days unless a shorter time period is directed by DLA Data Production Operations delegated

DLA POC.

4.4 Contractor shall update all contractor supplied software with the following exception. DLA J64 retains responsibility for patching all Microsoft Windows systems that can be updated via Microsoft SCCM. In the execution of contractor initiated software updates, coordination shall be made with the DLA POC named in the delivery order.

4.5 All purchased hardware shall be registered by the vendor under the “DLA” name for3rd party technical support.

4.6 The contractor shall not have remote access to equipment unless authorized.

http://nvd.nist.gov/

TRAINING REQUIREMENTS

5.0 As part of the training requirement each operator will be provided with hardcopy User Manuals which are concise, user friendly and provide specific steps and processes in all operational aspects in the use of the device and the accompanying peripherals, and software.

EQUIPMENT AND ACCESSORIES

6.0 The contractor shall provide devices that are new and actively marketed. The terms “new” and “remanufactured” are defined at FAR 52.211-5.