revised8_-_SOW_2_-_Certified_Large_Format_Printers.pdf

SP7000-16-R-1004 Page 1 of 6 Revised (8-26-16) Statement of Work 2 – NGEN/NMCI & ONENET Certified Large Format Printers

NGEN/ NMCI CERTIFIED LARGE (WIDE) FORMAT PRINTER PURCHASES FOR CUSTOMERS IN

CONTINENTAL U.S., ALASKA & HAWAII AND ONENET CERTIFIED LARGE (WIDE) FORMAT

PRINTER PURCHASES FOR CUSTOMERS IN GUAM

1. Large (Wide) Format Printers: Hardware used for printing documents in an office or business environment, often referred to as a Large Format Printers. This device must accept and output multiple formats including all major formats up to 2400 dpi — Printer must include a multi-roll system for both print and copy function —

Image preview on controller or built-in display unit. — Scan-to-file system must be CAC enabled and network compatible and operate within all DOD environments — Ability to retrieve scanned image files with integrated Windows compatible client software to network share directory — the software must be compatible with Windows 7, Windows 10 or current DOD operating systems. (Both PC and Mac compatible)

1.1 Specification for Large (Wide) Format Printers must meet or exceed the salient characteristics listed within this Statement of Work.

Printer 44”

Print:

• Print Speed Line drawings 28 sec/page on A1/D

• Print Resolution 2400 x 1200 optimized dpi

• Ink Types Cyan, Magenta, Yellow, Matte Black, Gray (if available)

• Handling Two automatic roll feeds; sheet feed; media output bin; automatic cutter

• Size 8.3 to 44-in wide sheets; 11 to 44-in rolls

• Thickness 0.5 mm (19.7 mil)

• Memory 256 MB, Hard Disk (if included): AES-256 encrypted, FIPS 140-2 Level 2 certified

• Connectivity CAC enabled (FIPS 140-2 Complaint) Interfaces (standard) Gigabit Ethernet (1000

Base-T), Hi-Speed USB 2.0 certified

• Print Languages Standard, Adobe PostScript 3, Adobe PDF, TIFF, JPEG, CALS G4

• Printing Paths Printer driver, USB

• Drivers (included) PostScript Windows and Mac OS X drivers with PostScript/PDF Kit. Compatible with

Universal Print Driver

• Scan & Copy PostScript Windows and Mac drivers Compatible

Scan & Copy:

• Scan Speed Color: Up 6 in/sec

• Optical Resolution 1200 dpi

• Maximum Scan Width 44 in

• Supported File Formats: PDF, TIFF, JPEG, CALS (B&W)

• Scan preview, scan to file, scan to HDD, scan to network folder, scan to print

• Media Handling: Straight-through scan paper path for sheet and cardboard originals

• Media Size: Up to 44 in wide

• Media Thickness: 1 mm (0.04 in)

• Scanner Memory: 1 GB memory

• Connectivity: Interfaces (standard) dual Gigabit Ethernet (1000Base-T), Hi-Speed USB 2.0 certified

SP7000-16-R-1004 Page 2 of 6

Printer 42”

Print:

• Print Speed Line drawings 16 sec/page on A1/D

• Print Resolution 2400 x 1200 optimized dpi

• Ink Types Cyan, Magenta, Yellow, Matte Black, Gray (if available)

• Handling Two automatic roll feeds; sheet feed; media output bin; automatic cutter

• Size 8.3 to 42-in wide sheets, 11 to 42-in rolls

• Thickness 0.4 mm (15.7 mil)

• Memory 256 MB, Hard Disk (if included): AES-256 encrypted, FIPS 140-2 Level 2 certified

• Connectivity CAC enabled (FIPS 140-2 Complaint) Interfaces Gigabit Ethernet (1000Base-T)

• Print Languages Standard, Adobe PostScript 3, Adobe PDF, TIFF, JPEG, CALS G4

• Printing Paths Printer driver, USB

• Drivers (included) PostScript Windows and Mac OS X drivers with PostScript/PDF Kit. Compatible with

Universal Print Driver

• Scan & Copy PostScript Windows and Mac drivers Compatible

Scan & Copy:

• Scan Speed Color: Up to 6 in/sec

• Optical Resolution 1200 dpi

• Maximum Scan Width 42 in

• Supported File Formats: PDF, TIFF, JPEG, CALS (B&W)

• Scan preview, scan to file, scan to HDD, scan to network folder, scan to print

• Media Handling: Straight-through scan paper path for sheet and cardboard originals

• Media Size: Up to 42 in wide

• Media Thickness: Up to 1 mm (0.04 in)

• Scanner Memory: 1 GB memory

• Connectivity CAC enabled (FIPS 140-2 Complaint) Interfaces(standard) High-Speed USB 2.0 certified host connector Gigabit Ethernet (1000Base-T)

Printer 36”

• Print Speed Line drawings 25 sec/page on A1/D

• Print Resolution 2400 x 1200 optimized dpi

• Ink Types Cyan, Magenta, Yellow, Matte Black, Gray (if available)

• Handling Two automatic roll feeds; sheet feed; media output bin; automatic cutter

• Scanner Straight-through scan paper path for sheet and cardboard originals

• Media Size 8.3 to 36-in wide sheets, 11 to 36-in rolls

• Thickness 0.5 mm (19.7 mil)

• Scan Speed Color: 2.5 in/sec

• Scan/Copy min resolution 600 dpi

• Memory 256 MB, Hard Disk (if included): AES-256 encrypted, FIPS 140-2 Level 2 certified

• Connectivity CAC enabled (FIPS 140-2 Complaint) Interfaces(standard) High-Speed USB 2.0 certified host connector Gigabit Ethernet (1000Base-T)

• Print Languages Standard, Adobe PostScript 3, Adobe PDF, TIFF, JPEG, CALS G4

• Printing Paths Printer driver, USB

• Drivers (included) PostScript Windows and Mac OS X drivers with PostScript/PDF Kit. Compatible with

Universal Print Driver

• Scan & Copy PostScript Windows and Mac drivers Compatible

SP7000-16-R-1004 Page 3 of 6

Power:

Input 110 volts alternating current, 50/60 Hz

Energy efficiency:

ENERGY STAR® qualified

Security (Network):

Must meet and stay current to the Department of Defense (DOD) operating systems through the term of contract.

Devices shall be configured in compliance with all applicable DoD Security Technical Implementation Guides (STIG) (Ref: http://iase.disa.mil/stigs). Any known deficiencies shall be identified to DLA Document Services prior to the Certification and Accreditation testing phase for evaluation of acceptance.

Provide up-to-date software and drivers to include, but not limited to: print drivers and web interface drivers.

All devices/components shall have the capability of turning on and off any nonessential ports and protocols.

All hard drives that are put into service within the Department of Defense will remain in the custody of DLA Document Services. All hard drives, whether internal, external, or otherwise, shall not be returned to the contractor.

Testing and Certification Process:

NGEN/ NMCI (CONUS, Hawaii, Alaska) & ONENET (Guam)

DLA Document Services will perform equipment testing, within available capabilities, in accordance with the guidelines and provision that have been outlined for each DOD agency. Devices that have not been approved by DLA Document Services will not be accepted to be placed on any network. The contractor shall deliver the proposed devices for each VB series to DLA Document Services HQ, Bldg 9, NSA Mechanicsburg, Mechanicsburg, PA 17055, for testing, at no cost to the government. Estimated time for testing is 20 business days. Testing and approval shall be performed by the DLA Document Services in coordination with the contractor’s assistance. The hardware will be required to pass the DOD standard NESSUS Vulnerability Scan. The Contractor shall provide at no additional cost, onsite engineering assistance and other support necessary to configure, setup, and test the equipment as needed.

DLA Document Services has agreements with the Air Force and the Marine Corp to test devices on their specific networks upon completion of our internal testing process. If all pass the testing process, DLA Document Services will submit a compliance memorandum to the Director of Contracting informing

SP7000-16-R-1004 Page 4 of 6 them that the devices have passed our preliminary testing process. Some additional procedures and testing will be required for devices to be placed on the Navy’s Next Generation Enterprise Network.

After completion of testing DLA Documents Services will submit the results to Space and Naval Warfare System Command (SPAWAR), PMW 205. PMW 205 will review the testing results and will conduct further device testing, evaluation and issue the Authorization to Operate (ATO) for inclusion on the Navy network. This is estimated to take 14-25 business days. If PMW 205 issues the ATO for the applicable Desktop Printers, the vendor will proceed with installation. DLA Document Services will exercise due diligence to mitigate and resolve any questions and/or concerns raised by PMW 205 during the certification review process. If PMW 205 does not certify applicable Desktop Printers for any reason, DLA Document Services will not proceed with installation at customer locations and DLA Document Services will terminate the contract for default. In the event that not all proposed Desktop Printers pass the testing, DLA Document Services reserves the decision to submit or not submit testing results to PMW 205 for certification review.

For all devices tested and placed on the DLA Document Services IDIQ contract, the vendor will collaborate with DLA Document Services to develop the testing results package. The vendor will develop the MFD Implementation Guide. The Implementation Guide will provide step-by-step instruction and screen shots to configure the Desktop Printers in accordance with the testing results.

Government acceptance of the Implementation Guide is at the discretion of the DLA Document Services EMS Branch.

This list is not inclusive of any future requirements and or changes by the DLA. The contractor will be required to perform operating system updates and patches IAW future DoD or DLA directives.

All contractor-provided software (including Operating System) must be supported by the contractor and the software’s original manufacturer at all times it is in use. If it becomes apparent that either the contractor or original manufacturer will no longer support any contractor-provided software, the contractor must provide and install other software in coordination with DLA Document Services that is still supported by the contractor and the software’s original manufacturer.

Devices shall be configured in compliance with all applicable DoD Security Technical Implementation Guides (STIG) (Ref: http://iase.disa.mil/stigs). Any known deficiencies shall be identified to DLA Document Services prior to the Certification and Accreditation testing phase for evaluation of acceptance.

Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/ ) and take appropriate actions if their equipment is subject to a known vulnerability. In addition, the customer will notify the contractor via DLA Document Services as security vulnerabilities are identified concerning all equipment installed on the DOD Information Network (DODIN) When vulnerabilities are identified by either the contractor or the customer, the contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM TASKORD 13-0670 unless a different time period is directed by USCYBERCOM via DLA Document Services. The TASKORD is For Official Use Only and is quoted below for reference:

3.B.1.D.2. (U//FOUO) Assured Compliance Assessment Solution (ACAS) assigns severity scored of critical , high, medium and low to plug-in findings.

3.B.1.D.2.A. (U//FOUO) Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks.

Actions to mitigate or remediate critical vulnerabilities should be initiated upon discover with the goal of mitigation/remediation within 7 days.

SP7000-16-R-1004 Page 5 of 6

3.B.1.D.2.B. (U//FOUO) Findings with a severity score of high should be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within 21 days of discovery.

3.B.1.D.2.C. (U//FOUO) Findings with severity scores of medium and low should be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

3.B.1.D.2.D. (U//FOUO) In all instances, DOD components should consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

In the event remediation cannot be achieved within the mandated timeline, a Plan of Actions and Milestones will be approved by the Customer's Authorizing Official or designee for risk acceptance.

Provide up-to-date software and drivers to include, but not limited to: print drivers and web interface drivers.

All devices/components shall have the capability of turning on and off any nonessential ports and protocols.

All hard drives that are put into service within the Department of Defense will remain in the custody of DLA Document Services. All hard drives, whether internal, external, or otherwise, shall not be returned to the contractor.

Multifuctional Devices must be ISO/IEC 15408 (Common Criteria) certified using the National Information Assurance Partnership (NIAP) approved criteria. To be technically acceptable all devices must meet the following two conditions:

NIAP CCEVS Validated Products List NIAP CCEVS Product Compliant List Common Criteria Portal Certified Products List

Are capable of obtaining accreditation through the NIST based RMF process. As part of this, the contractor agrees to provide all requested information and work in good faith with DLA Document Services so the DLA Document Services’ customer(s) can expeditiously obtain RMF accreditation. The contractor further agrees that should the proposed device(s), not obtain RMF accreditation, after 6 months the contractor shall remove the device(s) at no additional expense to the government to include, but not be limited to, waiving any and all early or premature discontinuance/termination/cancellation/etc./fees.

SMARTCARD: The contractor shall supply a SMARTCARD PKI Solution, which is compliant with DOD CAC and NIST FIPS 201 (PIV) standards. The contractor shall provide card readers at time of installation that are capable of reading and processing all approved CAC and PIV cards.

Secret Internet Protocol Router Network (SIPRNet) Token: The contractor shall supply a SMARTCARD PKI Solution with SIPRNet token capability, which is compliant with DoD requirements for PK-enabling and interoperability as set forth in DODI 8520.02/8520.03. The contractor shall provide card readers that are capable of reading and processing all approved SIPRNet token cards. Support Systems that incorporate the use of PKI for encryption of information in transit or at rest. Be compatible with 3.3 volt

SP7000-16-R-1004 Page 6 of 6

SafeNet SC650 token. Compatible with the 90Meter Middleware solution for CAC known as CAC Smart Card Manager-90.

All IA products must be NSTISSP #11 compliant

Warranty/Maintenance All purchased equipment shall include a 1 Year fix or replace manufacturer’s warranty.

Additional Year Warranty included as a separate CLIN.

Delivery of Equipment

Devices will be delivered to multiple locations on and off government installations as specified in each task order associated with this contract. Vendors will use the best commercial packaging and mode of shipping i.e. (Postal Services, Fedex, UPS) advantageous to the government, however it must be of traceable means. The Government requires delivery of devices to be made within 30 calendar days upon execution of each delivery order off the base contract of the IDIQ.