Attachment_1_-_Performance_Work_Statement_(PWS).pdf

SP7000-19-Q-1084

PERFORMANCE WORK STATEMENT (PWS)

DLA INFORMATION OPERATIONS

DLA Information Operations EMS Division seeks to enter into a contract for up to 4 months of services and equipment associated with 27 Multi-Functional Devices (MFDs), accessories and copier machines (hereafter collectively referred to as devices) including installation and removal, full service maintenance, all consumable supplies (excluding paper), key operator training, reports, relocations, network functionality, and network security.

The geographic scope of this contracting action is OUTSIDE THE CONTIGUOUS UNITED STATES (OCONUS) and limited to a 50 mile radius and within the same country as shown below and on the delivery schedule.

Germany

1.0 GENERAL INFORMATION.

This is a firm fixed price commercial acquisition.

1.1 The contractor shall comply with all rules and regulations to obtain installation access in order to meet all response times stated in the PWS. The contractor shall comply with base access and vehicle registration requirements regarding contractor-owned and contractor employee privately owned vehicles as set forth in the base/command regulations. All vehicles, including those with passes or decals, are subject to random search at any time.

1.1.1 The contractor will subject its personnel to the Government's approval of access to all Government installations. The DLA Information Operations Point of Contact (hereby referenced as POC) along with the assigned Customer Relations Specialist (CRS) will coordinate with the commands’ points of contact to sponsor the contractor’s designated personnel on all Goverment installations for each specified base on the delivery schedule. All contractor employees must pass, at a minimum, a suitable local background check when being sponsored for access to the Government installation.

1.1.2 Any and all fees including the application process and or enrollement to access any installation or facility’s will be at the sole financial descretion of the contractor. DLA Information Operations will assist with Government sponsorship for services outlined in this PWS to help the vendor become compliant with security requirements.

1.2 All deliveries or services provided under this contract require a Customer Acceptance Form (Enclosure 1) be signed and dated by the DLA Information Operations’ customer.

1.2.1 Upon completion of any installations, deliveries, relocations, removals, maintenance services, or any support action, the contractor shall provide the receiving customer with the Customer Acceptance Form, for their signature as a means of consent by the receiving agency/command that the action was completed.

1.2.2 This Customer Acceptance Form will be signed to include the following: (1) Activity Name, (2) Model and Serial numbers; (3) date of installation and/or removal; (4) installation or removal locations (to include building numbers, room numbers, (5) Information Assurance Managers (IAMs) or their designated assignee’s name, phone numbers, email addresses and their validating signature confirming receipt of the devices status. This Customer Acceptance Form along with a customer signed packing slip/invoice for each device must be submitted to the POC within 10 calendar days of completing the install/removal.

D created/revised:

FY18-2 Dec 18, 2018

PWS FY18-2

1.3 Invoices will be submitted on a monthly basis via Wide Area Work flow (WAWF) on a spreadsheet with the serial numbers and locations of each device Invoices will be in United States Dollars. The first invoice will not be paid unless the Installation Report spreadsheet referenced in Paragraph 6.2 of the Performance Work Statement has been provided. No Invoice will be approved without a fully completed spreadsheet and the signed Customer Acceptance Form. There will be no interest penalty incurred by the government for delay of payment due to a vendor delay in providing the Installation Report.

1.4 The final invoice must include the Removal Report referenced in Paragraph 2.5 of this Performance Work Statement. Failure to provide the Removal Report will result in an invoice rejection. The government will not pay the final invoice until such time as the Removal Report has been furnished IAW Paragraph 2.5.

There will be no interest penalty incurred by the government for delay of payment due to a vendor delay in providing the Removal Report.

2.0 INSTALLATION & REMOVALS. The contractor shall:

2.1 Initial installations will be IAW the timeframes outlined in the chart below. Installation of additional devices can only be authorized by a Contracting Officer and will occur between months 1-48; with no new installations allowed during months 49-60. Regardless of installation date, all devices will maintain a co-terminus Period of Performance (PoP) and will end at the completion of the 60th month.

2.2 The Government requires delivery to be made according to the following schedule:

Amount of Devices Per Contracting Action

Maximum Number of Calendar Days to Complete Installation

Up to 100 30

101 – 200 45

201 – 500 60

More than 500 90

2.3 Provide a toll free telephone number(s) to place service maintenance calls and order consumable supplies.

The contractor shall affix its toll free telephone number(s) on each device placed on this contract, as well as the DLA Information Operations EMS sticker. (DLA Information Operations will provide the stickers). In addition, the contractor shall ensure each device has the manufacturer’s name, model number, and machine serial number legibly stamped or affixed to the device in a readily accessible location. The contractor shall provide English speaking personnel at the toll-free number(s) it provides in this paragraph.

2.4 Remove all devices and associated supplies from Government premises within thirty (30) calendar days of contract expiration or receipt of a valid removal order. In the case of termination/cancellation, a Modification signed by the KO shall be issued to remove the device and shall provide the contractor with an effective date, each device’s serial number, location, and local contact phone number. Devices not removed by the contractor within thirty (30) calendar days shall be deemed abandoned and subject to such disposal as the Government may deem appropriate at the contractor’s expense. Contractor is required to submit the Customer Acceptance Form after the removal of a device.

2.4.1 Upon termination or expiration of the contract, the hard drive and/or any component containing residual data, will be removed by the vendor/contractor and turned over to DLA Information Operations (or its designated assignee) and provide written verification to the designated DLA Information Operations POC. In all cases where the customer or DLA Information Operations requests to own the hard drive at the term of the contract and at time of removals, the contractor, as part of their quoted price, shall provide a replacement hard drive to ensure equipment is fully operational.

2.4.2 Government Owned Equipment, as part of the Contractors quoted price, when requested.

It will be the Contractor’s responsibility for removal and disposal of existing Government Owned Equipment which refers to those MFDs purchased and may require the removal and disposal from Government premises. As part of the Contractors quoted price; prior to removal, DLA Information Operations requires the Contractor to remove all hard drives from the controllers and print engines, turn the hard drives over to DLA Information Operations, and provide documentation to the DLA Information Operations POC signed by the Contractor and the local DLA Information Operations representative attesting to the hard drive removal and receipt by DLA Information Operations. All hard drives will remain the possession of DLA Information Operations. It will be the Contractor’s responsibility to remove and dispose of existing equipment. Offerors will have the opportunity to list the cost of removing the equipment when pricing the contract. Removal of existing equipment will be coordinated by the location POC named in the delivery order.

2.5 Provide a Vendor Removal Report to the DLA Information Operations POC within (10) calendar days after removal. The Removal Report must be provided in an excel spreadsheet format (version 2003 or newer) that provides the Purchase Order Number (PO#) along with the following: (1) date of installation; (2) date of removal

(3) serial numbers/ CLIN; (4) removal locations to include building numbers, room numbers, customer “POC” name, phone numbers, email addresses; and (5) copy of trucking company pick-up order/GBL.

3.0 TRAINING. The contractor shall:

3.1 Provide on-site training in English within three (3) business days after installation to end users. A training schedule shall be established prior to device delivery and shall be noted on the installation report. The training schedule shall show training dates and times. Special and remote areas shall be provided training at the new device’s location(s).

3.2 The contractor shall provide initial training upon installation of devices and any follow up training can be furnished via a quick reference desk guide in addition to a CD-ROM and/or online web-based training.

3.2.1 Quick reference guide shall be single sheet, 2 sided print, no larger than 8.5 X 11 paper size, laminated, full color and easily stowed away with the device.

4.0 MAINTENANCE (Including Operational Standards & Performance). The contractor shall:

4.1 Maintain each device at a minimum 95% monthly available rate based on the 21 standard federal work days in a month. Maintaining the devices includes, but is not limited to, preventive maintenance, repairs, troubleshooting, connectivity and maintenance as required, to correct hardware and software malfunctions within 10 business days, and to mitigate high risk findings identified by customers running DOD approved network scanning tool as well as all associated labor and travel.

4.2 Provide service technician support Monday through Friday from 8:00 a.m. – 4:30 p.m. local time, except varying Federal or local Holidays. The contractor shall provide a service technician who speaks English.

4.3 Respond to work stoppage situations within (4) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed as an acceptable service response. The service technician shall call the key operator within an hour to discuss service problem and time of arrival. It is estimated that 10% of service calls will be classified as “work stoppage” across the total device population on a yearly basis.

4.4 Respond to non-work stoppage situations within (8) business hours of a service call. A telephone call

(unless it results in solving the problem) shall not be deemed as an acceptable service response. The service technician shall call the key operator within an hour to discuss service problem and time of arrival.

4.5 In the case of devices cleared for CLASSIFIED material, the contractor’s repair technicians CONUS shall have a

Department of Defense (DOD) security clearance equal to or higher than the classification of the device will be escorted by government personnel with the apporpriate security clearance and will be able to provide verification when requested.

4.5.1 In the case of devices cleared for CLASSIFIED material OCONUS, the contractor’s foreign-national technicians will be escorted by government personnel with the appropriate security clearance and will be able to produce proper identification/credentials when requested.

4.6 Inform the designated DLA Information Operations POC within two (2) business days of the determination that device is non-repairable and provide comparable replacement device within three (3) business days from receipt of an order from the contracting officer.

5.0 CONSUMABLE SUPPLIES. The contractor shall:

5.1 Provide all consumable supplies (including staples) necessary for the operation of the devices. Paper is excluded as a consumable supply.

5.2 Deliver all required consumable supplies to the designated locations listed on the delivery schedule within two (2) business days after receipt of an order.

6.0 REPORTS. The contractor shall:

6.1 Provide to the designated DLA Information Operations POC a quarterly usage report in electronic (Microsoft compatible) format on the total and average monthly production volumes by serial number for all devices.

Quartery usage reports are due each December, March, June and September within 15 business days after 3 months of usage is completed. In addition, the DLA Information Operations POC may request adhoc usage reports by serial numbers.

6.2 Submit a device installation report to the designated DLA Information Operations POC within ten (10) calendar days after installation. Each installation report shall include an excel spreadsheet format (version 2003 or newer) that provides the Purchase Order Number (PO#) along with the following: (1) date of installation; (2) serial numbers/ CLIN; (3) delivery locations (to include building numbers, room numbers, DLA Information Operations’ customer names, phone numbers, email addresses); and (4) delivery report (packing slip or a separate spreadsheet) which clearly identifies the Contract Line Item Number(s) (CLINs) of the order.

6.3 Provide service history reports containing frequency of service calls, production volume between repairs, type of repairs, parts required, and device down time to the designated DLA Information Operations POC within 5 business days upon request for information.

6.4 Provide a summary of training report within 5 business days of training completion by serial number and listing personnel trained.

6.5 Maintain an accurate listing of all devices under contract (model, serial number, location) and provide to the designated DLA Information Operations POC with the monthly invoice. The contractor shall invoice in and be paid in U.S. Dollars.

6.6 The contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Defense Logistics Agency via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address:

http://www.ecmra.mil/.

Reporting input will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2014. Contractors may direct questions to the help desk at: http://www.ecmra.mil/.

7.0 EMS - MODEL SUBSTITUTIONS. The contractor shall:

After contract award and initial installation, provide model substitution in accordance with the appropriate Volume Bands that (1) meets or exceeds all the requirements set forth in this Performance Work Statement, AND (2) can be offered at unit prices that are equal to or less than those of the contractor’s quote or the current contract price, whichever is less.

7.1 Provide confirmation of model discontinuance due to equipment life cycles.

7.2 Verify the substitution.

7.3 Validate no-cost impact.

7.4 No model substitutions will be made without first receiving written approval by the contracting officer.

8.0 DEVICE RELOCATION. The contractor shall:

8.1 Provide relocations aggregating to an amount equal to the total number of devices under contract for each year of the contract. (For example, if there are 36 devices under contract then the contractor shall provide up to 36 relocations per year. This may mean relocating the same device 36 times, relocating 36 different devices once each, or any other combination thereof each year.) Relocations shall be limited to a 50 mile radius from where the devices to be moved are located and shall not require rigging or special handling.

Devices shall not be relocated without written approval from the designated DLA Information Operations POC and shall be completed within 30 calendar days after receipt of the approved request. Contractor is also required to submit the Customer Acceptance Form after the relocation.

Note: Device relocation shall include the following depending on the needs of the Government: breakdown and packing of equipment, shipping, uncrating, re-installation and key operator training.

9.0 DEVICES & CONFIGURATIONS. The contractor shall:

9.1 Provide devices for all Volume Bands (See Enclosure 2) that:

9.1.1 Are new or remanufactured as well as currently manufactured, and actively marketed. The terms “new” and “remanufactured” are defined at FAR 52.211-5.

9.1.2 Comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d), and the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards (36 CFR part 1194) as amended. See Enclosure (3).

9.1.3 Comply with the Health Insurance Portability and Accountability Act (HIPAA) when installed at government medical sites.

9.1.4 Upon delivery, at no additional cost above the bid price, have the following features and configurations included as standard options:

9.1.4.1 The MFDs shall, upon delivery of the device, be able to meet the capabilities and functions specified within this paragraph, to include all scan, all print, all fax, all copy, basic inline finishing functions. Printing is defined as digital printing or reproduction output to hardcopy from a digital-based image or electronic document file, created in various software programs, directly to a variety of media using ink, toner, inkjet, or other dye/pigment based imaging system. Printing functions means the ability to select various print settings such as single sided; double sided; enlargement/reduction; varying paper sizes and orientation; various image control and quality settings such as color, where applicable; gray scale, draft mode etc. For the purposes of this Performance Work Statement, Digital Printing does not include 3D printing. Faxing capability is defined as analogue fax only. Scan functions are defined as standard scanning and network scanning with full integration to standard network infrastructure destinations, which comprises Scan-to-Email, Scan-to-Folder, Scan-to-Network, Scan-to-Server and PC. Full integration does not mean scanning to proprietary back-end content or document management systems supporting customized indexing or metadata requirements. Scanned documents must be made available as a .TIF and as a .PDF file format. Copying is defined as reproduction output from hardcopy to hardcopy to a variety of media using ink, toner, inkjet, or other dye/pigment based imaging system. Copy functions mean the ability to use an onboard automatic document feeder and provide for the selection of various document output settings such as single sided, double sided, image enlargement/reduction, varying paper sizes and orientation, various image control and quality settings such as color, where applicable, gray scale, draft mode etc. Basic inline finishing functions are defined as document collation, document stapling, stapling, offset of finished sets, when requested, choice of more than one output tray.

9.1.4.2 Automatic Duplexing; Reversing Automatic Document Feeder with minimum 30 page document capacity.

9.1.4.3 Operate correctly and efficiently using at least 50% or greater recycled 20 lb paper.

9.1.4.4 Devices with hard drives must have an encryption or overwrite capable Security Kit.

9.1.4.5 The default setting for device operation will be, 2 sided printing, gray scale print and the default language setting shall be English.

9.1.4.6 Configure devices so the fax function is isolated from the network controller.

9.1.4.7 Configure devices Page Description Language (PDL) to support Adobe PS3, as well as

PCL5e or PCL6.

9.1.4.8 Provide up-to-date firmware, software and drivers to include, but not limited to: print drivers and web interface drivers.

9.1.4.9 Equipment must be capable of 230 volt 50 Hz AC electrical current. No transformers will be used as an exception.

9.1.4.10 Preset/default to “draft” quality printing rather than “high” quality.

9.1.4.11 Desktop and server operating systems currently supported by Microsoft.

9.1.4.12 Provide up-to-date software and drivers to include, but not limited to: 32-bit and 64 architecture driver support and web interface drivers.

9.1.4.13 In the case of MFDs, will be delivered with all USB ports disabled, except the port used to connect the device to a single computer or card reader, to prohibit the use of USB flash drives/thumb drives.

9.1.4.14 If File Transfer Protocol (FTP) services capability exists, the device must have secure FTP (SFTP) functionality available.

9.1.4.15 Have changing device settings so that the device moves to “sleep mode” at the end of the working day and on weekends.

9.1.4.16 Preset/default to toner efficient fonts. Fonts such as Century Gothic, Garamond or Times New Roman reduce toner costs over Arial.

9.1.4.17 Preset/default all MFDs to automatically go into sleep mode after 20 minutes of inactivity and automatically go into hibernation after an hour of inactivity.

9.1.4.18 Equipment must be capable of a “secure print” function using identification (ID) and password identification number (PIN) to retrieve documents from the device

9.2 Provide devices for Volume Band 0 that, in addition to what is set forth at paragraph 9.1; also have these features/capabilities/configurations.

9.2.1 Maximum Measurements: Width 25” x Depth 25” x Height 23” Desktop/tabletop device shall be small enough to fit on a desk or table comfortably without dominating the desktop/tabletop surface. Floor standing models are not acceptable.

9.2.2 Copy from/to multi-sized materials up to and including 8.5 x 14 paper.

9.2.3 Feeds from at least two (2) paper sources, one of which must be a bypass tray.

9.3 Provide devices for Volume Band 1 and 2 that, in addition to what is set forth at paragraph 9.1, also have these features/capabilities/configurations:

9.3.1 At least 1 Gigabyte of document management memory.

9.3.2 Multi-Position Stapler Finisher.

9.3.3 Floor standing with wheels (or cabinets provided as needed).

9.3.4 Copy from/to multi-sized materials up to and including 11 x 17 paper.

9.3.5 Feeds from at least two (2) adjustable paper trays 500 sheet minimum and (1) one bypass tray with

100 sheet minimum.

9.3.6 Preset/default output duplexing.

9.3.7 Preset/default output black and white printing on color devices.

9.4 Provide devices for Volume Band 3 that, in addition to what is set forth at paragraphs 9.1 and 9.3, also have these features/capabilities/configurations:

9.4.1 Feeds from at least four (4) adjustable paper trays 500 sheet minimum and (1) one bypass tray with

100 sheet minimum.

9.5 Provide devices for Volume Band 4 and 5 that, in addition to what is set forth at paragraphs 9.1 and 9.3, also have these features/capabilities/configurations:

9.5.1 Feeds from at least four (2) adjustable paper trays 500 sheet minimum (1) one bypass tray with 100 sheet minimum and a high capacity tray with a 2000 sheet minimum.

9.6 Provide an operator’s manual written in English with each device.

9.7 Only classified devices can be placed on the SIPRNET. Devices with hard drive shall be protected at the highest level of classified material produced.

Any one of the following conditions is acceptable for devices on Classified Networks:

9.7.1 Removable Hard Drive (a removable hard drive is a hard drive the operator may easily remove, and reinsert into the device on a reoccurring basis).

9.7.1.1 Any Volume Band that is used for classified processing in a physical environment NOT approved for Open Secret Storage will require a removable hard drive so they can be removed and locked in an approved container/room.

Provide devices that have a Removable Hard Drive.

Any Volume Band that has a hard drive readily accessible and easily removable requires that the MFD must have a mechanism to lock and prevent access to the hard drive.

Devices provided with hard drives shall have a lockable cabinet door to prevent access to the hard drive. In lieu of a locked cabinet, physical security measures must be in place and the drive cannot be easily removable. if drive is encrypted, or there is zeroization or other strong protection mechanism in place the requirement for a lock is not required.

Note: If the contracting officer has designated an assignee, the contractor’s written verification must include a validating signature from the designated assignee confirming receipt of the components.

10.0 NETWORK FUNCTIONALITY. For those devices that shall be connected to a DOD local area network, the contractor shall:

10.1 Provide devices capable of being configured to comply with the current Defense Information Systems Agency (DISA) Security Technical Implementation Guide (latest version and release), developed by DISA for the DOD.

URL for zip files of this DISA documents found at:

https://iasecontent.disa.mil/stigs/zip/U_Multifunction_Device_and_Network_Printers_V2R11_STIG.zip https://iasecontent.disa.mil/stigs/zip/U_Multifunction_Device_and_Network_Printers_V2R11_STIG.zip

Note: DOD policy prohibits the publishing of network configuration information, and therefore DOD installations are not required to fill out pre-installation site surveys. The required information will be provided at time of installation by the local IT support.

Contractor shall supply onsite support during installation. At time of installation, the end user IT department shall be present for collaboration.

10.2 Provide technical and system analysis support and appropriate network interface to successfully connect devices to DLA Information Operations’ customer networks.

10.3 Provide, upon installation a minimum of, two (2) hours of technical and analyst support to the agency network administrator onsite for each device installed. Support may be requested for the physical and software interface of the controller/device to the DLA Information Operations’ customer’s network. Support shall be provided for network configurations based on agency hardware/software.

11.0 NETWORK SECURITY. For those devices that shall be connected to a local area network, the contractor shall:

11.1 Warrant that the devices shall operate on and coexist on a network supporting any and all of the following:

Internet Protocol Version 4 (IPv4), Internet Protocol Version 6 (IPv6), A hybrid of IPv4 and IPv6.

11.2 Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their equipment is subject to a known vulnerability. In addition, the customer will notify the contractor via DLA Information Operations as security vulnerabilities are identified concerning all equipment installed on the DOD Information Network (DODIN) When vulnerabilities are identified by either the contractor or the customer, the contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM unless a different time period is directed by USCYBERCOM via DLA Information Operations. The TASKORD is For Official Use Only and is quoted below for reference:

Assured Compliance Assessment Solution (ACAS) assigns severity score of critical, high, medium and low to plug-in findings.

Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DOD Information Networks. Actions to mitigate or remediate critical vulnerabilities should be initiated upon discovery with the goal of mitigation/remediation within 7 days.

Findings with a severity score of high should be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within 21 days of discovery.

Findings with severity scores of medium and low should be addressed in accordance local Information

System Security Officer (ISSO) guidance until further notice.

https://www.us-cert.gov/ncas/alerts https://www.us-cert.gov/ncas/alerts http://oval.mitre.org/

In all instances, DOD components should consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

In the event remediation cannot be achieved within the mandated timeline, a Plan of Actions and Milestones will be approved by the Customer's Authorizing Official or designee for risk acceptance.

11.3 Additional Network Security Requirements. The contractor shall provide devices that

11.3.1 Are listed on either the NIAP CCEVS Product Compliant List (https://www.niap-ccevs.org/Product/) or Common Criteria Portal Certified Products List (http://www.commoncriteriaportal.org/products/)

11.3.2 The contractor shall supply an unclassified SMARTCARD PKI Solution, which is compliant with DODI

8520.02/8520.03, CNSSP-11 and NIST FIPS 201 (PIV) standards. The contractor shall provide card readers at time of installation that are capable of reading and processing all approved CAC and PIV cards.

11.3.3 The contractor must produce certificates of compliance if requested.

11.3.4 Equipment shall be capable of digitally signing emails using the senders DOD PKI Certificate(s).

11.3.5 Equipment shall be capable of encrypting emails using the receivers DOD PKI Certificate(s).

11.3.6 Equipment shall be capable to scan to file on networked devices.

CAC authentication is required for the following capabilities:

Scanning Printing

11.4 Configured for installation at U.S. Army Sites. The contractor shall provide devices that are configured for installation at U.S. Army sites in accordance with the following:

Office of the Secretary of the Army Memorandum, NETC-EST-IA, 1 Nov 05, Subject: Army Implementation of Two-Factor Network Authentication for User Accounts and Compliance with Homeland Security Presidential Directive-12 (HSPD-12) Army Regulation 25-2, Information Assurance, 23 March 2009, Chapter 4-5c(6) and Chapter 4-12a (http://armypubs.army.mil/epubs/pdf/r25_2.pdf) Army CIO/G6 Message, SAIS-ZA CIO/G, DTG 041939Z Feb 06, Subject: Army Accelerated Implementation of Common Access Card Cryptographic Network Logon, paragraph 2.

11.5 Testing

11.5.1 DLA Information Operations will perform equipment testing, within available capabilities, in accordance with the guidelines and provision that have been outlined for each DOD agency.

Devices that have not been approved by DLA Information Operations will not be accepted to be placed on any network. All devices that are submitted for bid must be tested for compliance with Network Security as defined in section 11.0, all paragraphs and subparagraphs, prior to installation if applicable. If vendors have provided previous models for testing through DLA Information Operations those models will not have to be resubmitted for testing. These testing procedures only https://www.niap-ccevs.org/Product/ http://www.commoncriteriaportal.org/products/ apply to new or refreshed models that have never been submitted for testing. The contractor shall deliver the proposed MFDs for each VB series to DLA Information Operations HQ, located at 5404 J Avenue BLDG 404 New Cumberland Pennsylvania 17070, for testing, at no cost to the government.

Estimated time for testing is 20 business days. Testing and approval shall be performed by the DLA Information Operations Equipment Management Solutions Department in conjunction with the contractor’s assistance. The Contractor shall provide at no additional cost, onsite engineering assistance and other support necessary to configure, setup, and test the equipment as needed.

11.5.2 DLA Information Operations has agreements with the Air Force and the Marine Corps to test devices on their specific networks upon completion of our internal testing process. If all MFDs pass the testing process, DLA Information Operations will submit a compliance memorandum to the Director of Contracting informing them that the devices have passed our preliminary testing process. Some additional procedures and testing will be required for devices to be compliant with other Department of Defense Networks. After completion of testing DLA Information Operations will submit the documentation/device to the appropriate testing facility, this is estimated to take 14-25 business days. Upon the completion of that additional testing, the vendor will proceed with installation. DLA Information Operations will exercise due diligence to mitigate and resolve any questions and/or concerns raised by that agency during the testing review process.

11.5.3 If the devices do not pass any of the proposed testing procedures for any reason and cannot provide a suitable replacement within 15 days, DLA Information Operations will not proceed with installation at customer locations and DLA Information Operations will terminate the contract for cause. In the event that not all proposed MFDs pass the testing, DLA Information Operations reserves the decision to submit or not submit testing results to the proposed agency for testing review.

11.5.4 For all devices tested and placed on the DLA Information Operations contract, the vendor will collaborate with DLA Information Operations to develop the testing results package. The vendor will develop the MFD Implementation Guide. The Implementation Guide will provide step-by-step instruction and screen shots to configure the MFDs in accordance with the testing results.

Government acceptance of the Implementation Guide is at the discretion of the DLA Information Operations Equipment Management Solutions Department.

11.5.5 Note: For current DOD instructions go to: http://www.dtic.mil/whs/directives/corres/ins1.html

12.0 CONTRACTOR PROGRAM MANAGEMENT. The contractor shall assign a single point of contact to coordinate with the POC in all aspects of this contract. Quotes shall state the assigned point of contact’s name, title, business address, phone number and email address.

http://www.dtic.mil/whs/directives/corres/ins1.html

Enclosure 1

PWS 18-2

CUSTOMER ACCEPTANCE FORM

Activity Name: Customer Address:

Customer POC Phone Number: Customer POC Email Address:

Contract Number:

NOTE: This document is required for all installations, relocations, maintenance services, deliveries and removals.

Use back for multiple installations or removals.

Device Manufacturer: Model #:

Serial Number: Training Date: (MM/DD/YYYY)

Service Date: (MM/DD/YYYY): Service Location (Room):

Installation Relocation Maintenance

Delivery of Supplies/Parts * Removal (IAM Signatures required)

Other (Describe here or on Back):

* IAM of Receipt of Hard Drive (Print Name): * IAM of Receipt of Hard Drive (Signature):

Contractor Technician Name (Print): Technician Signature:

Customer Accepting Receipt of device (Print): Must be the EMS

DLA Information Operations POC.

Customer Signature:

CLIN#: Model #: Serial Number: Service Location (Room):

Customer Acceptance Form

Customer Acceptance Form (continued)

CLIN#: Model #: Serial Number: Service Location (Room):

NOTE: This space below is for any action other than an installation, relocation, maintenance, delivery and/or removal.

Enclosure 2

VOLUME BANDS

The table below identifies the monthly capacity for each volume band, as well as the minimum speed ratings required for each band. The speed ratings apply to B&W and color output for Volume Bands 1-5 as outlined in each category.

CLIN

Volume

Band Description Quantities

VB-1

Low Volume Black and White or Color Devices:

Minimum 25 pages per minute B/W and a minimum 25 pages per minute Color. 600 DPI or greater with collating and staple finishing capabilities. (Applies to all volume band 1 requirements). Estimated maximum of 5,000 copies per month for B/W and 2,000 copies per month for color.

1A Black and White standalone device.

1A1 Black and White standalone device.

With Fax Capabilities.

1A2

Classified device capable of reproducing up to and including

1B Networked Black and White, Multi-Functional Device.

With full Fax, Scan, Copy and Print Capabilities.

1B1 Networked Black and White Multi-Functional Device.

(Print Only)

1B2

With (Fax) Capabilities.

1B3

With (Scan) Capabilities.

1B4 Networked Black and White Multi-Functional SIPRNET only.

Secret .

1B5

With full Fax, Scan, Copy, Print and Common Access Card (CAC) Capabilities.

1C Color standalone device.

1C1 Color standalone device.

1C2

1D Networked Color, Multi-Functional Device.

1D1

1D2

1D3

1D4 Networked Color, Multi-Functional Device SIPRNET Only.

1D5 Networked Color Multi-Functional Device.

1E Option for Short-Term Rental Devices: VB (target single VB) Not to exceed twelve (12) months per device.

VB-2

Mid Volume Black and White or Color Devices: Minimum 30 pages per minute or greater B/W and a minimum 30 pages per minute Color. 600 DPI or greater with collating and staple finishing capabilities. (Applies to all volume band 2 requirements).

Estimated maximum of 10,000 copies per month for B/W and 5,000 copies per month for color.

2A Black and White standalone device.

2A1

2A2

2B

2B1

2B2

2B3

2B4 Networked Black and White Multi-Functional SIPRNET only.

2B5

2C Color standalone device.

2C1

2C2

2D

2D1

2D2

2D3

2D4

2D5 Networked Color Multi-Functional Device.

2E Option for Short-Term Rental Devices: VB (target single VB) Not to exceed twelve (12) months per device.

VB-3

High Volume Black and White or Color Devices:

Minimum 40 pages per minute or greater B/W and a minimum 35 pages per minute Color. 600 DPI or greater. (Applies to all volume band 3 requirements). Estimated maximum of 20,000 copies per month for B/W and 10,000 copies per month for color.

3A Black and White standalone device.

3A1

3A2

3B

3B1

3B2

3B3

3B4

001 3B5 Networked Black and White Multi-Functional Device.

With full Fax, Scan, Copy, Print and Common Access Card (CAC) Capabilities.

3C Color standalone device.

3C1

3C2

3D

3D1

3D2

3D3

3D4

002 3D5

With full Fax, Scan, Copy, Print and Common Access Card (CAC)

VB-4

High-Volume High-Speed, Black and White or Color Devices: Minimum 50 pages per minute B/W and a minimum 40 pages per minute Color. 600 DPI or greater. (Applies to all volume band 4 B/W and all volume band 4 color requirements). Estimated maximum of 35,000 copies per month for B/W and estimated maximum of 20,000 copies per month for color.

4A Black and White standalone device.

4A1

4A2

4B

4B1

4B2

4B3

4B4

4B5

4C Color standalone device.

4C1

4C2

4D

4D1

4D2

4D3

4D4

4D5

VB-5

High-Volume High-Speed, Black and White Devices: Minimum 55 pages per minute with a maximum 70 pages per minute. 600 DPI or greater. (Applies to all volume band 5 requirements). Estimated maximum of 70,000 copies per month for B/W.

5A Black and White standalone device.

5A1

5A2

5B

5B1

5B2

5B3

5B4

5B5

TOTAL 27

Estimated total for Short Term Rental Devices.

Enclosure 3 508 Compliance Document

Government Product Accessibility Template for Multifunction Machines

Summary Column one includes all the Sections of the Standard that may apply to any deliverable. The total number of provisions within each Section of the Standard is shown in parentheses.

Column two identifies the total number of provisions that typically apply to a deliverable of this type. Some of these may not be features of the vendor’s deliverable. Conversely, others not noted may be features of the vendor’s deliverable. If the deliverable includes additional features, the accessibility of these features must also be considered.

Column three is for general notes about the Sections of the Standard. Some apply to all deliverables and some are specific to the deliverable.

Column four is a summary of the vendor’s response to applicable provisions and additional deliverable features from the Sections of the Standard.

Column five is where the vendor can note explanations for any of the preceding columns, e.g. there are differences between expected applicable provisions and actual product features.

NOTE: Provisions in Encl 2 are subject to change to reflect changes in laws, regs and may be amended upon notice to the contractor.

CFR 1194 Standard Sections

Total Number of Applicable Provisions

Notes

Total Number of Supported Provisions

Please explain

Fully Partial Not Section 1194.21 Software Applications and Operating Systems (12 provisions)

This Section applies if the multifunction machine is connected to a computer and has application software.

Section 1194.22 Web-based Internet and Intranet Information and Applications (16 provisions)

Section 1194.23 Telecommunications Products (14 provisions)

These four provisions apply to input devices such as integral parts of printers (keypads, touchscreens and contact sensitive controls) as referenced in 1194.25(c), Multifunction machines generally do not include telephones that can be used for voice communication.

Additional provisions from this Section would apply if the multifunction machine does include a telephone that can be used for voice communication.

Section 1194.24 Video and Multi-media Products (5 provisions)

Section 1194.25 Self- Contained, Closed Products (13 provisions)

Section 1194.26 Desktop and Portable Computers (4 provisions) 1

Multifunction machines do not typically have computer functions, but they often link to computers.

Section 1194.31 Functional Performance Criteria (6 provisions)

Functional performance criteria always apply.

Section 1194.41 Information, Documentation and Support (3 provisions)

If information, documentation, and support are to be provided by the vendor, then this Section applies.

Subpart B -- Technical Standards

Note: If there is a possibility that the provision applies, the default value is “Yes”.

Column one is the full text of the provision from the Standard.

Column two documents the agency’s accessibility requirement based on common characteristics of the EIT deliverable. Place a Yes or No in this column based on program need and actual characteristics of your expected deliverable (i.e., Is this provision seen as applicable to the expected deliverable?)

Column three provides explanatory information about the provision to help both the agency in determining applicability and the vendor in providing accessibility information.

Column four is for the vendor to check off whether the deliverable meets, partially meets or does not meet the specific provision.

Column five is for the vendor to provide an explanation of how the deliverable meets or does not meet the specific provision. It is also an opportunity to explain why a deliverable does not have an applicable feature or why it has a feature that was not identified as applicable.

Section 1194.21 Software applications and operating systems

Provision Text Applicable Notes How does the EIT meet this requirement?

Please explain

(a) When software is designed to run on a system that has a keyboard, product functions shall be executable from a keyboard where the function itself or the result of performing a function can be discerned textually.

Yes

This applies if the multifunction machine uses a QWERTY keyboard.

Fully

Partially

No

(b) Applications shall not disrupt or disable activated features of other products that are identified as accessibility features, where those features are developed and documented according to industry standards. Applications also shall not disrupt or disable activated features of any operating system that are identified as accessibility features where the application programming interface for those accessibility features has been documented by the manufacturer of the operating system and is available to the product developer.

Yes

(c) A well-defined on-screen indication of the current focus shall be provided that moves among interactive interface elements as the input focus changes. The focus shall be programmatically exposed so that Assistive Technology can track focus and focus changes.

(d) Sufficient information about a user interface element including the identity, operation and state of the element shall be available to Assistive Technology. When an image represents a program element, the information conveyed by the image must also be available in text.

(e) When bitmap images are used to identify controls, status indicators, or other programmatic elements, the meaning assigned to those images shall be consistent throughout an application's performance.

Yes

In this requirement, the term “bitmap” refers to a broad number of image formats, such as .bmp, .gif, .jpeg, .tif and .svg.

(f) Textual information shall be provided through operating system functions for displaying text. The minimum information that shall be made available is text content, text input caret location, and text attributes.

(g) Applications shall not override user selected contrast and color selections and other individual display attributes. Yes

(h) When animation is displayed, the information shall be displayable in at least one non-animated presentation mode at the option of the user.

Yes

Self-scrolling and moving texts are considered animation.

(i) Color coding shall not be used as the only means of conveying information, indicating an action, prompting a response, or distinguishing a visual element.

Yes

This requirement is also addressed in provision 1194.25(g).

(j) When a product permits a user to adjust color and contrast settings, a variety of color selections capable of producing a range of contrast levels shall be provided.

Yes

See www.lighthouse.org/color _contrast.htm

This requirement is also

1194.25(h).

(k) Software shall not use flashing or blinking text, objects, or other elements having a flash or blink frequency greater than 2 Hz and lower than 55 Hz.

Yes

Other elements include turning graphics on and off or changing between images.

This requirement is also addressed in provisions 1194.22(j) and 1194.25(i).

(l) When electronic forms are used, the form shall allow people using Assistive Technology to access the information, field elements, and functionality required for completion and submission of the form, including all directions and cues.

Yes

This requirement is also

1194.22(n).

http://www.lighthouse.org/color_contrast.htm

Section 1194.23 Telecommunications products

Provision Text Applicable Notes How does the EIT meet this requirement?

Please explain

(a)(1) Products which have mechanically operated controls or keys shall comply with the following:

Controls and Keys shall be tactilely discernible without activating the controls or keys.

(a)(2) Products which have mechanically operated controls or keys shall comply with the following:

Controls and Keys shall be operable with one hand and shall not require tight grasping, pinching, twisting of the wrist. The force required to activate controls and keys shall be 5 lbs. (22.2N) maximum.

(a)(3) Products which have keys shall comply with the following:

If key repeat is supported, the delay before repeat shall be adjustable to at least 2 seconds. Key repeat rate shall be adjustable to 2 seconds per character.

(a)(4) Products which have keys shall comply with the following:

The status of all locking or toggle controls or keys shall be visually discernible, and discernible either through touch or sound.

Section 1194.25 Self-contained, closed products

Provision Text Applicable Notes How does the EIT meet this requirement?

Please explain

(a) Self-contained products shall be usable by people with disabilities without requiring an end-user to attach Assistive Technology to the product. Personal headsets for private listening are not Assistive Technology.

(b) When a timed response is required, the user shall be alerted and given sufficient time to indicate more time is required. Yes

This requirement is also

1194.22(p).

(c) Where a product utilizes touchscreens or contact-sensitive controls, an input method shall be provided that complies with Section1194.23 (k) (1) through (4).

Yes

Many multifunction machines have either mechanically operated controls and/or touchscreens.

This requirement includes touchscreens and contact-sensitive controls that can be touched in any way; by the human body, a mouth stick, stylus, pencil, etc.

This requirement is addressed in provisions 1194.25(c), 1194.26(a), and 1194.26(b).

(d) When biometric forms of user identification or control are used, an alternative form of identification or activation, which does not require the user to possess particular biological characteristics, shall also be provided.

Yes

This requirement is also

1194.26(c).

(e) When products provide auditory output, the audio signal shall be provided at a standard signal level through an industry standard connector that will allow for private listening. The product must provide the ability to interrupt, pause, and restart the audio at any time.

Yes

This requirement applies, if auditory instructions are provided to the operator.

Auditory output includes audio voice output, not audible tones such as beeps.

(f) When products deliver voice output in a public area, incremental volume control shall be provided with output amplification up to a level of at least 65 dB. Where the ambient noise level of the environment is above 45 dB, a volume gain of at least 20 dB above the ambient level shall be user selectable. A function shall be provided to automatically reset the volume to the default level after every use.

Yes

This provision applies, if auditory output is provided through a speaker rather than a personal headset.

(g) Color coding shall not be used as the only means of conveying information, indicating an action, prompting a response, or distinguishing a visual element.

Yes

This requirement applies, if color is used in the display, touchpad or keypad. If the touchpad or keypad conforms to Section 1194.25(c) this requirement would not apply.

This requirement is also

1194.21(i).

(h) When a product permits a user to adjust color and contrast settings, a range of color selections capable of producing a variety of contrast levels shall be provided.

Yes

See www.lighthouse.org/color _contrast.htm

This requirement is also

1194.21(j).

(i) Products shall be designed to avoid causing the screen to flicker with a frequency greater than 2 Hz and lower than 55 Hz.

Yes

LED’s and…