ATTACHMENT 1 - Revised Statment of Work 02.25.2020.pdf

Attachment 1 – STATEMENT OF WORK 1

STATEMENT OF WORK

SMALL-FORMAT COLOR REPRODUCTION EQUIPMENT

INDEFINITE DELIVERY / INDEFINITE QUANTITY (IDIQ) CONTRACT

INTRODUCTION-

DLA Data Production Operations seeks to enter into a single award Indefinite Delivery / Indefinite Quantity (IDIQ) contract for the purchase of Small-Format color reproduction equipment (“equipment”) and the following associated ongoing services:

- Delivery and Installation of the Equipment;

- Maintenance and Repair of the Equipment;

- Provision of Consumable Supplies (Excluding Paper) for the Operation of the

Equipment;

- Networking Functionality of the Equipment;

- Information Technology (IT) Security Accreditation and Technical Support for the

Equipment;

- Training on Using the Equipment; and

- Meetings, Reports and Administration Regarding the Equipment.

Equipment is to be delivered to and associated ongoing services provided at approximately 36 DLA Data Production Operations facilities located throughout the Contiguous United States, Alaska, Hawaii, the District of Columbia, Guam and Puerto Rico. (See Attachment 4 - Facility Locations.) The estimated placement quantity per band is as follows:

Band 60 15 Band 70 15 Band 80 25 Band 100 20

Total 75

The IDIQ will be for up to a 60 month ordering period. Delivery orders will be issued for the initial equipment purchases and associated ongoing services from date of installation, for a period not to exceed the end of the current fiscal year in which the Delivery orders were issued.

Subsequent task orders for associated services will then be issued annually upon expiration of the previous task order and the period of performance will match that of the Government’s fiscal

Attachment 1 – STATEMENT OF WORK

1.0 GENERAL INFORMATION

1.1 DLA Data Production Operations requires the equipment and associated ongoing services at approximately 36 locations throughout the Contiguous United States, Alaska, Hawaii, District of Columbia, Guam and Puerto Rico. DLA Data Production Operations locations are contained in Attachment 4 - Facility Locations. It is estimated, but not guaranteed, that DLA Data Production Operations will order approximately 75 devices over a 60 month timeframe and that approximately 10% of the devices will be ordered from date of award through the initial five (5) months, spread throughout the enterprise geographic detailed above.

1.2 Specific equipment capability requirements for usage bands 60, 70, 80, 100, are set forth at Attachment 2 - Equipment Specification Requirements, minimum features section. Offerors will complete Attachment 2 as part of their technical proposal, for the equipment being offered at each usage band level. (Attached Microsoft Excel document labeled Attachment 2. begin on the instructions tab). Additionally, offerors are so instructed of the possible equipment configurations that DLA Data Production Operations may require, and assemble through delivery orders, including those listed in Attachment 2 – Equipment Specification Requirements. All proposed devices must, at a minimum, contain the requirements listed in configuration #1 (Basic Configuration). Tandem connected units are NOT acceptable. Tandem connected units are defined as print engines housed in separate constructions connected to other printers to meet the page per minute requirements. Dual engines in a single footprint are acceptable provided all engines are housed within a single construction.

1.3 DLA Data Production Operations requires offerors to propose equipment for the following requirements: PC/Workstation, Document Software, and Controller/Print Engine (see Attachment 2 - Equipment Specification Requirements).

1.4 In order to support the processing of classified documents, the government also requires the proposal of an optional removable hard drive kit including two drives to allow for both Classified and Un-classified job processing. Both drives must be labeled with appropriate classification and only one will be in use at a given time. The specifications for the removable hard drive kit can be found on Attachment 2.

The offeror will be responsible for installation and any necessary configuration to ensure a complete printing solution.

1.5 DLA Data Production Operations requires offerors to propose document management software on Attachment 2. As part of a standardization effort within DLA Data Production Operations, this software will be the only software used for document manipulation. The contractor will be responsible for installation and any necessary configuration to ensure a completely functioning printing solution.

2.0 DELIVERY AND INSTALLATION

2.1 Within five (5) calendar days after receipt of a delivery order, the contractor shall conduct site surveys at each delivery location specified by the delivery order. The contractor shall provide a written analysis of the site survey which must include all of the following; space limitations of the location, electrical requirements to include exact specifications of power requirements and limitations, specification and placement of electric outlets and network connections. The survey shall also include environmental requirements (e.g. space, power) for PC/Workstation. The written survey shall be provided to the point of contact on each delivery order and the DLA Data Production Operations delegated POC on the contract within three (3) calendar days after survey is completed.

Delivery of vendor provided equipment will be contingent on a completed site survey.

2.2 The contractor shall install all equipment at the site specified within the time frames specified:

Delivery orders up to 5 devices will require installation within 30 calendar days from placement of the order. Delivery orders for 10 to 15 devices will require installation within 60 calendar days from placement of the order. Delivery orders in excess of 20 devices will require installation within 90 calendar days from placement of the order.

2.3 All awarded equipment will be setup for service calls (service contract(s) in place on all awarded devices) before delivery of any equipment. The service line (phone number) must be in place and verified prior to install.

3.0 MAINTENANCE AND REPAIRS

3.1 The contractor shall maintain at least 90% Monthly Uptime Availability (MUA) per machine which shall be calculated based upon the 21 standard Federal work days in a month and an eight hour day and excludes normal preventive maintenance time. MUA uses the following equation: (Uptime + Scheduled Maintenance)/ (Unscheduled Downtime + Uptime + Scheduled Maintenance) Refer to Section 8.0 Meetings, Reports and Administration, Para 8.2 for reporting requirements.

3.2 The contractor shall replace, at no cost to the government, any device that does not maintain at least a 90% MUA two (2) times in any 180 day period with an equivalent device as evaluated and approved by DLA Data Production Operations. Any replacement of a device must be accepted and approved via modification through the DLA Data Production Operations Contracting Officer.

3.3 The contractor shall provide 8:00 am-5:00 pm, local time, maintenance and repair coverage which includes six-hour service response for non-critical devices and four-hour service response for designated critical devices, for maintenance services including travel, parts, labor, software version upgrades (up to the hardware capability) and retrofits for all equipment including all components. A telephone call is not an acceptable service response. A service technician must call the primary operator within 30 minutes for critical devices and one-hour for standard devices to discuss the service problem and time of arrival. DLA Data Production Operations estimates 5 of the facilities will be designated as critical.

These sites will be designated on a monthly basis, with evaluation taking into account current workload and priorities. Publication of the critical list will be accomplished not later than COB of the 5th of each month and take effect the following month. The technician must be able to perform all aspects of maintenance and actively engage in resolving the report issue.

3.4 The contractor shall provide, when included on a task order, additional coverage under extended maintenance service hour options to include 5:00 pm to 12:00 am (midnight) and/or 12:00 am (midnight) to 8:00 am, Monday through Friday, local time. Additionally, a 48 hour weekend service repair coverage will be required on an ‘as needed’ basis, to cover all of Saturday and Sunday. This includes six-hour service response for non-critical devices and four-hour service response for designated critical devices, for maintenance services including travel, parts, labor, software version upgrades (up to the hardware capability) and retrofits for all equipment including all components. A telephone call shall not be deemed as an acceptable service response. A service technician must call the primary operator within 30 minutes to discuss the service problem and time of arrival. The technician must be able to perform all aspects of maintenance. All requirements for extended maintenance and repair coverage after normal business hours will be indicated on each order as needed, and will be requested, and are to be priced, in weekly or weekend increments. DLA Data Production Operations estimates this type of extended maintenance may be required for approximately 5 of the facilities, spread throughout the geographic covered in section 1.1.

3.5 The contractor must ensure all service technicians are eligible for access to Department of Defense facilities in accordance with the authority in Directive Type Memorandum (DTM 09-

012) which establishes DoD access control policy and the minimum DoD security standards for controlling entry to DoD installations and stand-alone facilities. Contractors must also check and follow installation access policies specific to each DoD installation. Technicians must be eligible at time of the award.

3.6 The contractor must obtain appropriate security clearances, up to “secret,” for its technicians who service equipment located in restricted-access facilities. DLA Data Production Operations will assist the contractor with this requirement. DLA Data Production Operations estimates that this requirement will apply to no more than 26 of 113 locations. The process to obtain a clearance will include filing a DLA form 1728, to be submitted to DLA HQ, for each contractor technician, in order to perform background verifications.

4.0 CONSUMABLE SUPPLIES

4.1 The contractor shall provide all consumable supplies necessary for device operation using an automatic replenishment system. A minimum of three (3) month supply of all consumable supplies will be provided for each device one to two weeks before time of equipment delivery and set-up. The contractor shall have the automatic replenishment system fully functioning within 90 days of the device installation.

4.1.1 The phrase “consumable supplies” means all supplies necessary for device operation including, but not limited to, toner, developer, fuser oil, replacement parts, etc.

Paper and staples are excluded from the definition of consumable supplies.

4.1.2 The phrase “automatic replenishment system” means a process where the contractor without prompting, orders or intervention of any sort from DLA Data Production Operations personnel– continuously delivers consumable supplies for each device at each location so that the equipment it delivers under this contracting action runs properly while maintaining or exceeding the MUA set forth at paragraph 3.1.

4.2 The contractor shall provide access to its vendor ordering system and/or a toll-free telephone number so that DLA Data Production Operations personnel can order consumable supplies without an additional fee should the automatic replenishment system fail.

(Providing this information for consumable supplies thereby does not excuse failure to meet the requirements in paragraph 4.1.)

4.3 The contractor shall reclaim expended toner cartridges, fuser modules, overflow containers and any other consumable items considered recyclable or hazardous to the environment and recycle and /or dispose of them in accordance with Executive Order 13693.

Prepaid mailing labels will be supplied by the contractor for reclamation.

4.4 The contractor will provide current and updated Material Safety Data Sheets on all consumable supplies it provides.

5.0 IT CONFIGURATION

5.1 All devices/components shall be maintained and kept current with DLA required and approved operating systems, with the exception of those devices operating as a true Multi-function device (controller and printer combined into one unit). DLA Data Production Operations requires offerors to propose as mandatory on all band levels a production print server (internal or external) that offers at a minimum the following capabilities :

• Must be capable of supporting multiple print queues

• Must offer a job transfer ability between print devices

• Must offer common job programming options such as booklet imposition, multiple up function, determining finishing options, specifying output location, preflight-soft proof preview, page exception programming, page insertion, job retrieval for reprint, print quantity and print quality adjustments.

The following is a list of the current print server operating system requirements:

• Microsoft Windows 10 or current DLA approved Operating System

• Microsoft Windows Server 2012 and 2016 or current DLA approved

Operating System

• Sun Solaris 11 or current DLA approved Operating System

This list is not inclusive of any future requirements and or changes by the DLA or CYBERCOM.

The contractor will be required to perform operating system updates and patches IAW future DoD or DLA directives at no additional cost to the government.

5.2 All contractor-provided software (including Operating System) must be supported by the contractor and the software’s original manufacturer at all times during its use by the government.

If it becomes apparent that either the contractor or original manufacturer will no longer support any contractor-provided software, the contractor must provide and install other software in coordination with delegated DLA Data Production Operations delegated POC that is still supported by the contractor and the software’s original manufacturer.

5.3 Contractor solution must be capable of functioning in a common security environment, given that DLA Data Production Operations is required to add additional software that is standardized within DLA Data Production Operations including but not limited to McAfee ePolicy Orchestrator (multiple modules including AntiVirus and Host Intrusion Prevention), Arcsight Logger, Active Client Software and Axway Desktop Validator.

5.4 All hard drives that are put into service at DLA Data Production Operations must remain in the custody of DLA Data Production Operations. All hard drives, whether internal, external, or otherwise, shall not be returned to the contractor.

5.5 All devices/components shall meet DoD information security specifications when interfacing with classified materials to ensure no remnants of the classified data exists after the classified process has been completed. Guidelines can be found at https://iase.disa.mil. The contractor shall indicate the specific steps needed to ensure classified data is never disclosed.

Any proposed process must include the use of removable hard drives and receive DLA Data Production Operations POC approval, which will occur during the certification and accreditation process.

5.6 All devices shall be configured in compliance with all applicable DoD Security Technical Implementation Guides (STIG) (Ref: http://iase.disa.mil/stigs). Any remaining deficiencies that cannot be resolved shall be identified to DLA Data Production Operations delegated POC prior to the Certification and Accreditation testing phase for evaluation of acceptance.

5.7 The equipment shall operate and coexist on a network that can support each of the following:

• Internet Protocol Version 4 (IPv4)

• Internet Protocol Version 6 (IPv6)

• Internet Protocol Version 4/6 Hybrid (IPv4/6)

5.8 All devices/components shall have the capability of turning on and off any ports and protocols.

5.9 As part of the installation process, the contractor will label all equipment, with the appropriate classification as defined by DLA Data Production Operations. DLA Data Production Operations will provide the appropriate instructions and labels.

5.10 DLA Data Production Operations will provide a configuration standard / settings document for each hardware model that the vendor shall utilize when installing hardware at a designated site. This configuration standard / settings document will be developed for each asset / model in conjunction with the vendor post-award at DLA Data Production Operations headquarters facilities in Mechanicsburg, Pennsylvania.

5.11 The use of USB flash drives is strictly prohibited at all DoD installations with all Data Production Operations locations included as well. In addition, non-government issued IT devices (e.g. phones, laptops, etc.) are prohibited from being used on DLA Data Production Operations equipment and network.

5.12 Section 508 Accessibility Standards - The user interface shall comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 Code of Federal Regulations (CFR) 1194. The standard 1194.21 (Software applications and operating systems) has been determined to be applicable to this contract.

6.0 IT CERTIFICATION & ACCREDITATION, INSTALLTION AND TECHNICAL

SUPPORT

6.1 After proposals are received and prior to award DLA Data Production Operations shall identify the specific pieces of equipment and software that require network testing, security accreditation, and approval. Within 21 calendar days of notification, the contractor shall deliver the identified equipment and software, at no cost or risk to the Government, to the DLA Data Production Operations production https://iase.disa.mil/ http://iase.disa.mil/stigs facility at Mechanicsburg, PA for testing of its compliance to the requirements set forth in the Statement of Work. The equipment must be free of vulnerabilities and be configured in a compliant manner with any known STIG deficiencies identified prior to the testing commencement for evaluation of acceptance. The DLA Data Production Operations Information Assurance Manager will determine the acceptance or rejection of any residual risk as part of the Certification and Accreditation process.

Testing will be performed for a maximum period of 75 calendar days. This testing will determine if the equipment meets all of the requirements of the Statement of Work, can function as delivered, and will develop a standard configuration that the contractor will use for all installations. All testing will be conducted by DLA Data Production Operations with the contractor’s assistance and prior to award.

Testing will include but is not limited to vulnerability scanning, port scanning and STIG compliancy checks. Upon notification of a discrepancy, the contractor will have 7 calendar days to provide corrective action. The contractor shall, at no additional cost, provide onsite engineering assistance and other support necessary to configure, setup, and test the equipment.

Delivery orders will be processed; however, until successful completion of the IT Certification and Accreditation phase as determined by DLA Data Production Operations, no actual equipment delivery shall be made until the contracting officer provides a notice to proceed.

6.2 Upon installation of each approved device, the contractor shall provide a minimum of two (2) hours of technical support to the on-site Information Technology personnel for each device installed.

6.3 The contractor shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/ ) and take appropriate actions if its equipment is subject to a known vulnerability. In addition, DLA Data Production Operations will notify the contractor as security vulnerabilities are identified concerning the installed equipment. When vulnerability is identified, the contractor shall provide patches within 30 calendar days unless a shorter time period is directed by DLA Data Production Operations delegated point of contact. The contractor shall provide the monthly Security Vulnerability Report per paragraph 8.5.

6.4 The contractor shall update all contractor supplied software with the following exception.

DLA J64 retains responsibility for patching all Microsoft Windows systems that can be updated via Microsoft SCCM. In the execution of contractor initiated software updates, coordination shall be made with the DLA Data Production Operations delegated POC named in the task order.

6.5 All purchased hardware shall be registered by the vendor under the “DLA” name for 3rd party technical support.

6.6 The contractor shall not have remote access to equipment unless authorized.

6.7 Provided workstation hardware will be imaged with a DLA standard image for both classified and unclassified systems.

http://nvd.nist.gov/

7.0 TRAINING REQUIREMENTS

7.1 As part of the training requirement each operator will be provided with hardcopy User Manuals which are concise, user friendly and provide specific steps and processes in all operational aspects in the use of the device and the accompanying peripherals, and software.

7.2 Within three (3) business days of installation of each device, the contractor shall provide a minimum of two consecutive eight (8)-hour days of onsite, hands-on training regarding the device and its software. This training must be accomplished in English by an individual having expert knowledge in all operational aspects of the device and software.

7.3 The contractor shall provide, under a separately priced CLIN, additional training sessions, as needed by the Government. Each training session will be comprised of two consecutive, 8-hour days sessions, teaching from approximately 2, up to 10 attendees. Situations where additional training may be ordered are if employees who have completed the minimum training required are not proficient in the operation of the devices, peripherals and software required to effectively operate the equipment, or where DLA Data Production Operations has new hires requiring such training. Sessions will be scheduled through a task order. The contractor shall provide the training within fifteen (15) business days of the date of the receipt of the task order.

This requirement will be spread throughout the enterprise geographic detailed in section 1.1 above. Estimated quantities are established in the price matrix of Attachment 3 – CLIN Structure.

8.0 MEETINGS, REPORTS AND ADMINISTRATION

8.1 The contractor shall prepare and submit an Installation Report that includes, at a minimum, the serial numbers for equipment and all hard drives, equipment make/model and location to include DLA Data Production Operations Office Group, installation, and building number as applicable. The report will be sent to the DLA Data Production Operations delegated POC named in the contract and to the Contracting Officer.

8.2 The contractor shall provide a single POC for administration of the contract and a single POC for service issues. The contractor shall prepare and deliver a monthly Availability Equipment Report via email to each Office Group Production Manager and DLA Data Production Operations delegated POC named in the Delivery/Task order. At a minimum the report shall contain the following for each device placed:

• Location

• Product Name

• Serial Number

• Units Produced

• Number Monthly of Service Calls

• Monthly Total Downtime

• Available Hours

• Percentage of Up-Time/Availability (MUA as defined in paragraph 3.1)

8.3 The contractors’ Administrative POC and the contractors’ Service POC shall attend, in person, a Quarterly Equipment Meeting with the DLA Data Production Operations delegated POC held at DLA Data Production Operations New Cumberland, PA, to discuss the report set forth in paragraph 8.2, above. The meeting discussion will be based on previous month(s) machine information.

8.4 The contractor shall provide the DLA Data Production Operations delegated POC with a monthly Training Completion Report for all DLA Data Production Operations personnel trained. The report must include the trainees’ names, location, date, and equipment make and model trained on. Each report will be sent to the DLA Data Production Operations POC responsible for that equipment location as indicated in the contract.

8.5 The monthly Security Vulnerability Report shall be provided by the contractor to the DLA Data Production Operations delegated POC. The report shall contain the location of all devices, product name, serial number, details of the security vulnerability and its status.

9.0 EQUIPMENT AND ACCESSORIES

9.1 During the period covered under this contract, should the Government and/or the contractor desire to substitute or upgrade equipment with technology improvements, all such actions shall be approved by the Contracting Officer prior to the contractor taking any action. If a substitution is needed the contractor must notify the Contracting Officer and a formal review process will be conducted. Substitutions will be provided at no cost to the government.

9.2 The contractor shall provide devices that are new or remanufactured as well as currently manufactured, and actively marketed. The terms “new” and “remanufactured” are defined at

FAR 52.211-5.

10.0 GOVERNMENT OWNED OR FURNISHED PROPERTY/EQUIPMENT

10.1 Government owned or furnished property/equipment will not be offered as part of this Request for Proposal (RFP) and resulting contract. Reliance, in whole or part, on any currently owned government equipment in fulfilling the requirements of this RFP, will result in a technically unacceptable proposal.

10.2 The Government will not provide administrative space for use by the contractor.

11.0 REMOVAL OF HARD DRIVES

11.1 As part of the contractor’s quoted price, DLA Data Production Operations requires the contractor to remove all hard drives from the controllers and print engines and turn the hard drives over to DLA Data Production Operations. The contractors shall then provide documentation to the DLA Data Production Operations delegated POC signed by the Contractor, attesting to the hard drive removal and receipt by DLA Data Production Operations . All hard drives will remain the possession of DLA Data Production Operations.

DCP0019

Cross-Out