Attachment 1 - P00007 Revised Performance Work Statement 05172024.pdf

DLA Information Operations Performance Work Statement (PWS) Version 23.3

I. OVERVIEW

A. The Defense Logistics Agency (DLA) seeks to enter into a contract for up to 60-month lease of SEVENTY-TWO (74) Multifunctional Devices (MFDs), accessories and office document devices (hereafter collectively referred to as “devices”) within CONTIGUOUS UNITED STATES (CONUS). This contract is in support of the U.S Navy Nuclear Power Training Unit (NPTU). Specific details are found in sections II and III.

B. The services associated with the leased devices sought are delivery and installation (section IV), end-user training (section V), full-service maintenance, including all consumable supplies (excluding paper)(section VI), relocation (section VII), technical refresh (section VIII), removal (section IX), reports (section X), network functionality (section XII), and network security (section XIII).

II. Security

A. Access to Classified and Sensitive Information

The provisions in this Section (§ II, Security) apply to the Contractor and to every entity(ies) it may employ to assist it perform the contract.

This Project is categorized as classified at the Secret level and requires the Contractor to obtain and maintain a favorable Facility Clearance (FCL) at the same or higher level of classification. This contract does not require the Contractor to store, handle, or process classified information at their facility.

The requirement for a secret FCL must be met by the Contractor. The FCL requirement is mandated by the National Industrial Security Program Operating Manual (NISPOM), codified at 32 C.F.R. § 117.10. NISPOM defines the FCL as “[a]n administrative determination that, from a security viewpoint, a company is eligible for access to classified information of a certain category (and all lower categories).” 32 C.F.R. § 117.3(b). Personnel security clearance (PCL) is defined as “[a]n administrative determination that an individual is eligible, from a security point of view, for access to classified information of the same or lower category as the level of the personnel clearance being granted.” Id. In addition, the NISPOM only allows a contractor to give an employee access to classified information at the same or lower level of classification that the contractor entity holds. 32 C.F.R. 117.10(a)(iii). The personnel security investigations conducted for access to classified information will be started by the contractor company Facility Security Officer (FSO).

NISPOM requires a government contracting agency--in this case DLA and its NPTU customer, not to provide a contractor’s employees access to classified [information] unless that contractor has the appropriate FCL for that level of classification.

There will be a phase-in period of up to 90-days provided to the awardee to permit time to meet the FCL requirement. The FCL must be approved as active (or interim) in order to be eligible to work on classified systems or devices installed under this contract at the Confidential Restricted Data (CRD).

Failure to submit minimum proof of an active or interim “Secret” FCL, and demonstrate the ability to obtain the Secret Clearance for contractor staff by the end of the 90-day phase-in period after

DLA Document Services PWS Version 23.3 award may result in the Contractor being deemed to be in default and, if so, the contract may be terminated for cause in-accordance-with FAR 52.212-4(m). The Government may then issue an award to the next lowest priced technically acceptable offeror; who will then be required to obtain an interim or active FCL within its up to 90-day phase-in-period. This process may be followed until a technically acceptable low offeror successfully obtains an interim or final FCL.

The following security access/performance requirements are required in performance of this contract: [map to Access/Performance requirements listed in Blocks 10/11 in DD Form 254]

Requirement Supported Contract Task Delivery Installation Task I.V. requires Contractor access to secured facility Training Task V. may require Contractor access to secured facility Removal Task I.X. requires Contractor access to secured facility Maintenance Task V.I. requires Contractor access to secured facility

For questions regarding the Facility Clearance Process please visit Facility Clearances (dcsa.mil)

B. Sensitive Information Access

Contractor personnel, who perform work on sensitive IT systems or applications will be required to obtain and maintain the appropriate investigation and adjudication or suitability determination commensurate with the information contained within the application or system. The Contractor shall assure that individuals assigned to this contract, as determined by the Government, have obtained the proper eligibility as required by DODI 5200.2. Note that sensitive information access does not imply or convey access to classified information. Instructions for access to classified information, if necessary, will be included on the DD Form 254 attached to the contract.

Tiered Investigation Standards

Position Low-Risk Moderate Risk High Risk

Confidential Secret Top Secret SCI

Position Sensitivity Non-Sensitive Non-Critical Sensitive Critical

Sensitive Special Sensitive

Investigation Tier 1/NACI Tier 3/NACLC/ANACI Tier 5/SSBI

Formerly Known As IT-III or IT-3 IT-II or IT-2 IT-I or IT-1

All contractor personnel, assigned to this project shall have attained a favorable outcome to the investigative requirement and be available to initiate work immediately after the phase-in period of the award.

In lieu of the correct investigations being completed when the Contractor’s employee(s) start, a waiver interim clearance may be submitted if no issues exist within the National Background Investigation https://www.dcsa.mil/Industrial-Security/Entity-Vetting-Facility-Clearances-FOCI/Facility-Clearances/

DLA Document Services PWS Version 23.3

Services (NBIS) Questionnaire (SF 85) for Non-Sensitive Positions or Questionnaire (SF 86) for National Security Positions. The Contractor shall have the NBIS form completed, with any other requirements (fingerprints taken and, if required, an OF306), and reviewed by DLA Intelligence before officially hiring any contractor employee into sensitive information access positions. Foreign Nationals are only eligible to perform non-sensitive duties and will not be investigated by the US Government.

The Government retains the right to request removal of contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. The reason for removal shall be documented in writing by the Contracting Officer. Current personnel security investigations conducted for access to classified information may satisfy investigation requirements for sensitive information access position.

Personnel security investigations for sensitive information access will be initiated by the DLA Personnel Security Office.

III. DEVICES AND CONFIGURATIONS

A. All devices shall meet the following requirements:

1. Devices shall be Trade Agreement Act (TAA) compliant and manufactured new (not rebuilt or remanufactured). New means composed of previously unused components, whether manufactured from virgin material, recovered material in the form of raw material, or materials and by-products generated from, and reused within, an original manufacturing process; provided that the supplies meet contract requirements, including but not limited to, performance, reliability, and life expectancy.

2. Simplex/duplex copying, printing, and scanning.

3. Automatic Document Feeder with a 30-page minimum capacity and duplexing.

4. Basic inline finishing functions which include stacking, collating, and multi-position stapling.

5. Operate using at least 30% recycled 20 lb. paper.

6. Free-standing with casters/wheels (or cabinets provided as needed). No devices shall be configured for table-top use.

7. Copy resolution of at least 600 x 600 dots per inch (DPI).

8. Print resolution of at least 1,200 x 1,200 DPI.

9. Support Microsoft Windows 10 or higher and MacOS 11 or higher desktop operating system and Microsoft Server 2012 or higher server operating systems.

10. A minimum of 1Gigabite (GB) of document management memory.

11. Print drivers shall be capable of Page Description Language (PDL) to support Adobe PS3, and PCL6.

12. Delivered with up-to-date software/firmware and drivers, with 32-bit and 64-bit architecture driver support. Provide all subsequent updates along with installation instructions to DLA.

13. Operate using standard U.S. office 120 volts (V)/60 hertz (Hz) 15 amps alternating current (AC) electrical current or U.S. office 120V/60Hz 20 amps AC electrical current. In the event the later (20 amps) is offered, the Contractor shall clearly identify these models in proposals and in all price lists. No external transformers shall be used as an exception. The contractor shall also identify the power plug type required.

14. Equipped with an external surge protector to protect all electronic components. The external surge protector shall be provided in addition to any internal surge protectors. External surge protectors shall

DLA Document Services PWS Version 23.3 have a minimum five (5) year manufacturer’s warranty that covers:

a. Replacement of the surge protector if it fails, at no cost to the Government.

b. Repair or replacement of any device provided through this PWS damaged by a power surge when properly connected to the Contractor-provided surge protector.

15. Include a printed or digital (via compact disc (CD) or download link) operator’s manual, in English, for each device.

16. Default to:

a. Automatically go into sleep mode after 20 minutes of inactivity

b. Automatically go into hibernation after an hour of inactivity.

c. Print duplex (2-sided).

d. Print in gray scale on both monochrome and color MFDs

e. “Draft” quality printing rather than “high” quality printing

f. Display all information in English.

B. Devices shall meet the following security requirements:

1. Devices with hard drives shall have an encryption or overwrite Security Kit.

a. Have an encryption security kit installed to prevent tampering. Upon delivery, the Contractor shall provide NPTU documentation stating the kits have been installed and the level of encryption it provides as well as the ability to physically verify that it is installed either by a license key or visual proof of an encryption board.

b. Requires an automated three pass overwrite of all data after each print job following the National Institute of Standards and Technology (NIST) 880-88 specification using a succession of multiple data overwrites.

c. Requires a disablement of non-volatile memory job storage option.

d. Requires the addition of a locking mechanism/port, like a Kensington lock or equivalent, to the formatter board containing the storage media to allow the installation by NPTU IT personnel of tamper resistant screws in the place of locally designed and applied security brackets/bolts to prevent access to the hard drive. Required tools or locks must be turn over to NPTU IT to control access to the storage media when maintenance needs to be performed. NPTU IT will also install a tamper proof seal on each MFD when deployed and will replace the tamper proof seal if work needs to be performed on the MFD where the seal must be removed. The hard drive will still need to be an encrypted hard drive that allows implementation of the current FIPS 140-2 standard. Installation of either device must be permitted by MFD manufacturer without voiding the warranty/support of the MFD/device.

e. One model of each device shall be delivered to NPTU three (3) weeks prior to delivery and installment of all

DLA Document Services PWS Version 23.3 devices. This is required so that a bracket can be designed to install on the new machines to allow the hard drives to be physically locked.

2. All Universal Serial Bus (USB) ports/memory card slots on the devices shall be disabled when delivered except: the printer port used to connect the device to a single computer;

Common Access Card (CAC) readers; and any USB ports needed for servicing/maintaining equipment. Additionally, unused ports, protocols and services on each device shall be able to be enabled/disabled by the local IT administrator.

3. All devices shall have a secure scanning functionality that complies with Federal Information Processing Standard (FIPS) 140-2 or 140-3 encryption with routing and full integration to standard network infrastructure destinations, which include: Scan-to-Email, Scan-to-Folder, Scan-to- Network, Scan-to-Server and Scan-to-PC. Scanned documents shall be made available as a TIFF, JPEG and as a PDF file format. The default scan resolution shall be 300 x 300 DPI. The default scan output file type shall be PDF. Devices shall have Optical Character Recognition (OCR) in order to process and produce text-searchable documents to the scan destination. Note: Full integration does not mean scanning to proprietary back-end content, document or records management systems to support customized indexing or metadata requirements.

a. Scan to network server is required. Network protocols FTP, TFTP and TELNET are not allowed.

Scanning function of device must support the incorporation of smartcards compliant with CAC and PIV standards and must support Active Directory/LDAP authentication via a UserID/password/PIN.

b. E-mail protocols and installed network protocols such as SMTP, Appletalk and IPX/SPX shall allow disablement via a Graphical User Interface GUI). Network protocols such as FTP, TFTP and TELNET, HTTP are not allowed. Wireless capability is not permitted unless there is an option to be completely disable wireless capability by an administrator.

c. 802.1x capability is required and shall support EAP-TLS protocol and shall support AES256- SHA256, AES256-SHA, AES128-SHA256 and AES128-SHA ciphers.

4. All devices shall have:

a. CAC/Personal Identity Verification (PIV) enablement in order to secure the device from unauthorized use and shall have a “Secure Print” feature that allows end-users to use authentication credentials (ex. ID, Login) and password identification (PIN) to release print jobs on the device. DOD Standards for CAC can be found in the following publications: Department of Defense Instruction (DODI) 8520.02, Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, and Federal Information Processing Standards (FIPS) 201.

b. Capability of integration with Print on-demand solution (e.g., equivalent to “Follow Me,” “Follow You,” “Push” or “Pull” printing) that shall allow end-users to release print output on any device on the network.

C. Contractors shall provide original equipment manufacturer (OEM) specification sheets, to include proposed configurations, for each device with proposal to the Contracting Officer.

IV. SPECIFICATIONS:

A. In addition to the features/capabilities/configurations set forth in section II (outlined above), the Contractor shall provide all devices in accordance with the chart below:

DLA Document Services PWS Version 23.3

Quantity Volume Band

Unclassified/ Classified

Estimated Monthly Impressions

Min. Speed (PPM) Paper Capacity

Mono Color Mono/Color

27 VB-1SM Classified 5,000 N/A 25 One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

4 VB-1SC Classified 3,000 2,000 25 One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

11 VB-2SM Classified 10,000 N/A 35 One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

3 VB-2SC Classified 5,000 5,000 35 One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

12 VB-3SM Classified 20,000 N/A 45 One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Four (4) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

5 VB-3SC Classified 10,000 10,000 45 One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Four (4) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

5 VB-4SM Classified 35,000 N/A 50

One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17" One (1) High-Capacity Tray [2,000 Sheet Minimum] - 8.5 x 11"

4 VB-4SC Classified 20,000 15,000 50

One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17" One (1) High-Capacity Tray [2,000 Sheet Minimum] - 8.5 x 11"

3 VB-5SM Classified 70,000 N/A 60

One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17" One (1) High-Capacity Tray [2,000 Sheet Minimum] - 8.5 x 11"

V. DELIVERY AND INSTALLATION

A. Delivery and Installation of Ordered Devices:

1. Delivery and Installation of ordered devices shall be in accordance with (IAW) the timeframes outlined in the chart below:

Amount of Devices Per Contracting Action

Maximum Number of Calendar Days to Complete Delivery and Installation

Up to 100 30 days after successful testing and installation of the locking mechanism on the test devices

101 - 200 45 days after successful testing and installation of the locking mechanism on the test devices

201 – 500 60 days after successful testing and installation of the locking mechanism on the test devices

More than 500 90 days after successful testing and installation of the locking mechanism on the test devices

2. Installation shall be defined as device is fully operational as ordered, to include network connectivity and scanning, if required. The Contractor shall provide onsite technical and system analyst support and appropriate digital cards/products to successfully connect devices to DLA customers’ networks.

3. Upon completion of device delivery, the Contractor shall obtain customer signature and date on each bill of lading (BOL) or packing slip (with serial numbers) and provide this proof of delivery to the designated DLA Point of Contact (DLA POC) within ten (10) business days after delivery. The Contractor shall also provide the Installation Report (Appendix #1) or a modified delivery schedule

DLA Document Services PWS Version 23.3 with serial numbers added to the designated DLA Point of Contact (DLA POC) within ten (10) business days after delivery and installation have been completed.

4. If a device cannot be delivered and installed within the delivery time that is given, the Contractor shall notify the issuing Contracting Officer as soon as the delay is realized, of the expected delivery date for the ordered device(s). Upon notification, the Contracting Officer may choose to cancel the order or request due consideration for the delay.

5. Regardless of installation date, all devices, including replacement devices, shall maintain a co-terminus Period of Performance (PoP).

6. Upon installation, the Contractor shall affix on each device a sticker with the following information:

manufacturer’s name, model number, device serial number and toll-free telephone number(s) to place service maintenance calls and order consumable supplies. Additionally, the Contractor shall add the PoP end date to DLA EMS sticker and affix to device. (DLA shall provide the DLA EMS stickers.)

7. The Contractor shall provide English-speaking personnel at the toll-free number(s) provided.

B. Options to Order Additional Quantities of Devices:

1. As options, the Contractor shall, at the same unit price, provide up to twenty percent (20%) more co-terminus leased devices than set forth at each CLIN of a delivery order; provided that DLA exercises and issues its options, if at all, prior to the end of the 24th month following the effective date of the contract.

VI. TRAINING

A. The Contractor shall provide either on-site or online training, in English, as specified in the contract, to end-users.

B. The Contractor shall coordinate directly with each command’s POC listed on the contract to establish the training schedule.

C. Training shall include the following:

1. How to operate the basic function keys of the device.

2. How to operate special features including duplexing, enlargements, reductions, and multiple job queues.

3. Diagnosis and resolution of basic device malfunctions, including paper jams.

4. Location and procedures for installing consumables such as paper, toner, staples, etc.

D. For on-site training, the Contractor shall submit a Summary of On-Site Training Report (Microsoft Excel format), listing device serial number, personnel trained, and date training was completed, to the designated DLA POC within five (5) business days of training completion. The initial invoice shall be rejected in Wide Area Work Workflow (WAWF) until a correctly submitted On-Site Training Report is submitted to the DLA POC.

E. For online training, the Contractor shall provide each POC listed on the delivery schedule with manufacturer-approved training that, at a minimum, covers all items listed in paragraph V.C. The link shall be accessible by DLA and its customers via http or https. The Contractor shall submit a Summary of Online Training Report (Microsoft Excel format), listing device serial number, personnel trained, email addresses training link was sent, and date training link was sent, to the designated DLA POC within five (5) business days of email to personnel. The initial invoice shall be rejected in Wide Area Work Workflow (WAWF) until a correctly submitted Online Training Report is submitted to the DLA

POC.

F. In addition to either on-site or online training, the Contractor shall provide a quick reference desk guide (single sheet, 8.5” x 11” paper size, laminated, full color and able to be easily stowed away with

DLA Document Services PWS Version 23.3 the device). The contractor shall also provide a CD-ROM/DVD and/or web-based training (URL printed on a sticker to be placed on the front of the device) to serve as follow-up training.

VII. MAINTENANCE

A. Service

1. The Contractor shall maintain each device at a minimum 95% monthly available rate. Based on a 40-hour work week, devices shall be fully functional for 38 out of 40 hours each week. Maintaining the devices includes:

a. Preventive maintenance

b. Service calls

c. Repairs

d. Troubleshooting

e. Connectivity

f. All associated labor and travel

2. If a malfunction cannot be corrected during the initial service call, the Contractor shall resolve all issues no later than ten (10) calendar days from date of initial service call.

3. The Contractor shall provide English speaking service technician support Monday through Friday from 8:00 a.m. – 4:30 p.m. local time, with the exception of the following Federal holidays:

a. New Year’s Day

b. Birthday of Martin Luther King, Jr.

c. Washington’s Birthday

d. Memorial Day

e. Juneteenth National Independence Day

f. Independence Day

g. Labor Day

h. Columbus Day

i. Veterans Day

j. Thanksgiving Day

k. Christmas Day

4. The Contractor shall respond to work stoppage situations within two (2) business hours of a service call. Work stoppage is defined as a required function of the device (printing, copying, scanning or faxing) is non-operational. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival. It is estimated that 10% of service calls shall be classified as “work stoppage” across the total device population on a yearly basis.

DLA Document Services PWS Version 23.3

5. The Contractor shall respond to non-work stoppage situations within four (4) business hours of a service call. Non-Work stoppage is defined as a required function of the device (printing, copying, scanning or faxing) is degraded. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival.

6. All devices installed are used for Confidential Restricted Data (CRD). Contractor’s service/support technicians shall be a US citizen and have an active Department of Defense (DOD) security clearance equal to or higher than Secret (DoD Directive 5210.2 para 1.C.2). NNPTC/NNPTU needs networked devices that operate on the NNPP network and can use CAC.

7. The Contractor shall be responsible for all damages due to normal wear and tear and loss or damage caused by the Contractor or its agents.

8. If a device is determined to be non-repairable, to include damaged devices, the Contractor shall inform the designated DLA POC within two (2) business days of making this determination. The Contractor shall deliver and install a comparable replacement device within fifteen (15) calendar days from written notification from the Contracting Officer.

B. Consumable Supplies

1. The Contractor shall provide all consumable supplies (including staples) necessary for the operation of the devices. Paper is excluded as a consumable supply.

2. The Contractor shall deliver all consumable supplies to the designated locations listed on the delivery schedule identified on the contract, within three (3) business days after receipt of a request for supplies.

VIII. DEVICE RELOCATION

A. For device relocations, the Contractor shall:

1. Provide device relocation services, within a 50-mile radius, for 100% of the total number of devices ordered, for each year of the specified period of performance. (For example, if there are 100 devices ordered, the Contractor shall provide relocations for up to 100 devices per year. This could be relocating the same device 100 times, relocating 100 different devices one time each or any other combination thereof each year.) Devices shall not be relocated without written approval from the designated DLA POC and shall be completed within thirty (30) calendar days after receipt of the written request.

2. Include the following: Breakdown and packing of equipment, shipping, uncrating, re-installation and end-user training.

3. Be responsible for any and all repairs that may be required following any relocation performed.

4. Upon completion, obtain customer signature on the Removal/Relocation Report contained within Appendix #2 and the MFD Hard Drive Removal Record (Appendix #3) if applicable.

IX. TECHNICAL REFRESH

A. In the event the Contractor is no longer able to provide the products proposed, the Contractor may, only after written approval by the Contracting Officer, remove the products from the contract and provide replacement products which shall meet or exceed the Volume Band requirements as listed in this PWS, at the contract price.

1. Replacement devices shall be newer technology than the models they are replacing. If the Contractor submits new models for testing, the devices shall be “in production” and not near “end of life.”

DLA Document Services PWS Version 23.3

2. Prior to delivery, if replacement devices have not been previously tested by DLA, they shall be tested as outlined in section XIV.

X. DEVICE REMOVAL

A. For device removal, the Contractor shall:

1. Remove all devices and associated supplies within thirty (30) calendar days of contract expiration or receipt of a modification signed by the Contracting Officer. Upon device removal, the Contractor shall complete the Removal/Relocation Report (Appendix #2), to include the date of the removal and Customer signature and submit this report to the DLA POC and Contracting Officer within five

(5) business days of device removal. ALL classification stickers shall be removed prior to device removal/disposal.

2. Notify the issuing Contracting Officer as soon as any delay in device removal is realized.

3. Upon completion of the hard drive removal, the Contractor shall obtain the required signatures on the MFD Hard Drive Removal Record (Appendix #3) and submit this report the DLA POC and Contracting Officer within five (5) business days of hard drive removal.

4. The Government reserves the right to withhold final payment if all devices are not removed from the premises within thirty (30) calendar days of contract expiration or termination.

5. 5. Be subject to payment of all disposal fees incurred by the Government for any devices not removed within thirty (30) calendar days of termination or expiration. After this time period, the devices will be considered abandoned.

XI. REPORTS

A. The Contractor shall provide the following reports:

1. Installation Report, as referenced in section IV.A.3.

2. Summary of On-Site Training Report and/or Summary of Online Training Report, as referenced in section V.D/E.

3. Device Listing Report (Microsoft Excel format) shall be submitted via Wide Area Work Flow (WAWF) to the DLA POC with the monthly invoice. The report shall contain an accurate listing of all devices under contract (model, serial number, location).

4. Removal/Relocation Report, as applicable, as referenced in section VII.A.4 and IX.A.3.

B. Upon request, the Contractor shall provide the following reports within 5 business days, at no cost to the Government:

1. Usage Report (Appendix #4) shall be submitted to the DLA POC.

2. Response Time Report shall be submitted to the DLA POC and the Contracting Officer. This report shall identify the technician’s response time, defined as the time between when the service call is placed and when the technician arrives onsite to repair the equipment. If the issue is able to be resolved on the phone, the response time shall be defined as the time the service call was placed and when the issue was resolved over the phone.

3. Device Downtime Report shall be submitted to the DLA POC. This report shall identify the time the equipment was inoperable/non-functional. Downtime is defined as the time the service call is placed notifying the Contractor’s representative that the equipment is inoperable/non-functional or when the technician begins service on the equipment if the device is operable/functional upon arrival. In addition, the report shall include information relative to the frequency of service calls, production volume between service calls, types of repairs, as well as parts required.

DLA Document Services PWS Version 23.3

4. Device Uptime Report shall be submitted to the DLA POC and the Contracting Officer. This report shall identify the time the equipment was operable and available and will be used to verify the required minimum 95% monthly available rate, as outlined in section VI.A.1.

XII. INVOICING

A. All invoices shall be submitted with the Device Listing Report via Wide Area Work Flow (WAWF) and shall be submitted in United States Dollars. The following website provides additional information regarding WAWF including information for “vendors getting started” with the system:

https://wawf.eb.mil/xhtml/unauth/help/help.xhtml.

B. For devices that are relocated or removed, invoices shall include the Removal/Relocation Report

(Appendix #2) and the Hard Drive Removal Record (Appendix #3) and the BOL. Invoices submitted without the applicable reports shall not be paid.

XIII. NETWORK FUNCTIONALITY

A. DoD policy prohibits the publication of network configuration information; therefore, DoD installations shall not fill out pre-installation site surveys. The required information shall be provided at time of installation.

B. The Contractor shall provide devices that shall operate on and coexist on a network supporting all of the following:

1. Internet Protocol Version 4 (IPv4),

2. Internet Protocol Version 6 (IPv6),

3. A hybrid of IPv4 and IPv6.

C. Support shall be provided for network configurations based on agency hardware/software.

XIV. NETWORK SECURITY

A. The Contractor shall provide devices that can be configured to comply with the current Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) titled Multifunction Device and Network Printer STIG (latest version and release), available at:

https://cyber.mil/.

B. All devices shall support Simple Network Management Protocol (SNMP) version 3 (v3). Versions 1 and 2 (SNMPv1/SNMPv2) shall be disabled.

C. All hard drives that are put into service within Federal agencies shall remain in their custody. In the instance where a device is removed by the Contractor, all hard drives, whether internal, external, or otherwise, shall remain in possession of the Government and not be removed with the device.

D. Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their equipment is subject to a known vulnerability. When vulnerabilities are identified by the Contractor, DLA or its customers, the Contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM TASKORD regulations unless a different time period is directed by USCYBERCOM via DLA. The TASKORD is For Official Use Only. The following is authorized to be quoted from the TASKORD for reference:

1. Assured Compliance Assessment Solution (ACAS) assigns severity scores of critical, high, medium and low to plug-in findings.

https://wawf.eb.mil/xhtml/unauth/help/help.xhtml https://cyber.mil/ http://nvd.nist.gov/ https://www.us-cert.gov/ncas/alerts http://oval.mitre.org/

DLA Document Services PWS Version 23.3

a. Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities shall be initiated upon discover with the goal of mitigation/remediation within seven (7) calendar days.

b. Findings with a severity score of high shall be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within twenty-one (21) calendar days of discovery.

c. Findings with severity scores of medium and low shall be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

d. In all instances, DoD components shall consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

E. In the event remediation cannot be achieved within the mandated timeline, the Contractor shall provide a Plan of Action and Milestones and receive approval thereof by the Customer’s agency Authorizing Official or designee for risk acceptance.

F. All devices shall be International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15408 (Common Criteria) certified IAW CNSSP-11 using the National Information Assurance Partnership (NIAP) approved criteria or equivalent.

1. A device shall be acceptable if it is included on either the NIAP CCEVS Product Compliant List (https://www.niap-ccevs.org/Product/) or Common Criteria Portal Certified Products list (http://www.commoncriteriaportal.org/products/).

2. All devices shall have current ISO/IEC 15408 certification and recertification, if applicable, before the Contractor can schedule lab time. See section XIV. Guidance for Common Criteria Maintenance and Reevaluation is available at: https://www.niap-ccevs.org/documents_and_guidance/ccevs/scheme-pub-6.pdf

G. All devices shall be capable of obtaining accreditation through the Risk Management Framework (RMF) for DoD Information Technology (IT). As part of this, the Contractor agrees to provide all requested information and work in good faith with DLA so the DLA customers can expeditiously obtain RMF accreditation prior to device delivery and installation. The Contractor shall also provide devices for vulnerability and STIG testing to DLA or customer’s site. The Contractor further agrees that if the proposed device(s) does not obtain RMF accreditation, the contractor shall remove the device(s).

Information regarding RMF is found in Risk Management Framework (RMF) for DoD Information Technology (IT) Instruction 8510.1 dated 12 March 2014:

http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. In order to maintain RMF and STIG compliance, devices are required to be delivered with the most up-to-date firmware, as outlined in section II.A.12.

H. The Contractor shall supply a SMARTCARD Public Key Infrastructure (PKI) Solution which is compliant with DODI 8520.03 and NIST FIPS 201 (PIV) standards. The contractor shall provide card readers that shall read and process all approved CAC and PIV cards. The Contractor shall maintain compliance with DoD-wide SMARTCARD and DoD PKI standards and support all approved physical cards during the full lease period.

I. The Contractor shall ensure that CAC authentication is available for scanning, printing and copying and shall be:

https://www.niap-ccevs.org/Product/ http://www.commoncriteriaportal.org/products/ https://www.niap-ccevs.org/documents_and_guidance/ccevs/scheme-pub-6.pdf https://www.niap-ccevs.org/documents_and_guidance/ccevs/scheme-pub-6.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

DLA Document Services PWS Version 23.3

1. Capable of digitally signing emails using the senders DoD PKI Certificate(s).

2. Capable of encrypting emails using the receivers DoD PKI Certificate(s).

3. Capable of scan to file on networked devices.

4. In compliance with Homeland Security Presidential Directive-12 (HSPD-12).

5. DOD PKI Standards for CAC authentication can be found in the following publications: Department of Defense Instruction (DODI) 8520.03, HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors, and Federal Information Processing Standards (FIPS) 201.

J. All devices shall be capable of authentication specifically with Thales ID Prime 930 SMARTCARD, to be implemented at some point during the contract period. Firmware updates required for this conversion from current CAC to this card shall be completed at no additional cost to the Government. Thales 930 cards will not be available for testing from the government. This should not prevent the vendor from purchasing a Thales 930 card for testing from the manufacturer 90meter, Inc.

K. The Contractor shall produce certificates of compliance, if requested.

XV. TESTING

A. All devices proposed in response to the contract shall be tested for compliance with Network Security as defined in section XIII after award.

B. The estimated time for DLA testing is twenty (20) business days. Testing and approval shall be performed by the DLA Document Services EMS Division in conjunction with the Contractor’s assistance.

The Contractor shall provide onsite engineering assistance and other support necessary to configure, setup, and test the equipment as needed.

1. DLA tests devices to meet DoD RMF and STIG Compliance. If all devices pass the preliminary testing process, DLA shall submit a compliance memorandum to the Contractor informing them that the devices have passed the preliminary testing process. In some cases, prior to being added to the DLA customer’s network, additional certification procedures and testing shall be required prior to risk acceptance. If required by DLA, the Contractor shall deliver test devices to the DLA customer prior to proceeding with installation. DLA shall exercise due diligence to assist with technical mitigation and resolve any questions and/or concerns raised by that agency during the testing review process.

2. If the devices do not pass any of the testing procedures for any reason, DLA shall not proceed with installation of said devices at the customer locations and DLA shall terminate the contract.

C. A device shall not be tested if it cannot be assigned to one of the Volume Bands as outlined in section

III.

D. The devices shall be delivered with all required accessories, software, firmware, etc. Output paper handling accessories are not tested and shall not be delivered to the lab.

E. Approved devices previously submitted to DLA for testing are not required to be re-tested.

F. The Contractor shall deliver the devices for each Volume Band series, under each Functional Area, to the DLA Document Services test located at 430 Mifflin Avenue, Building 430, New Cumberland, PA 17070, for testing, at no cost to the government. Delivery coordination shall take place within five (5) business days of contract award. The MFD Configuration Manager can be reached at (717) 265-3131.

G. The Contractor shall resolve non-compliance issues as quickly as possible. If the issues cannot be resolved within fourteen (14) calendar days, the test shall be suspended. After the non-compliance issues are resolved by the Contractor, the suspended session shall be scheduled when lab time is next available. If requested by DLA, the Contractor shall remove their devices from the lab to avoid delaying the next scheduled test.

DLA Document Services PWS Version 23.3

H. For all devices tested and placed on the DLA contract, the Contractor shall collaborate with the DLA Configuration Manager to develop the testing results package. The Contractor shall develop the device Implementation Guide. The Implementation Guide shall provide step-by-step instructions and screenshots to configure the devices in accordance with the testing results. Government acceptance of the Implementation Guide is at the discretion of the DLA EMS Division.

I. The security requirements set forth in this PWS are minimum device specifications and have been identified as the basic requirements common across Government agencies. These are the minimum security requirements applicable to all devices awarded under this contract. Each ordering activity may have its own hardware/software acceptance processes. All devices shall be subject to ordering activity hardware/software evaluation processes. If the device fails a security evaluation, the Contractor may select a different technology or mitigate the failed controls to fulfill this requirement. The Contractor shall be available to meet with the information technology (IT) and security personnel at a mutually convenient time during the evaluation process and shall identify a mutually acceptable solution. The Contractor shall provide the necessary equipment or expertise to complete security testing and integration into the existing environment. The customer agency may require the Contractor to ship devices to a specific location for testing at time of award.

J. If, during the life of the contract, a requirement in section XII and XIII is changed, updated or revised, the Contractor shall comply with the most current version of the requirement.

K. The Contractor shall remove all hardware from the DLA test lab within ten (10) calendar days upon notification of test completion.

XVI. SUPPLY CHAIN RISK MANAGEMENT

A. As part of its quote, the Contractor shall provide written documentation demonstrating how the integrity and security of all equipment, components thereof, repair parts and consumables it will provide and/or use in performing this contract will meet the standards set forth in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. This documentation shall clearly demonstrate how the Contractor is taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services DLA receives through this contract. Additionally, this documentation shall provide specific details of what—

1. Policies the Contractor has in place to prevent both (a) the use of counterfeit or altered equipment, components thereof, consumables and parts and (b) their introduction into the Contractor’s supply chain;

2. Security procedures the Contractor uses to track the chain of custody of equipment, components thereof, consumables and parts, to include while this material is in storage and in transit; and

3. Steps the Contractor takes to ensure the integrity and authenticity of equipment, components thereof, repair parts and consumables to prevent tampering so they will perform according to specifications without additional unwanted functionality.

B. The Contractor shall continuously meet the standards of NIST Special Publication 800-161 Rev. 1 while taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services provided through this contract. Upon request, the Contractor shall provide written documentation meeting all requirements set forth in part A, above.

XVII. ENTERPRISE MANAGEMENT TOOL

DLA Document Services PWS Version 23.3

A. The Contractor shall provide an Enterprise Management Tool that manages devices. The management/monitoring software tool shall reside within the customers’ network in order to monitor, manage and generate usage to facilitate continued fleet optimization reports.

B. The Enterprise Management Tool shall use SNMP V3.

C. The tool shall monitor meter reads, volume, usage, supplies consumed with notification to order more and provide device uptime performance on networked output devices.

D. Network and security configuration shall be accessible via a web client. This communication shall be HTTPS at a minimum. HTTP only is not authorized.

XVIII. INSTALLATION SECURITY REQUIREMENTS

A. The Contractor shall comply with all rules and regulations to obtain Government installation access in order to meet all response times identified within the PWS.

B. The Contractor shall comply with Government base access requirements as set forth in the base/ command regulations.

C. The Contractor shall be responsible for any and all fees associated with the application process and/or enrollment to access any installation or facility.

XIX. GENERAL CONDITIONS

A. The Contractor shall assign a single point of contact (POC) to coordinate with the Contracting Officer in all aspects of this contract within three (3) business days of receipt of the award. The Contractor shall provide its assigned POC’s name, title, business address, phone number and email address to the Contracting Officer.

B. The Contractor shall comply with the Health Insurance Portability and Accountability Act (HIPAA) when installing devices at Government medical sites.

C. The Contractor shall comply with the Section 508 accessibility requirements. By submission of its offer, the Contractor affirms that its Electronic Information Technology (EIT) supplies and services are accessible as outlined in the law, the standard, and FAR Subpart 39.2. The Contractor shall complete the Voluntary Product Accessible Template (VPAT®) document (Appendix #5) with their proposal.

XX. APPENDICES

A. Appendix #1: Installation Report

B. Appendix #2: Removal/Relocation Report

C. Appendix #3: Hard Drive Removal Record

D. Appendix #4: Usage Report

E. Appendix #5: VPAT® Template

Appendix #1 INSTALLATION REPORT

Activity Name Customer Address

Customer POC Phone # Customer POC Email

Contract #

DLA Document Services PWS Version 23.3

CLIN# Manufacturer Model # Serial # Install Date

Building Number

Floor Number/

Room Number

Continue on the back, if needed. Note: A Delivery Schedule or Spreadsheet can be used as an attachment to this install report.

Customer Accepting Receipt of Device (Print): Customer Signature

DLA Document Services PWS Version 23.3

CLIN# Manufacturer Model # Serial # Install Date

Building Number

Floor Number/ Room Number

(Page 2 – Appendix #1)

DLA Document Services PWS Version 23.3

Appendix #2 REMOVAL/RELOCATION REPORT

Activity Name Customer Address

Customer POC Phone # Customer POC Email

Contract #

CLIN# Manufacturer Model # Serial # Date Building# / Floor # / Room #

Continue on the back, if needed. Note: A Delivery Schedule or Spreadsheet can be used as an attachment to this install report.

*HARD DRIVE REMOVAL (SIGNATURES REQUIRED)*

Customer Approving Removal of Device (Print Name):

Must be the EMS DLA Document Services POC, or designated representative.

Customer Signature

Information Assurance Manager (IT) Receipt of HD (Print Name):

Information Assurance Manager (IT) Signature

Contractor Technician (Print Name): Technician Signature

DLA Document Services PWS Version 23.3

CLIN#

Manufacturer

Model # Serial # Date Building# / Floor # / Room #

(Page 2 - Appendix #2)

DLA Document Services PWS Version 23.3

Appendix #3 Equipment Management Solutions Hard Drive Removal Record

Form log number FY - SEQ#

DLADCSVC - -

Contract number

Customer (Agency/Command)

Drive manufacturer and model

Hard drive serial number

MFD serial number

Date removed

Printed name of technician removing hard drive

Signature of technician removing hard drive

Drive classification ☐ Classified (up to Secret) ☐ Unclassified (CUI)

Hard drive disposition

☐ Retained by customer ☐ Shipped to DLA Document Services ☐ Shipped to NSA

Printed name of EMS Division representative accepting drive for DLA Document Services or customer accepting drive

Signature of EMS Division representative accepting drive for DLA Document Services or customer accepting drive

Printed name/title of person sanitizing hard drive

Signature of person sanitizing hard drive

Date destroyed

Printed name/title verification after Degaussing and Crushing

Signature for verification after degaussing and crushing

Degausser/crusher location ☐ DSI HD-1T (Phil) ☐ EM/Garner Model TS-1

(NOR)

☐ SEM Model 0101(Phil) ☐ SEM Model 0101(NOR)

Post-Sanitization destination (recycling center)

Contact phone number to degausser operator and verification personnel

DLA Document Services PWS Version 23.3

DLA Document Services PWS Version 23.3

Appendix #4 USAGE REPORT

Monochrome Color

Contrac t #

Model

Serial

Install Date

(MM/DD/YYY

Y)

Begi…