Amendment 0001 - Updated Performance Work Statement (06-27-2025).docx

I. OVERVIEW

A. The Defense Logistics Agency (DLA) seeks to enter into a contract for up to 60-month lease of one hundred fifty-two (152) Multifunctional Devices (MFDs), accessories and office document devices (hereafter collectively referred to as “devices”) in support of Headquarters Army Materiel Command (HQ AMC) at Redstone Arsenal, AL. (144 devices shall be located in Redstone Arsenal, AL; 2 devices shall be located at Anniston Army Depot, AL; 6 devices shall be located at the Pentagon, Washington D.C.) Specific details are found in sections II and III.

B. The services associated with the leased devices sought are delivery (section IV), end-user training (section V), full-service maintenance, including all consumable supplies (excluding paper) (section VI), relocation (section VII), technical refresh (section VIII), removal (section IX), reports (section X), network functionality (section XII), and network security (section XIII).

C. Each proposer’s contract line item number (CLIN) prices shall be all inclusive, as DLA does not intend to pay any amount in addition to a contractor’s prices for the currently established CLINs. DLA intends for each contractor to recoup all its costs associated with the performance of this contract, and each and every stated requirement therein, through its prices for each currently established CLIN. DLA does not intend to add any additional CLINs or otherwise separately pay/reimburse/etc. for performance of any requirement set forth in this PWS or otherwise set forth in the Request for Proposals.

II. DEVICES AND CONFIGURATIONS

A. All devices shall meet the following requirements:

1. Equipment shall be Trade Agreement Act (TAA) compliant.

2. All equipment, including all parts, accessories and finishers, provided from Contractor shall be new (not refurbished or remanufactured) at contract award or modification for option to increase quantity. New means composed of previously unused components, whether manufactured from virgin material, recovered material in the form of raw material, or materials and by-products generated from, and reused within, an original manufacturing process; provided that the supplies meet contract requirements, including but not limited to, performance, reliability, and life expectancy.

3. Simplex and duplex copying, printing, and scanning.

4. Automatic Document Feeder with a 30-page minimum capacity and duplexing.

5. Operate using at least 30% recycled 20 lb. paper.

6. All A3 devices shall be free-standing with casters/wheels (or cabinets provided as needed). A3 devices shall not be configured for table-top use. A3 devices shall include basic inline finishing functions which include stacking, collating, and multi-position stapling.

7. All A4 devices shall be configured for table-top use, and all A4 devices shall collate documents.

8. Copy resolution of at least 600 x 600 dots per inch (DPI).

9. Print resolution of at least 1,200 x 1,200 DPI.

10. Support the following:

a. Microsoft Windows 11 or higher,

b. MacOS 13 or higher desktop operating system

c. Microsoft Server 2016 or higher server operating systems.

11. A minimum of 1 Gigabyte of document management memory.

12. Print drivers shall be capable of Page Description Language (PDL) to support Adobe PS3, PCL5E and PCL6.

13. Delivered with up-to-date software/firmware and drivers, with 32-bit and 64-bit architecture driver support. Provide all subsequent updates along with installation instructions as requested by the DLA Customer within five (5) business days of request.

14. Operate using standard U.S. office 120/240-volt 15-amp 60 hertz (Hz) alternating current (AC) electrical current or U.S. office 120/240-volt 20-amp 60 Hz AC electrical current. In the event that 20 amp or higher is offered, the Contractor shall clearly identify these models in proposals and in all price lists. No external transformers shall be used as an exception. The contractor shall also identify the power plug part number required.

15. Equipped with an external surge protector to protect all electronic components. The external surge protector shall be provided in addition to any internal surge protectors. External surge protectors shall have a minimum five (5) year manufacturer’s warranty that covers:

a. Replacement of the surge protector if it fails.

b. Repair or replacement of any device provided through this PWS damaged by a power surge when properly connected to the Contractor-provided surge protector.

16. Include a download link, referred to in the Quick Reference Desk Guide as outlined in section V.F.) operator’s manual, in English, for each device. If a digital operator’s manual is provided at delivery but a DLA Customer requires a printed operator’s manual, printed manuals shall be delivered for each device within ten (10) business days of request.

17. Default to:

a. Automatically go into sleep mode after 20 minutes of inactivity

b. Automatically go into hibernation after an hour of inactivity.

c. Print duplex (2-sided).

d. Print in gray scale on both monochrome and color MFDs.

e. “Draft” quality printing rather than “high” quality printing.

f. Display all information in English.

B. In addition to all requirements in section II.A, all devices shall be delivered with one full set of starter (or standard yield) toner cartridges installed and an additional full set of standard yield toner cartridges.

C. In addition to all requirements in section II.A and II.B, all A3 devices shall include basic inline finishing functions which include stacking, collating, and multi-position stapling.

D. In addition to all requirements in section II.A and II.B, all A4 devices shall include collating.

E. All devices shall meet the following security requirements:

1. Devices with hard disk drives (HDDs) or solid-state drives (SSDs), hereafter collectively referred to as “hard drives,” shall have clear, purge, and verification security capabilities as defined in NIST SP 800-88 Revision 1 (Guidelines for Media Sanitization) and shall be encrypted.

a. Clear is defined as a method of sanitization achieved by applying logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques using the same interface available to the user; typically applied through the standard read and write commands to the storage device, such as by rewriting with a new value or using a menu option to reset the device to the factory state (where rewriting is not supported).

b. Purge is defined as a method of sanitization achieved by applying physical or logical techniques that renders Target Data recovery infeasible using state of the art laboratory techniques.

c. Verification is defined as the process of testing the media to ensure the information cannot be read.

d. Encryption shall meet a minimum of FIPS 140-2 Software Cryptography.

2. All CLASSIFIED designated devices shall include an external, removable hard drive. A removable hard drive is a hard drive the DLA Customer may promptly/easily remove and reinsert into an external hard drive chassis on the device on a recurring basis. All devices with removable hard drives shall have a locking mechanism with a key to secure the hard drive.

3. All Universal Serial Bus (USB) ports/memory card slots on the devices shall be disabled when delivered except: the printer port used to connect the device to a single computer; Common Access Card (CAC) readers; and any USB ports needed for servicing/maintaining equipment. Additionally, unused ports, protocols and services on each device shall be able to be enabled/disabled by the local IT administrator.

4. All Non-Classified Internet Protocol Router (NIPR) devices, volume bands 1-5, shall have analog fax only. Note: The analog fax function shall be configured to separate/isolate the fax controller from the network controller. SIPR (Secret Internet Protocol Router) devices shall NOT have the hardware capability for faxing.

5. All devices:

a. Shall have CAC/Personal Identity Verification (PIV) enablement in order to secure the device from unauthorized use and shall have a “Secure Print” feature that allows DLA Customers to use authentication credentials (ex. ID, Login) and password identification (PIN) to release print jobs on the device.

b. Shall integrate seamlessly with currently available print on-demand solutions approved for DISA Networks (e.g., equivalent to “Follow Me,” “Follow You,” “Push” or “Pull” printing).

c. Shall have secure scanning functionality that complies with Federal Information Processing Standard (FIPS) 140-2 or 140-3 encryption with routing and full integration to standard network infrastructure destinations, which include: Scan-to-Email, Scan-to-Folder, Scan-to-Network, Scan-to-Server and Scan-to-PC. Scanned documents shall be made available as a TIFF, JPEG and as a PDF file format. The default scan resolution shall be 300 x 300 DPI. The default scan output file type shall be PDF. Devices shall have Optical Character Recognition (OCR) in order to process and produce text-searchable documents to the scan destination. Note: Full integration does not mean scanning to proprietary back-end content, document or records management systems to support customized indexing or metadata requirements.

d. Written documentation outlining secure printing and scanning procedures required in a and c above shall be provided to both the Delivery POC and the IT POC listed on the delivery schedule at the post-award meeting and at the training session.

III. SPECIFICATIONS:

A. In addition to the features/capabilities/configurations set forth in section II (outlined above), the Contractor shall provide all devices in accordance with the chart below:

Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 11" x 17"

Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 8.5" x 14"

Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray] - Up to 8.5" x 14"

Onsite Technician for MFD (for Redstone Arsenal only)

IV. DELIVERY OF ORDERED DEVICES:

Delivery All costs associated with delivering devices under section IV(A), which includes but is not limited to all costs associated with rigging, special handling, etc., shall be borne by the Contractor.

Delivery of ordered devices shall be in accordance with (IAW) the timeframes outlined in the chart below:

to Complete Delivery

Contractor shall provide a proposed delivery plan, by device, to the COR thirty (30) calendar days prior to the required Period of Performance (PoP) start date and subsequent weekly updates until all devices have been delivered.

Delivery shall be defined as:

Device is placed in the proper location as shown on the Delivery Schedule.

Device is fully assembled to include all ordered accessories. If the Contractor receives the device and it’s ordered accessories in several parts from the manufacturer, that device shall be fully assembled off-site or shall be fully assembled the same day as delivery to the DLA Customer location. DLA’s Customer shall not be required to provide additional space for assembly.

A test copy is made at the DLA Customer's location in the presence of the DLA Customer to demonstrate that the device is operational, and the printed document is clean and clear.

The required additional set of toner cartridges are left with the device.

All shipping/packing materials are removed from the premises.

Devices shall be delivered to the DLA Customer’s location as shown on the Delivery Schedule by the Contractor or duly appointed sub-contractor. Devices shall not be drop shipped by commercial parcel services (e.g., UPS, DHL, etc.) where Contractor does not have direct oversight of all aspects of the delivery of the device to the intended location. If, upon Contractor’s arrival, a device is requested to be placed in a different location other than shown on the delivery schedule, the Contractor shall provide an updated delivery schedule to both the COR and the KO within two (2) business days. The Contractor shall annotate in the Notes/Message column of the Delivery Schedule the name and email address (phone number optional) of the individual who requested the location change.

Deliveries shall be scheduled and completed Monday through Friday from 8:00 a.m. – 4:30 p.m. local time of device location, with the exception of Federal holidays.

If devices are not able to be assembled in time to be delivered within the required delivery time as shown in section IV.A.1, the Contractor shall notify the COR within two (2) business days of Contractor’s knowledge of the delay and provide the COR with documented proof of the delay. The Contractor shall provide an updated delivery date for the ordered device(s) to the COR and KO. Upon notification, the KO may choose to cancel the order or request due consideration for the delay.

The Contractor shall notify the COR and KO of any failed delivery attempt (e.g., the DLA Customer POC is not available, the building where the device(s) are to be delivered is not accessible). The Contractor shall provide written proof by email within forty-eight (48) hours of attempted device delivery. The email should include the date/time of the attempted delivery and all pertinent details, such as who turned them away or what building(s) they were not able to access.

Upon completion of device delivery, the Contractor shall provide proof of delivery within ten (10) business days after delivery. This proof of delivery shall include: make, model, serial number, full delivery address (to include building number, floor, and room number if applicable), printed DLA Customer point of contact (DLA Customer POC) name, phone number, email address, date of delivery and DLA Customer POC signature. The Contractor shall provide this proof of delivery using an approved online repository where DLA can retrieve them 24 hours per day, 7 days per week, 365 days per year. If an online repository is not available, the required information shall be provided using the Delivery Report (Appendix #1).

Regardless of delivery date, all devices, including replacement devices, shall maintain a co-terminus Period of Performance (PoP).

Upon delivery, the Contractor shall affix on each device a sticker with the following information: manufacturer’s name, model number, manufacturer serial number and Contractor/manufacturer toll-free telephone number(s) to place service maintenance calls and order consumable supplies. Additionally, the Contractor shall add the PoP end date to the DLA EMS sticker and affix on device. (DLA shall provide each Contractor with a specific template for the required DLA EMS stickers; that template shall not be altered by the Contractor). Within 10 days of receiving the machine names from the Customer IT POC, the contractor shall place an additional sticker on all awarded devices that will include the machine name

13. Options to Order Additional Quantities of Devices: As options, the Contractor shall, at the same unit price, provide up to twenty percent (20%) more co-terminus leased devices than set forth at each CLIN of a task order; provided that DLA exercises and issues its options, if at all, prior to the end of the 24th month following the effective date of that original task order.

14. Upon award and prior to Delivery, DLA shall require that the Contractor attends a post award meeting (virtually through Microsoft Teams or another Government approved platform). In addition to Contractor’s representatives, that meeting shall consist of the COR, assigned eCRS(s), DLA Customer POC(s), and DLA Customer’s IT POC(s). Topics to be discussed in detail are Delivery Schedule, Contractor’s delivery plan, delivery procedures (to include unique base access/logistics challenges), and network assistance.

15. The Contractor shall provide a list of media access control (MAC) addresses five (5) business days prior to delivery to the local IT POC that is identified during the post award meeting.

B. Network Assistance

1. Upon completion of Delivery, as outlined above, the Contractor shall provide onsite technical and system analyst support and appropriate digital cards/products to successfully connect devices to DLA Customers’ networks.

2. The Contractor shall notify the COR if devices are not networked within ten (10) business days of delivery. The Contractor shall notify the COR if the DLA Customer is not providing needed IT support within 5 days of delivery. If the devices are not networked within the required ten (10) business days due to no fault of the DLA Customer, the KO shall be notified by the COR and the KO may request due consideration for the delay.

V. TRAINING

A. The Contractor shall provide both on-site training and online training, in English, as specified on the Delivery Schedule, to end-users.

B. The Contractor shall coordinate directly with each command’s POC listed on the order to establish the training schedule.

C. Training shall include the following:

1. How to operate the basic function keys of the device.

2. How to operate special features including duplexing, enlargements, reductions, and multiple job queues.

3. Diagnosis and resolution of basic device malfunctions, including paper jams.

4. Location and procedures for installing consumables such as paper, toner, staples, etc.

D. For on-site training, the Contractor shall submit a Summary of On-Site Training Report (Microsoft Excel format), listing device serial number, personnel trained, and date training was completed, to the designated COR within five (5) business days of training completion. If training is declined by the DLA Customer the report shall still be completed, listing the names of all personnel that declined training and date training was declined and submitted to the COR. Initial invoice payment shall not be released until this report is received.

E. For online training, the Contractor shall provide each POC listed on the delivery schedule with manufacturer-approved training that, at a minimum, covers all items listed in paragraph V.C. The link shall be accessible by DLA and its customers via https. The Contractor shall submit a Summary of Online Training Report (Microsoft Excel format), listing device serial number, personnel trained, email addresses training link was sent, and date training link was sent, to the designated COR within five (5) business days of email to personnel. If training is declined by the DLA Customer the report shall still be completed, listing the names of all personnel that declined training and date training was declined and submitted to the COR. Initial invoice payment shall not be released until this report is received.

F. In addition to either on-site or online training, the Contractor shall provide a printed Quick Reference Desk Guide (single sheet, 8.5” x 11” paper size, laminated, full color and able to be easily stowed away with the device). The contractor shall also provide web-based training (URL printed on a sticker to be placed on the front of the device) to serve as follow-up training.

VI. MAINTENANCE

A. Service

1. The Contractor shall maintain each device at a minimum 90% weekly available rate (no more than 4 hours work stoppage per week, based on a 40-hour work week). Maintaining the devices requires service calls (consisting of troubleshooting, repairs and preventive maintenance). All associated labor and travel costs shall be borne by the Contractor.

2. The Contractor is required to provide one (1) onsite technician with a DoD Secret security clearance to service all leased devices at Redstone Arsenal in buildings 4400 and 3534. The contractor shall also provide one (1) backup onsite technician with a DoD Secret security clearance to cover scheduled days off (vacation/medical appointments). In the event that the primary onsite tech is unable to report for duty due to illness or other emergency, the backup tech shall report to building 4400 within two (2) hours of that notification.

3. On-site personnel must be able to hold and maintain a Secret Security Clearance to be able to perform duties unescorted and obtain a government laptop for receiving notifications by various means (i.e., E-mail, A365 Teams, direct interaction from customers) and being able to perform services required.

4. Onsite technician must hold a SIPR E-mail account and maintain access to a SIPR laptop. Technician will only need to access websites that are device-related functions to gather meters reader from SIPR devices. Technician will not need or use any additional URLs within the SIPR network.

5. Onsite technician will sanitize all devices prior to their removal of any location serviced by the Government. This will be approved by Government personnel to ensure this is completed. Devices that are located within the AMC SCIF will be escorted by approved personnel and any hard drive will be removed prior to moving of devices. Government personnel will take control of the hard drive and will dispose of said equipment IAW Army Security Regulations.

6. Coverage shall be Monday through Friday from 8:00 a.m. – 4:30 p.m. local time with the exception of Federal holidays. This includes a thirty (30) minute lunch break.

7. The onsite technician shall respond to work stoppage situations within one (1) business hour of a service call. Work stoppage is defined is defined as a required function of the device (printing, copying, scanning or faxing) is non-operational. The technician shall call the DLA Customer within an hour to discuss the service problem and time of arrival.

8. The onsite technician shall respond to non‐work stoppage situations within two (2) business hours of a service call. Non-Work stoppage is defined as a required function of the device (printing, copying, scanning or faxing) is degraded. The technician shall call the DLA Customer within one (1) hour to discuss the service problem and time of arrival.

9. The DLA Customer shall provide the Contractor with a list of personnel and organizations that are deemed priority to HQ AMC within thirty (30) days of contract award. The contractor must respond at the machine location to priority trouble tickets/calls within thirty (30) minutes.

10. The Contractor shall provide an onsite technician to respond to all service calls. The Government shall dedicate a workspace equipped with a desk, chair, and phone. The onsite technician shall be responsible for the following:

a. Service, deliver paper and toner, hot swap devices (as applicable) and perform any moves of device locations within BLDG 4400 HQ AMC and BLDG 3534 (G6 Warehouse).

b. Proactively identify and resolve potential equipment service problems.

c. Perform standard break/fix service.

d. Perform service maintenance tasks.

e. Understand machine fault codes and correct them.

f. Diagnose and correct common image quality problems.

g. Replace minor and major component parts as needed.

h. Perform color calibration.

i. Perform routine, preventative, scheduled, and unscheduled service and minor repair to avoid/minimize call‐in maintenance/repair.

j. Implement a maintenance schedule.

k. Provide and maintain an on‐site inventory of parts and consumable supplies for Printers, with the exception of paper, which will be provided by the Government.

l. Ensure print output and scans are high quality with little to no smudging or distortion.

m. Only if the government provides SNMP software at its own expense outside of this contract, maintain a printer service call log and provide a monthly report that includes 1) a monthly usage log for print/copy/scans for all devices within the scope of the contract; 2) a monthly usage log of how much paper is being used from Print Business Centers and or Printers that reside within each floor.

11. The Contractor is responsible for all labor and travel associated with the onsite technicians’ responsibilities.

12. The Contractor’s onsite technician shall have a Department of Defense (DOD) security clearance equal to or higher than the classification of the device and be able to provide verification when requested.

13. On-site Technician will have access to NIPR and SIPR accounts for the sole purpose of checking Printer logs and to ensure that all printers are correctly function.

14. The on-site technician will not have access to any other URLs or weblinks other than those that must be used for completion of job for both NIPR and SIPR networks.

15. The Contractor shall be responsible for all damages due to normal wear and tear and loss or damage caused by the Contractor or its agents.

16. If a device is determined to be non-repairable by the onsite technician, to include damaged devices, the Contractor shall inform the COR within two (2) business days of making this determination. A device will be deemed unrepairable if it is documented that the device has failed to meet the 90% uptime requirement as described in section VI.A.1 for three consecutive months. The Contractor shall deliver and install a comparable replacement device within fifteen (15) calendar days from written notification from the KO.

17. For six (6) devices located at the Pentagon and two (2) devices located at Anniston Army Depot, the Contractor shall provide support with personnel other than the primary and backup onsite technician.

a. The primary method for requesting service at these two locations shall be by toll-free number, available Monday through Friday from 8:00 a.m. – 4:30 p.m. local time of location of device. This initial call shall be handled by a live person at which point a reference number shall be provided to the DLA Customer. In addition to service requests placed by calling a toll-free number, a web-based system (not email) may also be used as a secondary option if that system is available, at a minimum, Monday through Friday from 8:00 a.m. – 4:30 p.m. local time of location of device. The system shall provide a date/time and reference number when the service call is placed. The response timelines outlined below begin at the time the reference number is generated.

b. The Contractor shall provide English speaking service technician support Monday through Friday from 8:00 a.m. – 4:30 p.m. local time, with the exception of Federal holidays for these locations.

c. The Contractor shall respond to work stoppage situations within two (2) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival.

d. The Contractor shall respond to non‐work stoppage situations within four (4) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival.

e. In the case of devices cleared for CLASSIFIED material, the Contractor’s repair technicians shall have a Department of Defense (DOD) security clearance equal to or higher than the classification of the device and be able to provide verification when requested.

f. There are not any Paper Distribution requirements as set forth at subsection VI(c), below for these locations.

B. Consumable Supplies

1. The Contractor shall provide OEM consumable supplies (including staples) necessary for the operation of the devices. Paper is excluded as a consumable supply. Because paper is excluded as a consumable supply, the contractor is not responsible for providing paper or loading paper into devices. However, the contractor is responsible for Paper Distribution as set forth at subsection VI(c), below.

2. If a Contractor provides toner cartridges that are a part of a toner exchange/return program the Government CANNOT GUARANTEE that used toner cartridges shall be returned to the Contractor or OEM. Should any used toner cartridges not be returned, there shall be no fees incurred by the Government for the non-returned toner cartridges.

3. The Contractor shall deliver all consumable supplies within three (3) business days after receipt of a request for supplies by the onsite technician. The Contractor shall not require any reports from the Customer as a condition for delivering requested supplies. If a report is required by the DLA Customer, the Contractor shall follow the procedures for requesting reports as outlined in section X.C.

4. The primary method for ordering consumable supplies shall be by toll-free number, available Monday through Friday from 8:00 a.m. – 4:30 p.m. local time of location of device. This initial call shall be handled by a live person at which point a reference number shall be provided to the DLA Customer. In addition to orders placed by calling a toll-free number, a web-based ordering system (not email) may also be used as a secondary option if that system is available, at a minimum, Monday through Friday from 8:00 a.m. – 4:30 p.m. local time of location of device. The system shall provide a date/time and reference number when the order is placed. The three-business day timeline begins at the time the reference number is generated.

5. The contractor must manage the on‐site stock of the consumable’s supplies such that a machine is not offline for more than two (2) hours. The contractor shall not use any consumable supplies that contain hazardous material or substances.

C. Paper Distribution

1. Copier paper is delivered to the HQ AMC building 4400 receiving dock. The contractor shall deliver three (3) sizes of paper (8.5” x 11”, 8.5” x 14”, and 11” x 17”) from the loading dock area to the twelve (12) HQ AMC Business Centers within building 4400 at least every two (2) weeks, not to exceed four (4) cartons of each size per Business Center.

2. The contractor shall also deliver 8.5” x 11” paper to each of the devices located in building 4400 not in a Business Center at least every two (2) weeks, not to exceed three (3) cartons per location.

3. The reams must be unloaded from the carton and placed into paper cabinets (if available). The empty boxes must be broken down for recycling and removed from the building and placed in provided recycling receptacles.

VII. DEVICE RELOCATION

A. Devices shall not be relocated without written approval from the COR and shall be completed within thirty (30) calendar days after receipt of the written request. For device relocations, the Contractor shall:

1. Provide device relocation services, within a 50-mile radius, for 100% of the total number of devices awarded under each order, for each year of the specified period of performance. (For example, if there are 100 devices awarded under any given order, the Contractor shall provide relocations for up to 100 devices per year. This could be relocating the same device 100 times, relocating 100 different devices one time each or any other combination thereof each year.) All costs associated with device relocations within a 50-mile radius under section VII(A)(1), to include costs associated with rigging, special handling, etc., shall be borne by the Contractor.

2. Schedule and complete device relocations for Monday through Friday from 8:00 a.m. – 4:30 p.m. local time where the device is located, with the exception of Federal holidays.

3. Include the following as required: Breakdown and packing of equipment, shipping, uncrating, removal of all shipping/packing materials, network assistance and end-user training.

4. Be responsible for any and all repairs that may be required following any relocation performed.

5. Upon completion, obtain DLA Customer signature on the Removal/Relocation Report contained within Appendix #2 and the MFD Hard Drive Removal Record (Appendix #3) if applicable.

6. For any requested device relocations outside the 50-mile radius, additional costs shall be incurred by the DLA Customer and shall be funded prior to the relocation.

7. For any requested device relocations outside the 50-mile radius, Contractor shall provide a quote for each specific relocation to the KO for approval. The all-inclusive clause stated in section I.C. does not apply for this action.

VIII. TECHNICAL REFRESH

A. In the event the Contractor is no longer able to provide the proposed products, the Contractor may, only after written approval by the KO, remove the products from the contract and provide replacement products which shall meet or exceed the Volume Band requirements as listed in this PWS, at the contract price.

1. Replacement devices shall be newer technology than the models they are replacing. If the Contractor submits new models for testing, the devices shall be “in production” and not near “end of life.”

2. Prior to approved technical refresh, if replacement devices have not been previously tested by DLA, they shall be tested as outlined in section XIV.

3. CLASSIFIED designated replacement devices submitted as a technical refresh shall be delivered to the test lab with all required accessories, software, and firmware TO INCLUDE the external, lockable, removable hard drive as referenced in section II.E.2.

4. OEM specification sheets, to include proposed configurations for each device, shall be included with technical refreshes. Also with their proposal, the Contractor shall submit a completed Voluntary Product Accessible Template (VPAT®). The most recent VPAT can be downloaded at: https://www.itic.org/policy/accessibility/vpat.

5. Contractors shall provide Letter(s) of Supply from the manufacturer as proof that they are an authorized dealer for all devices provided if the replacement device is from a different manufacturer than originally proposed.

IX. DEVICE REMOVAL

A. For device removal, the Contractor shall:

1. Provide a proposed removal plan, by device, to the COR sixty (60) calendar days prior to contract expiration and updates every fourteen (14) calendar days beginning at contract expiration of removals until all devices have been removed.

2. Remove all devices and associated supplies within forty-five (45) calendar days of contract expiration or receipt of a modification signed by the KO. DLA may identify devices that are high priority which shall be picked up within thirty (30) calendar days of contract expiration.

3. Notify the COR of any failed retrieval attempt (e.g., the DLA Customer POC is not available, the building where the device(s) are located is not accessible). The Contractor shall provide written proof by email within forty-eight (48) hours of attempted device removal. The email should include the date/time of the attempted removal and all pertinent details, such as who turned them away or what building(s) they were not able to access.

4. Prior to unclassified device removal, remove all hard drives and surrender them to DLA (or its assignee). Upon completion of the hard drive removal, the Contractor shall obtain the required signatures on both the Removal/Relocation Report (Appendix #2) and the MFD Hard Drive Removal Record (Appendix #3). The Removal Report and MFD Hard Drive Removal Record shall be submitted to the COR within the required forty-five (45) calendar days of contract expiration or termination. After the hard drive has been removed, ALL classification stickers shall be removed prior to device removal/disposal.

5. Prior to classified device removal, ensure all removable hard drives have been removed along with any components deemed necessary to be removed by the command’s Information System Security Manager (ISSM) or Information System Security Officer (ISSO) or equivalent and surrender them to DLA (or its assignee). Upon completion of hard drive/component removal, the Contractor shall obtain the required signatures on both the Removal/Relocation Report (Appendix #2) and the MFD Hard Drive Removal Record (Appendix #3). The Removal Report and MFD Hard Drive Removal Record shall be submitted to the COR within the required forty-five (45) calendar days of contract expiration or termination. After the hard drive/components have been removed, ALL classification stickers shall be removed prior to device removal/disposal.

6. The Government shall withhold final payment if all devices are not removed from the premises within forty-five (45) calendar days of contract expiration or termination. Contractors shall not submit a final invoice until ALL devices have been removed. If a final invoice is received prior to all devices being picked up as well as all Removal Reports received, that invoice shall be rejected.

7. Be subject to payment of all disposal fees incurred by the Government for any devices not removed within sixty (60) calendar days of termination or expiration. After this time period, the devices shall be considered abandoned, and DLA shall not be required to contact the Contractor for approval.

X. REPORTS

A. The Contractor shall provide the following reports:

1. Delivery Report, as referenced in section IV.A.10.

2. Summary of On-Site Training Report, as referenced in section V.D and/or Summary of Online Training Report, as referenced in section V.E.

3. Device Listing Report (Microsoft Excel format) shall be submitted via Wide Area Work Flow (WAWF) to the COR with the monthly invoice. The report shall contain an accurate listing of all devices under contract (model, serial number, location).

4. Removal/Relocation Report, as applicable, as referenced in sections VII.A.7 and IX.A.4-6.

B. Upon request, the Contractor shall provide the following reports within five (5) business days:

1. Usage Report (Appendix #4) shall be submitted to the COR and the KO.

2. Response Time Report shall be submitted to the COR and the KO. This report shall identify the technician’s response time, defined as the time between when the service call is placed and when the technician arrives onsite to repair the equipment. If the issue is able to be resolved on the phone, the response time shall be defined as the time the service call was placed and when the issue was resolved over the phone.

3. Device Downtime Report shall be submitted to the COR and the KO. This report shall identify the time the equipment was inoperable/non-functional. Downtime is defined as the time the service call is placed notifying the Contractor’s representative that the equipment is inoperable/non-functional or when the technician begins service on the equipment if the device is operable/functional upon arrival. In addition, the report shall include information relative to the frequency of service calls, production volume between service calls, types of repairs, as well as parts required.

4. Device Uptime Report shall be submitted to the COR and the KO. This report shall identify the time the equipment was operable and available and will be used to verify the required minimum 90% weekly available rate, as outlined in section VI.A.1.

C. If the Contractor requires device reports from DLA’s Customer, those reports shall be requested through the COR. The Contractor’s request for a report shall not alter the timelines set forth in this PWS.

XI. INVOICING

A. All invoices shall be submitted by the 15th of the month with the Device Listing Report via Wide Area Work Flow (WAWF) and shall be submitted in United States Dollars. The following website provides additional information regarding WAWF including information for “vendors getting started” with the system: https://piee.eb.mil/xhtml/unauth/web/homepage/vendorGettingStartedHelp.xhtml B. For devices that are relocated or removed, invoices shall include the Removal/Relocation Report (Appendix #2) and the Hard Drive Removal Record (Appendix #3). Invoices submitted without the applicable reports shall not be paid.

XII. NETWORK FUNCTIONALITY

A. DOD policy prohibits the publication of network configuration information; therefore, DOD installations shall not fill out pre‐installation site surveys. The required information shall be provided at time of delivery.

B. The Contractor shall provide devices that shall operate on and coexist on a network supporting all of the following:

1. Internet Protocol Version 4 (IPv4),

2. Internet Protocol Version 6 (IPv6),

3. A hybrid of IPv4 and IPv6.

C. Support shall be provided for network configurations based on agency hardware/software.

XIII. NETWORK SECURITY

A. The Contractor shall provide devices that can be configured to comply with the current DISA Security Technical Implementation Guide (STIG) titled Multifunction Device and Network Printer STIG (latest version and release), available at: https://cyber.mil/.

B. All devices shall support Simple Network Management Protocol (SNMP) version 3 (v3). Versions 1 and 2 (SNMPv1/SNMPv2) shall be disabled.

C. All hard drives that are put into service within Federal agencies shall remain in their custody. In the instance where a device is removed by the Contractor, all hard drives, whether internal, external, or otherwise, shall remain in possession of the Government and not be removed with the device.

D. Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their equipment is subject to a known vulnerability. When vulnerabilities are identified by the Contractor, DLA or its Customers, the Contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM TASKORD regulations unless a different time period is directed by USCYBERCOM via DLA. The TASKORD is For Official Use Only. The following is authorized to be quoted from the TASKORD for reference:

1. Assured Compliance Assessment Solution (ACAS) assigns severity scores of critical, high, medium and low to plug-in findings.

a. Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities shall be initiated upon discover with the goal of mitigation/remediation within seven (7) calendar days.

b. Findings with a severity score of high shall be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within twenty-one (21) calendar days of discovery.

c. Findings with severity scores of medium and low shall be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

d. In all instances, DOD components shall consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

E. In the event remediation cannot be achieved within the mandated timeline, the Contractor shall provide a Plan of Action and Milestones and receive approval thereof by the DLA Customer’s agency Authorizing Official or designee for risk acceptance.

F. All devices shall be International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15408 (Common Criteria) certified IAW CNSSP-11 using the National Information Assurance Partnership (NIAP) approved criteria.

1. A device shall be acceptable if it is included on the NIAP CCEVS Product Compliant List (PCL) (https://www.niap-ccevs.org/evaluation-process)

2. Proposed devices shall remain on the NIAP CCEVS PCL during the ordering period.

G. All devices shall have current ISO/IEC 15408 certification and recertification, if applicable, before the Contractor can schedule lab time. See section XIV. Guidance for Common Criteria Maintenance and Reevaluation is available at: https://www.niap-ccevs.org/evaluation-process H. All devices shall be capable of obtaining accreditation through the Risk Management Framework (RMF) for DOD Information Technology (IT). As part of this, the Contractor agrees to provide all requested information and work in good faith with DLA so the DLA Customers can expeditiously obtain RMF accreditation prior to device delivery. The Contractor shall also provide devices for vulnerability and STIG testing to DLA or DLA Customer’s site. The Contractor further agrees that if the quoted device(s) does not obtain RMF accreditation, the contractor shall remove the device(s). Information regarding RMF is found in Risk Management Framework (RMF) for DOD Information Technology (IT) Instruction 8510.1 dated 12 March 2014: http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. In order to maintain RMF and STIG compliance, devices are required to be delivered with the most up-to-date firmware, as outlined in section II.A.10.

I. For all unclassified devices: The Contractor shall supply a SMARTCARD Public Key Infrastructure (PKI) Solution which is compliant with DODI 8520.03 and NIST FIPS 201 (PIV) standards. The contractor shall provide card readers that shall read and process all approved CAC and PIV cards. The Contractor shall maintain compliance with DOD-wide SMARTCARD and DOD PKI standards and support all approved physical cards during the full lease period.

J. For all classified devices: The contractor shall provide a SMARTCARD PKI Solution with SIPRNet token capability, which is compliant with DOD requirements for PK-enabling and interoperability as set forth in DODI 8520.02. The Contractor shall provide card readers that shall read and process all approved SIPRNet token cards. The Contractor shall provide device support systems that incorporate the use of PKI for encryption of information in transit or at rest. The Contractor shall provide devices that are compatible with 3.3-volt SafeNet SC650 token and that are compatible with the 90Meter Middleware solution for CAC, known as CAC Smart Card Manager-90. The Contractor shall maintain compliance with DOD wide SIPR and DOD PKI standards and support all approved physical cards and firmware during the full lease period. For current DODI instructions go to: http://www.dtic.mil/whs/directives/corres/ins1.html.

K. For all devices, the Contractor shall ensure that CAC/SIPR token authentication is available for scanning, printing and copying and shall be:

1. Capable of digitally signing emails using the senders DOD PKI Certificate(s).

2. Capable of encrypting emails using the receivers DOD PKI Certificate(s).

3. Capable of scan to file on networked devices.

4. In compliance with Homeland Security Presidential Directive-12 (HSOP-12).

L. The Contractor shall produce certificates of compliance, if requested.

XIV. TESTING

A. All devices set forth in an awarded contract shall be tested for compliance with Network Security as defined in section XIII after award.

B. The estimated time for DLA testing is twenty (20) business days. Testing and approval shall be performed by the DLA Document Services EMS Division in conjunction with the Contractor’s assistance. The Contractor shall provide onsite engineering assistance and other support necessary to configure, setup, and test the equipment as needed.

1. DLA tests devices to meet DOD RMF and STIG Compliance. If all devices pass the preliminary testing process, DLA shall submit a compliance memorandum to the Contractor informing them that the devices have passed the preliminary testing process. In some cases, prior to being added to the DLA Customer’s network, additional analyst support shall be required from the Contractor.

2. If the devices do not pass any of the testing procedures for any reason, DLA shall not proceed with delivery of said devices at the DLA Customer locations and DLA may terminate all or part of the contract.

C. A device shall not be tested if it cannot be assigned to one of the Volume Bands as outlined in section III.

D. Devices shall be delivered to the test lab with all required accessories, software, and firmware TO INCLUDE the external, lockable, removable hard drive as referenced in section II.E.2. Output paper handling accessories are not tested and shall not be delivered to the lab.

E. Approved devices previously submitted to DLA for testing are not required to be re-tested by DLA.

F. The Contractor shall deliver the devices for each Volume Band series to DLA Document Services located at 430 Mifflin Avenue, Building 430, New Cumberland, PA 17070, for testing. Delivery coordination shall take place within five (5) business days of contract award. The MFD Configuration Manager can be reached at (717) 265-3131.

G. The Contractor shall resolve non-compliance issues as quickly as possible. If the issues cannot be resolved within fourteen (14) calendar days, the test shall be suspended. After the non-compliance issues are resolved by the Contractor, the suspended session shall be scheduled when lab time is next available. If requested by DLA, the Contractor shall remove their devices from the lab to avoid delaying the next scheduled test.

H. Upon completion of DLA testing, the Contractor shall deliver test devices [one each of VB-3A3NC (NIPR), VB-3A3SC ( SIPR), VB-2A4NC ( NIPR), and VB-3A4NC (NIPR)] to the DLA Customer prior to proceeding with device delivery. DLA shall exercise due diligence to assist with technical mitigation and resolve any questions and/or concerns raised by that agency during their testing review process. These devices will remain with the Customer as part of their device allocation.

I. For all devices tested and placed on the DLA contract, the Contractor shall collaborate with the DLA Configuration Manager to develop the testing results…