Attachment 1 PWS.pdf

Attachment 1

PERFORMANCE WORK STATEMENT (PWS) HIRSCH

ELECTRONIC SECURITY SYSTEM, PREVENTIVE MAINTENANCE &

INSPECTION SERVICES FOR DLA INSTALLATION MANGEMENT, EUROPE &

AFRICA KAISERSLAUTERN, GERMANY

1.0 INTRODUCTION: This is a non-personal service(s) contract under which the personnel rendering the service(s) are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.0 ESTIMATED MONTHLY LABOR HOURS: Based on an estimate of 110 hours per year. The time expended on successful completion of all tasks is the U.S. Government’s best faith estimate and is in no way a determination of the average hours required. Contractors shall provide a quote that will enable successful completion of all tasks as stated in the PWS.

3.0 PLACE OF PERFORMANCE: Kleber Kaserne, Kaiserslautern, Germany, Buildings 3209, 3227, 3228, 3229, 3230, and Kaiserslautern Area Disposition building 2400.

4.0 PERFORMANCE PERIOD: The contract term is for a one (1) year period and shall commence in accordance with the terms of the contract.

5.0 SCOPE OF WORK: The Contractor shall provide all necessary labor, supplies and materials, and other equipment to provide preventive maintenance and inspection of all Hirsch Electronic Security Systems, as described within this PWS. The Contractor shall provide transportation and supervision of Contractor employees involved in the execution of required services at the location(s) in para 3.0. It is the Contractor’s responsibility to become familiar with all grounds and facility areas covered within this scope of work.

SECTION I-DESCRIPTION OF SERVICES

6.0 CYBERSECURITY MAINTENANCE AND SERVER MAINTENANCE SERVICES to include but not be limited to: provide proprietary Velocity Software updates and server maintenance for the Hirsch Electronic Security System (ESS).

6.1 SERVE ARCHITECTURE: The Contractor shall ensure on-site maintenance visits to support the Velocity production environment. The contractor shall support DLA Installation Management in coordination with Rheinland Pfalz Army Garrison to obtaining Security Certification and Accreditation by documenting and addressing any questions and/or configurations as required to obtain certification and supporting the upload to eMASS of the security package.

▪ The following is included in each onsite maintenance visit:

▪ Support with technical issues regarding the operation of the solution. Any issues will be documented then a resolution will be documented proposed if possible. If no resolution can be found, the issue will be reviewed, and an architectural or operational solution will be proposed.

▪ Maintenance and support will cover the server system architecture, and all HIRSCH Velocity aspects of the system.

HIRSCH Velocity updates will follow the normal Engineering Cycle.

▪ Velocity software upgrades and patches, includes both major and minor versions of Velocity software.

▪ Bug remediation

▪ Feature request prioritization based on direct customer feedback

▪ Solution/System change planning

▪ Offer expert guidance on logical use of HIRSCH Velocity access control objects within the context of the end users business logic (Credentials, Access Zones, Control Zones, Time Zones, Inputs, Relays, Alarms, Threat Levels, etc.)

▪ Compare gathered performance statistics with baseline statistics to improve performance and to forecast future software/hardware acquisitions

▪ Evaluate possible approaches to increasing application and server performance

▪ Issues regarding the use of Hirsch Velocity Software may be passed on to Hirsch Technical Services.

6.2 MAINTENANCE PLAN: A maintenance plan will be developed incorporating the following requirements

▪ Narrative describing the work to be performed.

▪ Tasks, frequency and staffing for preventive maintenance based on RMF standards.

▪ Procedures for responding to corrective maintenance service requests.

▪ Procedures for testing of systems after repairs are performed.

▪ Documentation to include any published manual, datasheets and standards.

▪ Reports to be prepared and submitted, and records to be maintained.

▪ Standard test procedures to be performed for corrective and preventive maintenance.

▪ Schedule for product manager.

▪ Check off sheets indicating tasks and tests conducted during any onsite maintenance visits. Sheets will list the site, server, building, equipment information.

6.3 RISK MANAGEMENT FRAMEWORK(RMF): Contractor will provide preventive maintenance, software updates utilizing the following regulations:

▪ Army Regulation (AR) 25-1, Army Information Technology

▪ Army Regulation (AR) 25-2, Information Assurance

▪ The Federal Information Security Management Act (FISMA)

▪ Federal Information Processing Standards

▪ Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)

▪ DoD Directive 8500.1, Information Assurance

▪ DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

▪ NIST SP 800-53 (Latest Revision) for IA controls

▪ NIST SP 800-39

▪ NIST SP 800-30

▪ NIST SP 800-37

6.4 RISK MANAGEMENT FRAMEWORK REPORTING AND DOCUMENTATION: The Contractor, will assist the US Army on DLA Installation Management behalf with the following RMF documentation and applying necessary security controls to the Velocity servers:

▪ System Security Plan (SSP)

▪ Security Assessment Report

▪ Risk Assessment

▪ Plan of Action and Milestone

▪ Support Documentation

▪ Management Controls

▪ Technical Control

▪ IA Strategy

▪ Security System Baselines

▪ Help to identify the security control requirements

▪ Evaluation of test controls

6.5 SERVICE REQUESTS: Normal service requests during regular working hours, Monday thru Friday, excluding Holidays outlined in Section 10.9, from 0800 to 1600 CET, will be coordinated with DLA Installation Management, Security Services and/or COR.

Services required outside of normal hours shall be requested via phone notification with no more than three (3) hours response.

The Contractor shall confirm outside of normal hours request within 1 hour of receiving the request via telephone.

6.6 The Contractor shall provide a central communication system such as an answering service to receive 3-hour work request notification calls or emergency calls when available telephone lines are occupied or out of the service area. The Contractor shall acknowledge via telephone to the COR within 1 hours of receipt.

6.7 SPECIALIZED CONTRACTOR PERSONNEL, MATERIAL AND INVOICING: The need for specialized contractor personnel and/or work required to be subcontracted or specially ordered shall be discussed in advance with the COR.

Specialized work may include Hirsch System replacements, low voltage line repairs, back-up battery supply or any electronic component.

The Contractor shall notify the COR when said items are required, provide the COR a list of materials required, and provide material sourcing in conjunction with the COR.

The above listed specialty work will be paid for by the DLA Installation Support Office. The contractor shall be responsible for pickup within the local area and placement on site, unless delivery is part of the procurement cost, after DLA Installation Support Office purchases the necessary material. The Contractor is solely responsible for the procurement and payment of material and specialty service normally required for maintenance of cybersecurity hardware and software.

6.8 MATERIALS AND SUPPLIES: The Contractor shall provide all materials, tools, vehicles and supplies required in the performance of this contract. All materials supplies and repair/replacement parts shall be new, clean, non-counterfeit, free of defects, corrosion, damage, and fitted for size/design. The characteristics of materials, supplies and repair/replacement parts shall be for the use intended and of an equal or better quality, capacity and efficiency as the originals, as well as be produced by manufacturers regularly engaged in the manufacture of these products. Materials acquired shall become property of the U.S.

Government when repaired, installed, and completed.

6.9 WARRANTIES: The Contractor shall make maximum use of the provisions of manufacturer’s warranties for Government property, as applicable. The Contractor shall maintain a file(s) of warranties on Hirsch Hardware that are under warranty and under the management of this contract. These files shall identify the item, part and model numbers, the nature and expiration date of the warranty, and the name and address of the firm to contact concerning the Government’s entitlement under the warranty. Copies of all warranties shall be provided to the Government at the time of purchase.

In the event of an equipment failure or other problem covered by the warranty, the Contractor shall verify expiration date and immediately inform the COR of the status.

SECTION II- PERFORMANCE STANDARDS

7.0 PERFORMANCE STANDARDS: The following standards are the performance objectives under this contract.

7.1 QUALITY ASSURANCE: All surveillance observations recorded as a defective performance shall be reviewed by the COR and Contractor. Uncorrected deficiencies shall be forwarded to the Contracting Officer for follow-on action.

7.2 QUALITY CONTROL: The Contractor shall establish and maintain an inspection and surveillance system within ten (10) days after contract award, to ensure that the work performed conforms to the contract requirements. The Contractor shall document and maintain a file of all scheduled and performed inspections and surveillances, inspection and surveillance results, and dates and details of corrective and preventive actions. The Contractor’s proposed inspection and surveillance system shall be submitted to the Contracting Officer via the COR for review and acceptance. The quality inspection and surveillance system file shall be the property of the Government and maintained in a centralized location within DLA Installation Support. The file shall be turned over to the Contracting Officer within five (5) calendar days of termination of the contract.

7.3 ANNUAL WORK SCHEDULE: The Contractor shall provide the COR a written proposed schedule stating the contractor’s schedule for PMI for the year; this shall be submitted via email or in person upon award of contract. The Contractor shall make necessary adjustments as agreed upon by the COR.

7.4 PERFORMANCE OBJECTIVES/RESPONSE TIMES: The Contractor shall respond and commence performance within 48 hours after receipt of the service request.

SECTION III- GENERAL INFORMATION

8.0 CONTRACTING OFFICER (KO)/CONTRACTING OFFICER REPRESENTATIVE (COR): As determined by the KO, a COR will be appointed and identified by a letter of designation, a copy of which will be provided to the Contractor by the KO. The designation letter states the responsibilities and limitations of the COR. The COR is not authorized to make any commitments or changes that affect price, quality, quantity, delivery, or other terms and conditions of the contract nor in any way direct the contractor or its subcontractors to operate in conflict with the contract terms and conditions. If the work is not written in the contract, the COR is not authorized to request new work. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the Contractor concerning technical aspects of the contract, monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies, coordinates availability of U.S. Government property, and coordinates site entry of Contractor personnel.

9.0 The KO is the sole authority for the contract and is the only person with the authority to authorize work performed in relation to the awarded contract.

9.1 CONTRACT MANAGER AND ALTERNATE CONTRACT MANAGER: The Contractor shall provide a contract manager and alternate who shall have full authority to act for the Contractor in all contractual matters and is responsible for the performance of the work under this contract. The name of the contract manager and the alternate, who shall act for the

Contractor when the manager is absent, shall be designated in writing to the contracting officer prior to the contract start date. The Contractor shall notify the contracting officer of any change in contract manager or alternate within 24 hours of the change. The contract manager or alternate shall be available Monday through Friday during normal duty hours, 0730-

1600 hours CET, via telephone and e-mail. Automated answering machines and non-personal answering services are not acceptable. The contract manager and alternate shall be able to speak, read and write English at a professional level.

9.2 KEY PERSONNEL: Key personnel are defined as personnel having supervisory or administrative duties in performance of this contract, where reading, understanding, writing and verbal communication are integral parts of an employee's duties.

The employee shall be able to speak, read and write English at an adequate level unless designated otherwise in writing by the KO.

9.3 EMPLOYEE IDENTIFICATION AND UNIFORMS: Contractor personnel shall be easily identifiable through the display of badges.

The Contractor (to include subcontractors) shall provide each of their employees an easily readable identification badge. The badge shall include the employee’s name, the contractor’s company name, and a recent color photograph of the employee.

Companies with U.S. Government contracts will require their employees to wear these badges visibly when performing work.

9.4 CONTRACTOR ACCESS TO ARMY INSTALLATIONS: The Contractor shall request installation, and vehicle passes in a timely manner for all Contractor personnel in the performance of this contract.

9.5 The Contractor shall provide a Personal Data for Installation Pass worksheet with each pass request within five (5) days of contract award. A sample form will be provided to the Contractor by the COR. The Contractor shall be responsible for reproducing copies of the worksheet for their own use. This pass request shall be supported with a valid Police Conduct

Certificate (Polizeiliches Führungszeugnis) for all employees assigned in the performance of the contract. For other than

German national employees, a resident permit and work permit (if applicable) shall be attached to the pass request. A copy of the personal identification document (Personalausweis or Reisepass) shall be attached to the pass request. The Police

Conduct Certificate shall be up to date and not be older than 12 months of issuance date. The Contractor shall submit to the

COR a pass request for each employee involved in the performance of this contract. The pass request will be screened by the

COR and forwarded for processing. The Contractor is required to comply with USAREUR Regulation 604-1, Personnel

Security Screening, Army in Europe (AE) Regulation 190-13, The Army Physical Security Program, and AE Regulation 190-16, Installation Access Control. In case of questions concerning the regulations, the Contractor shall contact the COR. The Simple

Security Check Questionnaire and the Declaration of Consent to a Simple Security Check shall be filled out and signed by the

Contractor, the Contractor employee and, as applicable, the employee's spouse, registered partner or cohabitant.

9.6 All installation pass applicants for the Kaiserslautern area will be registered in the Installation Access Control System (IACS), having the proper information readily available. All contractor personnel engaged in associated functions of this contract, require facility access up to and including Force Protection Condition Charlie. This requirement is mandatory to meet mission requirements for the Defense Logistics Agency.

9.7 During the performance of the contract, the Contractor shall be responsible for requesting and obtaining required identification for newly assigned personnel prior to start of the work assignment.

9.8 Within five (5) workdays upon completion or termination of the contract or expiration of the identification passes, the

Contractor shall ensure all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

9.9 Prior to submitting an invoice for final payment, the Contractor shall obtain a clearance certificate from the issuing office which states all base identification passes have been turned in and accounted for. This certification shall be submitted to the contracting officer prior to submission of the final invoice for payment. Failure to comply with these requirements may result in the government withholding final payment from the Contractor.

9.10 SAFETY REQUIREMENTS: The Contractor shall be responsible for the safety of Contractor personnel as well as U.S.

Government personnel impacted by the performance of services. The Contractor shall also be responsible for the safe operation and application of both Contractor-owned and U.S. Government furnished equipment/property and material.

9.11 HOURS OF OPERATIONS: Contractor personnel shall perform required work during normal duty hours, 800 to 1600 CET, and shall give 24 hours’ notice prior to visits to perform all tasks outlined in this PWS, except under emergency responses.

Unusual or emergency situation work may require performance outside normal duty hours (Monday to Friday) and/or on German or U.S. Holidays, refer to para 6.6.

9.12 EMERGENCY RESPONSE: Contractor shall notify the COR of any non-emergency work requirements necessitating weekend or other non-duty hour performance. Request which are non-emergent shall be made in writing to the COR 72 hours prior to requested workday.

9.13 HOLIDAYS: The Contractor is not required to provide services on U.S. and German holidays, except during failure of the ESS System.

U.S. Holidays German Holidays

1 January * New Year’s Day 1 January Neujahr (New Year’s Day)

3rd Monday in January Martin Luther King Day ** Karfreitag (Good Friday)

3rd Monday in February President’s Day ** Ostermontag (Easter Monday)

Last Monday in May Memorial Day 1 May Tag der Arbeit (Labor Day)

19 June Juneteenth **** Himmelfahrt (Ascension Day)

4 July * Independence Day **** Pfingstmontag (Whit Monday)

1st Monday in September Labor Day 3 October** Fronleichnam (Corpus Christi)

2nd Monday in October Columbus Day 1 November3 October

Tag der Deutschen Einheit (Day of German Unity)

11 November * Veteran’s Day 25 December1 November

Allerheiligen (All Saints Day)

4th Thursday in November Thanksgiving Day 26 December25

December Weilhnachten (Christmas)

25 December * Christmas Day 26 December Weihnachten (Christmas)

*When the holiday is on a Saturday, the preceding Friday will be the US government holiday. When the holiday is on a Sunday, the following Monday will be the US government holiday.

**Indicates date changes each year.

10.0 The COR and the Contractor shall attend meetings as requested by DLA Installation Management, Security Services.

10.1 During scheduled meetings the Contractor shall present a written document in English with clear information, indicating the completed task requirements.

10.2 The KO, COR and Contractor shall meet bi-annually, to discuss any contract issue(s). All contract issues requiring KO resolution shall be promptly brought to the KO’s attention to be addressed.

10.3 RECORDS: The Contractor shall maintain all inspections records, work schedules, repair records, invoices, and material receipts in a format that the information can be readily available to the COR, Contracting Officer and DLA staff as needed. Prior to the start of on-site repairs or maintenance services the Contractor shall provide the COR all necessary records.

10.4 CONTRACTOR PAYMENT: The Contractor will be paid upon the submission of a proper invoice for acceptable services performed during the contract period. The Contractor shall submit the invoice, utilizing the Wide Area

Workflow (WAWF) system, now called iRAPT (Invoicing, Receipt, Acceptance and Property Transfer).

10.5 PERFORMANCE RESOLUTION: Unacceptable performance shall be deducted from the Contractor billing for the month in which the contracting officer makes the determination that a reduction is appropriate, regardless of the period in which the performance occurred. Payment reductions or withholding shall be reflected in the COR’s monthly receiving report. The reduction amount shall be coordinated with the Contractor. Only acceptable services within the performance thresholds shall be invoiced.

11.0 SECTION IV – U.S. GOVERNMENT FURNISHED PROPERTY/MATERIALS

11.1 GOVERNMENT PROPERTY: The Contractor shall be responsible for safeguarding all government property accessed by the

Contractor. At the end of each work period, all government facilities shall be secured. No alterations to the facilities shall be made without specific written permission from the Contracting Officer.

EXHIBIT 3.0

Overview B3209

Fig 1: B3209

EXHIBIT 3.1

Overview B3227

Fig 2: B3227

EXHIBIT 3.2

Overview B3228

Fig 3: B3228

EXHIBIT 3.3

Overview B3229

Fig 4: B3229

EXHIBIT 3.4

Overview B3230

Fig 5: B3230