Statement of Work.docx

STATEMENT OF WORK

LEASE OF MULTIFUNCTIONAL DEVICES (MFD)

Readjustment Counseling Service, Station 703, Zone 4, Wilmington DE

A. INTRODUCTION

1. General Information:

1.1 The Readjustment Counseling Service, Station 703 has a requirement to lease 1 color multifunctional devices (MFD) to support the Wilmington Vet Center.

2. Scope of Work:

2.1 Contractor shall provide multifunctional device services to include provision of all consumable supplies (except paper), periodic preventive maintenance, corrective maintenance (repair) and operator training. Multifunction (printing, faxing, copying, and network scanning) devices will be capable of supporting Secure Personal Identifier Verification (PIV) printing for Microsoft print jobs, as well as secure emailing and faxing.

2.2 The Readjustment Counseling Service, Station 703 requires 1 color multifunctional devices. It is anticipated that the requirement for multifunctional devices will change to include an increase in quantity and/or relocation of devices during the life of the contract. The Government will not accept reconditioned, remanufactured, renovated, or previously used multifunctional devices. Each device proposed must be new models, in current production and within the life cycle of the contract to be consistent with normal commercial practices and standards. The contractor must replace any multifunctional devices that are at the end-of-life cycle at no additional cost to the government.

2.3 The Contractor retains ownership of all equipment, parts, supplies, etc. provided under this Contract and is responsible for their removal at the end of the Contract at no cost to the Government. For security purposes prior to removal of multifunctional devices, hard drives shall be removed by the Contractor and surrendered to the Government at no additional cost.

3. Period of Performance:

3.1 Base Year with (4) option years.

4. Type of Award:

4.1 Contract type shall be a Firm Fixed Price Contract for a base year and (4) option years exercised at the discretion of the government.

4.2 Pricing includes maintenance and all consumable supplies (excluding paper), installation, pick up, and disposal of all existing equipment at the end of the contract. Pricing must include unlimited copies/prints flat rate.

5. Place of Performance:

5.1 Readjustment Counseling Service, Station 703, Zone 4, Maryland. Additional places of performance may be added within the geographical service area of Maryland as directed by the Contracting Officer in response to expansion of services.

B. CONTRACT AWARD MEETING

The contractor shall not commence performance on the tasks in this SOW until the CO has conducted a kick-off meeting or has advised the contractor that a kick-off meeting is waived.

C. TECHNICAL SPECIFICATIONS/REQUIREMENTS

The Contractor shall provide multifunctional (printing, faxing, copying, and network scanning) devices capable of supporting Secure Personal Identifier Verification (PIV) printing for Microsoft print jobs. Only offers including hardware meeting this requirement will be considered.

C.1 GENERAL REQUIREMENTS

0. MFD must be equipped with a PIV card reader with appropriate software and licenses to be compatible with the Homeland Security Presidential Directive 12 (HSPD-12) card readers, Common Access Card/Public Key Infrastructure (CAC/PKI), and user login and password authentication.

0. MFD must support on-board PIV card authentication using government (DOD) PKI certificates. PIV card authentication must also integrate with Windows Active Directory via LDAP. Multifunctional devices must also support authentication via touch-screen keyboard using Windows Active directory.

0. MFD must support secure release for Windows applications. User must be able to authenticate at the Multifunctional device on the network with their PIV card and view, release or delete only their own print jobs. Unclaimed print jobs must be deleted by the system at configurable time intervals. The print release will only be on this unit, but all users must be able to release their own prints.

0. The Secure Print solution must operate from the MFDs touch-screen display. External displays or operator panels and third-party solutions are not desirable as they require additional multi-vendor support. In addition, the MFDs will not show other user’s jobs sitting in the queue. Only the authenticated user’s job will be shown as not to present a security vulnerability target.

0. Equipment must be TAA compliant.

0. MFDs shall be new or newly manufactured – defined as equipment assembled for the first time within the previous 90 days. Government will not accept reconditioned, remanufactured, renovated, or previously used MFDs. Each Multifunctional device proposed must be new models. The contractor must replace any MFDs that are at the end-of-life cycle at no additional cost to the government.

0. MFDs must support scanning to the user’s Home Directory not a shared network folder. User must be able to authenticate with their PIV card at the Multifunctional device to access his/her own unique Home Directory. User registration is not acceptable; user’s Home Directory should be automatically obtained from Active Directory when the user authenticates with their PIV card.

0. When scanning a document at the MFD (following user PIV authentication) and sending via email, the user’s email address will automatically be placed in the “From” field of the email to prevent anonymous emails – the sender’s email address is obtained from the user’s PIV card during authentication. MFDs also allow the user to digitally sign and encrypt the email and attachments using PKI Certificate technology in accordance with government security policies.

0. MFD configurations will be completed by the vendor to include software and firmware updates (latest supported revision), network configuration (using VA provided information), loading proper certificate authority (provided by VA) and necessary embedded solutions to support VISTA and Microsoft secure PIV printing. The MFD configuration will be approved by the government prior to installing any multifunctional devices on the network.

0. MFDs must have the ability to integrate with fax servers OpenText RightFax

k. MFDs Must be equipped to scan documents into file formats including PDF, TIFF and JPEG.

l. All MFD devices shall be floor standing.

m. MFD must support duplex print, scan, analog/digital fax and copy.

n. Maintenance, installation, and repair of leased multifunction printers will be the sole responsibility of the vendor and will be included in leasing costs.

o. All MFD printer maintenance kits, repair parts and consumables (excluding paper) will be covered under the lease agreement and will be Original Equipment Manufacturer (OEM).

p. MFDs must be furnished with Hard Disk Data overwrite and Encryption for the full HDD.

q. MFDs with installed hard drives or removable media become the sole property of the Department of Veteran Affairs and will be disposed of at end of lease period by the Department of Veterans Affairs in compliance with Department of Veterans Affairs Information Security Policies. Vendor is responsible for hard drive removal at no expense to the Agency.

r. Contractor shall comply with the accessibility standards under Section 508 of the Rehabilitation Act of 1973. Existing VPATs must be provided for each proposed model.

s. Contractor will be expected to install MFDs no more than thirty (30) calendar days from the date of contract award. Contractor will coordinate with the Office of Information Technology (OI&T) to configure devices with the latest supported software and firmware updates, network configuration, loading of proper certificate authority, and necessary embedded solutions to support VistA and Microsoft secure Personal Identifier Verification (PIV) printing. When multifunctional devices require replacement, the contractor will remove the hard drive from the machine and provide the hard drive to OI&T for proper disposition.

t. Contractor must provide a list of all proposed hardware and software to be installed/used as solutioned within their proposal. All proposed software (i.e. PIV enabled Print Release, Centralized Management, Data Collection) must be One-VA TRM approved. https://www.va.gov/TRM/SearchPage.aspx

u. Must provide one common user LCD interface for all multifunctional devices to perform all MFD functions, e.g., printing, faxing, copying, and scanning. Multifunctional devices LCD interface must be customizable allowing the touchscreen to be customized.

C.2 MINIMUM REQUIREMENTS APPLICABLE TO ALL MFDs

(1) MFDs shall have the capability to activate secure fax over IP (FoIP) to accommodate future needs.

(2) Each MFD shall have the model number, serial number prominently displayed in plain sight on the machine.

(3) MFD configuration settings shall provide capability for authorized MFD administrators the means of requiring an administrator password for access to the MFD console for both direct physical access and remote console access.

(4) User interface shall be customizable to display custom workflow applications.

(5) The embedded Operating System (OS) must be a hardened kernel with no direct access to the operating system. All configuration and system settings must be exposed through a vendor-controlled interface layered over top of the embedded device OS.

(6) The ability to detect and protect against changes to the embedded device OS files.

(7) 10/100/1000 Base-TX Ethernet with IPv6 support.

(8) Print support for PCL 5c/6 and Adobe PostScript 3.

(9) Shall have print drivers that provide bidirectional device information – indicating device and job status, currently loaded paper sizes and types, and installed options.

(10) All MFDs must be TAA (Trade Agreement Act) compliant.

(11) Energy Star compliant-EPEAT gold rating. (Note: This capability is non-negotiable and MUST be provide with bid offers.)

(12) Devices shall support AirPrint/ePrint features but shall be disabled.

(13) Devices shall support optional, secure wireless printing, but shall be disabled.

(14) All devices should support Network Time Protocol (NTP).

(15) Color MFDs shall have a minimum memory of 2 GB RAM.

(16) Must be equipped with PIV login capability compatible with FIPS 201-1.

(17) Shall have McAfee Embedded with Whitelisting Technology or equivalent capabilities and be McAfee ePolicy (ePO) compatible or equivalent. The ability to protect against the addition of new files, malware, or viruses by blocking execution of any specific non-whitelisted executable file(s). (Note: This capability is non-negotiable and MUST be demonstrated prior to the award of this contract.)

(18) Shall have hard drive minimum of 250 GB.

(19) Ability to enable/disable network protocols and features.

(20) The ability to disable all USB ports.

(21) MFDs must be IP addressable and can restrict device access based on IP address ranges or subnets.

(22) MFDs shall be compatible with Microsoft windows.

(24) Must copy to within 3/16” of the leading edge of paper and to within 3/16” of the remaining three edges.

(25) Must perform satisfactorily at any temperature between 60- and 85-degrees Fahrenheit.

(26) Must perform satisfactorily at any relative humidity between 15 and 80 percent.

(27) Must not contain either asbestos or polychlorinated biphenyls (PCB).

(28) Contractor must identify the presence of the following materials: beryllium or beryllium compounds, and lithium or lithium compounds.

(29) Must have the manufacturer's serial number permanently and legibly stamped or affixed on a major component in a readily accessible location. In addition, each MFD shall be permanently and legibly marked in a conspicuous location with the manufacturer's name or trademark, and model number.

(30) Must be furnished with an operator’s manual (printed or electronic).

(31) Must be furnished with a receiving bin for copies, unless an optional output device is specified.

(32) Must have the capability to copy pages of bound documents.

(33) Must be capable of operating satisfactorily and providing acceptable copies on recycled paper.

(34) Must be equipped with a lighten/darken contrast control.

(35) Must have a self-diagnostic system, which indicates at a minimum, the following conditions:

(a) needs toner,

(b) needs paper, and

(c) paper miss feed or jam.

(36) Must feature a visible indication of when the equipment is energized. This may be with a special “power on” light or an appropriate indicator on the control panel.

(37) Must have a minimum 8.5” x 14” flat-bed platen.

(38) Must be furnished with automatic document feeders (ADF), capable of automatically feeding and scanning two-sided originals up to 8.5” x 14” in size.

(39) Must have a minimum of two preset reduction ratios, one of 64% +/-3% the size of the original, one of 75% +/-4% the size of the original, and one enlargement mode of 120% +/5% the size of the original.

(40) Must have a zoom feature allowing continuously variable reduction in increments no larger than 1%. The reduction feature shall, at a minimum, cover a range from 25% through 100%. Copiers shall have a zoom feature allowing continuously variable enlargement in increments no larger than 1%. The zoom feature shall, at a minimum, cover a range from 100% through 400%.

(41) Must have the ability for color and black and white copying to default to all black and white.

(42) Must have full color and black and white scanning capability and scan up to 8.5” x 14”.

(43) All machines must copy, print, scan, and fax up to and including 8.5” x 14”.

(44) Installed analog/digital fax hardware shall provide 33.6 Kbps capability.

C.3 MFD REQUIREMENTS:

Standalone Color MFD

· Monthly Duty Cycle of Up to 100,000 pages

· Average Monthly Page Volume Per MFD 4000

· Must have a minimum total input of 1,000 sheets, including by-pass tray

· Capable of automatic duplex printing

· PIV authentication

· Support PIV enabled Print Release in the Linux Environment

· Black & White and Color Scanning

· Minimum 7-inch color touchscreen

· 1200 x 1200 DPI print resolution

· Minimum 7.9 seconds for color and 6.7 seconds for black and white pages for first page print

· Collating and Stacking

· Multi-position staple finishing (stapler finisher capable of Corner and Double stapling minimum 50 sheets)

· 2/3-hole punch finishing.

· Paper Size: up to 8.5” x 14”

· Must have a fax card and be able to support a fax server

· Minimum 30 ppm

Provide for each piece of equipment the manufacture name, the model number, the rental rate, and supporting documentation indicating how it meets technical requirements, as listed above. Failure to provide this information will result in quote not being considered.

C.4 TRAINING & SUPPORT

The Contractor shall provide comprehensive training at each install site at the time of the initial installation. Training for all installed multifunctional devices and installed software components will be conducted as train-the-trainer sessions. With each multifunctional device placed, the Contractor shall provide at least one (1) copy of the Operator's Instruction Manual for each multifunctional devices. Live in-person or on-line (web conferencing) training is acceptable. These training sessions will be defined as:

(1) Contractor shall post visual narratives at the devices showing instructions as to the basic functions of that device, i.e. how to print, copy, scan, and fax.

(2) User training – one (1) end user training session per installed MFD for up to twelve (12) trainees.

(a) Overview of MFD

(b) MFD coping

(c) Printing to the MFD

(d) Scan to email from the MFD

(e) MFD faxing

(f) One (1) process specific standard operating procedure (SOP) guide will be provided to each trainee for distribution to users.

(3) When notified, the Contractor shall supply additional training on an as needed-basis due to personnel turn over.

(4) All training cost shall be inclusive within the cost of the Contract.

C.5 SITE ACCESS AND PREPARATION

(1) The Government will provide the awarded Contractor with access to site(s) to evaluate the environment, placement location(s), power, and safety requirements prior to the scheduled installation date if desired by the Contractor.

(2) Contractor shall provide visual illustrations of each MFD model proposed. Illustrations must depict MFDs in their fully configured state – including all proposed paper decks, finishing units, etc. as solutioned and described in the Contractor’s proposal. Illustrations shall be identified with the appropriate CLIN.

(3) Contractor shall provide footprint dimensions indicating the space required for each fully configured MFD model as solutioned by the Contractor – including the main unit, all paper decks, finishing units, etc. The amount of clearance required from obstruction should also be provided.

(4) Contractor shall dispose of old MFDs at sites prior to installation of new MFDs if applicable.

C.7 SECURITY REQUIREMENTS

(1) Contractor must provide a list of all hardware and software with version number(s) to be installed/used.

(2) All software to be installed/used must be Department of Veterans Affairs One-VA Technical Reference Model (One-VA TRM) approved. https://www.va.gov/TRM/SearchPage.aspx.

(3) OI&T must approve all hardware and software prior to installation and before any activities can be performed on the Government’s network.

(4) Contractor will be provided an escort as required when attempting to gain access to MFD work areas.

(5) The MFDs shall have a security overwrite function that prevents image data from remaining on the hard drive after the completion of any copy, print, network scan, or scan to email or fax function.

(6) The hard drives shall be FIPS (Federal Information Processing Standards) 140-2 encrypted upon delivery and installation prior to being allowed on the network.

(7) The MFDs shall have a security method to isolate the fax capabilities from vulnerabilities and attacks of unauthorized parties trying to gain access to security infrastructure. Contractor shall provide a detailed technical description on how their MFDs shall be able to comply with this requirement.

(8) During the life of the Contract, if it is found that a MFD has been compromised or is associated with any security event or incident, reserves the right to isolate any MFD and have forensic-type activities performed. This may require removing any hard drives or system components that have been involved in creating the security event or incident.

(9) MFDs shall support at least TLS (Transport Layer Security) 1.2 or higher secure protocols.

(10) The ability to protect against the addition of new files, malware or executable files.

(11) The device shall support ability to disable all ports and network protocols.

(13) Ability to restrict data from being stored local on MFD hard drive.

(14) Support IPV6 and static IP assignment. All MFDs should receive a static IP. Assigning VA- MFDs a static IP prevents print files containing VA sensitive data from being redirected, which may lead to the compromise of that data if the DNS cache is poisoned.

(15) All managed services must have the ability to change default community strings and passwords.

(16) Ability to restrict unauthorized users from changing the global configuration of the MFD.

(17) Device shall be able to maintain its configurations state (i.e., passwords, service settings, disabled protocols, etc.) during a power down or reboot.

(18) Supports the ability on MFD to prevent downloads from external websites.

C.8 SECURE PRINTING

(1) Must operate from the MFD touch-screen display. External displays or operator panels and third-party secure printing solutions are not desirable.

(2) For authentication, the user must be able to authenticate at the MFD with the option of configuring the device using a domain username/password/PIN (Active Directory/LDAP) or PIV/PIN to release the held print job(s).

(3) The solution shall capture at a centralized queue using a standard print driver all user initiated print jobs from workstations and allow only the specified user to release the print job from the MFD on the network.

(6) The solution shall capture the print job with the necessary user metadata to associate the print job with the authenticated user at the MFD.

(7) The solution shall support the ability for the user to authenticate at the MFD with a PIV card to release the held print job.

(8) The solution shall be able to be configured where any jobs not retrieved by the user within a set period of time shall be automatically deleted from the secure server.

(9) Must have the ability to clear unprinted document cache after a determined period of time.

(10) For auditing, the solution must track at a minimum – username, print job name, and the time stamp for all print jobs.

(11) MFD will not show other user’s jobs sitting in the queue. Only the authenticated user’s jobs will be shown as not to present a security vulnerability target.

C.9 SECURE SCANNING

(1) Single touch scanning with the ability to dedicate at least six (6) user interface scan buttons at the device associated with scanning workflow – customizable by the administrator.

(2) The Contractor must provide the ability to scan to user home directories, or other personalized destinations to limit Patient Health Information (PHI) exposure.

(3) Apart from Active Directory (AD) authentication, routing of documents should not require any additional user identification – such as requiring the user to type in their username or navigating to a folder structure.

(4) Users shall be able to login at networked MFD and after PIV authentication retrieve their email and home folder attributes and securely scan to email and their home folder.

(5) Scan conversion to JPEG (Joint Photographic Experts Group), TIFF (Tag Image File Format), and PDF formats.

(6) Have network OCR (Optical Character Recognition) capabilities to convert scanned documents to searchable PDF without the need for specialized user desktop software such as Adobe Acrobat, etc.

(7) All scanning activity should be tracked in an ODBC compliant database. Tracked data should include user name, date/time, page count, network destination, and all other relevant metadata.

(8) Exchange/Active Directory -

(a) MFDs shall be compatible with Microsoft Exchange 2007 and newer using the MAPI – Messaging Application Programming Interface/IMAP – Internet Message Access Protocol (MAPI/IMAP Exchange Protocol).

(b) MFDs shall be capable of Microsoft Active Directory integration for centralized account management using the Lightweight Directory Access Protocol (LDAP).

(c) Solution shall be capable of communicating in a Microsoft domain environment using the NTLMv2 protocol (NT LAN Manager).

(9) Image Sizes - Scanning should provide the highest level of image compression available while maintaining native compatibility with Microsoft Office 2007 and newer – including Microsoft Office 365.

(10) Network

(a) Traffic will not exit the local area network (LAN).

(b) The device shall support network protocols Server Message Block (SMB) and Secure Sockets Layer (SSL).

(c) The SNMP Protocol (Simple Network Management Protocol), if present, must be capable of being turned off.

(d) Solution shall be fully compatible with TCP/IP v4 (Transmission Control Protocol/Internet Protocol) and DNS (Domain Name System).

(e) Network line speeds shall be capable of either half or full duplex operating at either 10, 100, or 1000 Mbps.

C.15 HARDWARE AND SOFTWARE MAINTENANCE SERVICES

(1) Contractor shall provide hardware and software maintenance services in accordance with the accepted commercial practice and the terms herein with respect to all devices furnished under contract.

(2) Contractor shall be responsible to provide all parts and labor as part of MFD maintenance cost including preventive maintenance. The Contract shall include full-maintenance service (repairs, adjustments, part replacements) by authorized service technicians, at no additional cost to the Government.

(5) Contractor shall provide a history maintenance report on a device upon request of the Government. The report should show all service calls during the life of the device under Contract, the issues of the calls, as well as the cumulative number of hours the device was consider as inoperable.

C.16 SUPPLIES

(1) The Contractor shall supply all required OEM replacement parts, toner, waste toner containers, fuser rollers, drums, coronas, imaging and transfer belts, and any other parts and consumable supplies including staples required for copying, printing, and facsimile functions except paper and other printable media. All parts must be Manufacturer parts and supplies no generic parts or supplies excepted.

(2) The Contractor receives, tracks and fulfills customer requests for consumable supplies.

(3) Contractor will ship consumables and supplies to each site using common carriers with package tracking capability and delivery confirmation.

(4) Contractor shall provide shipping and handling of all included consumables at no cost to the Government.

(5) Contractor shall deliver the supplies within three (3) to five (5) workdays after receiving the request.