Statement of Work - Elevator Maintenance.pdf

STATEMENT OF WORK

Federal Bureau of Prisons

Elevator Maintenance Services

1. DESCRIPTION OF FACILITIES

1.1 The work shall be performed at 320 First Street, NW, Washington, DC 20534. The building is a ten (10) story office structure.

2. PERFORMANCE OF WORK

2.1 The Contractor shall be available to meet with the representatives of the Federal Bureau of Prisons (FBOP) to finalize details regarding the performance of the work within ten

(10) calendar days after contract award. All non-emergency maintenance work must be performed outside normal operating hours of 6 AM to 6 PM Mon. to Friday.

2.2 The Contractor shall be responsible for all work being performed and testing all equipment. Acceptance of the work and/or installed equipment shall be at the discretion of the BOP.

3. STATEMENT OF WORK DELIVERABLES AND TASK

3.1 The work covered by this contract includes Monthly, Quarterly, and Annual Preventive

Maintenance Guides for seven (7) passenger elevators and one (1) freight elevator in the HOLC Building. The Contractor shall furnish all materials and labor covered in this Statement of Work.

A. MONTHLY MAINTENANCE INSPECTIONS:

1. Machine Room: Dust machines, motor generator sets, control cabinets, etc.

Sweep floors, relamp, and remove trash. Inspect controllers, signal, scheduling and dispatch panels, selectors and selector tapes. Make repairs and adjustments for proper operation.

2. Pits: Dust ironwork, sweep floor, empty drip pans, relamp inoperative lights, remove trash, and check for leaks. Check run-by, buffer switch, compensating switch, and emergency stop switch.

3. Motors: Hoist motor, motor generator, regulators, and exciters: Inspect oil level, oil pick up, and belts; repair and adjust as necessary for proper operation. Check for excessive heat, noise and leaks. Lubricate the bearings in accordance with manufacturer’s specification. Renew brushes as necessary. Keep end bells, commutators, and brush riggings clean. Inspect armature and rotor clearances and hoist motor generator set, then clean and adjust as necessary to obtain proper operation.

4. Geared Machines: Inspect worm and gear for bottoming and back lash, thrust end play, bearing wear, oil pick up, oil level, and packing. Check gear case for leaks. Empty drip pan.

5. Brakes: Observe operation of brakes. Inspect drum and shoe clearance and adjust as necessary. Clean and lubricate pivot points.

6. Car Gates: Clean, lubricate and inspect hangers and all related gate operating mechanisms. Check rollers, upthrust, interlock, gear box, motor brushes, door control box, cables, safety edge, light rays, gibs, sills, proper operation speed and force close speed. Repair and adjust as necessary for proper operation.

7. Speed Governor: Observe operation, including tension sheave. Check electrical switches for proper operation. Make sure seals are in place and not broken or damaged. Clean and lubricate points.

8. Lightning: Relamp all inoperative lamps including, but not limited to hatchways, hall landings, position indicators, car stations and domes. Clean light diffuses and car stations as necessary.

9. Miscellaneous: Check emergency procedure sign and inspect certificate is in place. Check top and side exits and related switches for proper operation. Repair or replace parts as necessary to insure operation in accordance with manufacturer's specification. Perform operational test of alarm bell, emergency stop switch, communications systems, fire recall service, (Key capture and smoke detector) and any other emergency obtain proper operation.

10. Hydraulic Machines: Observe operation of motor and pump, controls and plunger. Adjust as necessary for proper operation. Check for leaks on oil lines, tank and packing. Repair leaks. If creeping is excessive, correct. Test manual and emergency control. Clean and lubricate as necessary for proper operation.

11. Clean up and remove all debris from work area.

B. QUARTERLY MAINTENANCE INSPECTIONS:

1. Guides: Clean lubricate, and properly adjust all roller guides, guide shoes, and rail oilers.

2. Car Tops: Clean off all dirt, dust and oil. Clean and lubricate fans.

3. Emergency Lighting: Check operation and replace parts as necessary to obtain proper operation of all emergency lights.

4. Solid State Components and Circuit Boards: Inspect printed circuit board and other solid-state devices for cleanliness, condensation spots, evidence of heating, and deterioration. Check to ensure proper operating functions of solid-state devices. Replace defective parts to obtain proper operation.

5. LEVELING: Inspect leveling operation. Clean and lubricate switches, vanes, and all other related parts and adjust to obtain proper leveling at all landings, both in the UP and DOWN Direction, with 1/4 inches above or below the landing sill.

C. ANNUAL MAINTENANCE INSPECTION:

1. BRAKES: Completely dismantle brake assembly, clean and inspect for wear.

Replace defective parts to obtain proper operation. Lubricate bearing, pins, and pivot points.

2. SELECTOR: Inspect, clean lubricate, replace parts, and make repairs or adjustments as necessary for proper operation of selector unit including cables, chains, clutches, cams, gears, fuses, motor brushes, wiring, connections, contracts, relays, tapes, tape tension sheave, broken tape switch, and tape wipers.

3. CONTROLLER: Thoroughly clean controller with blower or vacuum. Inspect and check operation of switches, relays, times, capacitors, resistors, contracts, overloads, wiring, connections, fuses, overload oil levels, and overload control.

Check for MG shutdown, high call reversal, zone control and load bypass door failure time. Replace defective parts and adjust controller for proper operation.

4. HOISTWAY DOORS: Clean, inspect, and lubricate all door operating mechanisms, including but not limited to rollers, upthrust, interlocks, clutches, self-closing gibs, and sills. Replace worn parts, repair or adjust door mechanisms as necessary to obtain proper operation.

5. HOISTWAYS: Clean rails, beams, and all related iron work in hoist ways.

Dust hoist way walls, clean tops, sides, and bottom of car. Clean counterweight.

6. HOIST MACHINE AND MOTOR-GENERATOR: Clean with blower of vacuum. Clean end bells, brush riggings, and commutator.

7. BUFFERS: Check oil levels and operation of switches. Add oil and adjust switches as necessary for proper operation. Manually compress buffer and test for proper return in accordance with ASME/ANSI A17.1 Safety code for elevators.

8. SCHEDULING, DISPATCH AND SIGNAL BOARDS: Clean with blower or vacuum. Inspect and check operation of switches, relays, timers, fuses, and capacitors, resistors, contacts, overloads, wiring, and connections. Replace worn parts and adjust for proper operation.

9. MOTORS: Change oil in hoist motor, MG set, gear machines, and gear boxes with lubricants as specified by the equipment manufacturer.

10. SAFETIES: Inspect, clean, lubricate, and manually operate safety mechanisms prior to slow speed safety test. Replace parts or adjust as necessary to obtain proper operation of safety devices.

11. ANNUAL SAFETY INSPECTION: Provide all necessary labor to assist the independent 3rd party, “inspection company to be retained by the F.B.O.P.” with

(4) annual safety certifications & (1) major 5-year full load safety certification.

4. SPECIAL SERVICES (Emergency Repair) Emergency Maintenance Services

4.1 The Contractor shall be on call to respond to any elevator service call that may arise 24 hours a day. A service call is defined as any situation outside of the regular maintenance schedule that may require a technician to report to the location to work on equipment (i.e., stuck elevator, broken elevator, jammed door, etc.)

4.2 The contractor shall respond to an emergency call, i.e., an individual stuck on elevator within 1-hour after the time the call is placed. All other service calls require a four (4) hour response time.

4.3 In the event of a major system breakdown the contractor shall provide a firm fixed price estimated cost quote of labor hours & materials for emergency services. The quote shall include the number of hours that the contractor is expected to complete the task, unit price according to the contract and the cost of materials (if applicable). The quote shall be reviewed and accepted by the COR and authorized by the contracting officer prior to the commencement of work.

4.4 The Contractor shall provide a firm fixed price emergency service rate that shall go into description area under CLIN 0004, 0008, 0012, 0016, 0020, and 0024. The quantity shall stay at one (1) and the unit will be YEAR (YR). Funding shall be added to the CLINs when the COR and authorized Contracting Officer have reviewed and accepted the quote for the estimated cost for emergency services and materials. The amount shown shall stay at $0.00 on the contract and if emergency services are needed, the funding shall incrementally be added at the time of service. The modification shall be bilaterally agreed upon and a task order shall accompany the modification for authorized emergency services to proceed. Funding shall be added as emergency services are requested, per the emergency services firm fixed price rate.

5. RELATED SERVICES

5.1 During the term of the contract, the Contractor shall be responsible for the retention of any specialists required for the completion of the work.

5.2 The Contractor shall be responsible for the work done by any individuals or firms they retain.

6. STANDARDS OF SERVICE

6.1 The Contractor shall identify one primary contact person for the project within five (5) calendar days after notification of contract award.

6.2 The Contractor shall identify an alternate contact person for the project within five (5) calendar days after notification of contract award.

6.3 The Contractor and his employees shall perform in a professional manner keeping noise and disturbances to a minimum.

6.4 The Contractor shall be responsible for assuring all persons retained to work on this project comply with all policies and regulations while on the property where work is taking place.

6.5 The Contractor shall be responsible for the removal of all debris and the vacuuming of the job site on a daily basis.

6.6 The Contractor shall be responsible for assuring all floor coverings are protected during all phases of construction.

6.7 The Contractor shall be responsible for furnishing the FBOP with names and social security numbers of employees who will be working on this project within five (5) working days prior to coming on site.

6.8 If any other information is needed, please feel free to contact Shawn Moorefield COR at

(202) 305-1747.

6.9 WARRANTIES (GUARANTEES) The warranty and guarantee provisions of the Contract Clauses apply to all Work of the contract, including, but not limited to, the following specific categories related to individual units of work specified in Statement of Work and Contract Terms and Conditions:

• In accordance with FAR 52.246-21 Warranty of Construction, and in addition to any other warranties in this contract, the Contractor warrants that work performed under this contract conforms to the contract requirements and is free of any defect in equipment, material, or design furnished, or workmanship performed by the contractor or any subcontractor or supplier at any tier. This warranty shall continue for a period of one (1) year from the date of Project Substantial Completion.

• Special Project Warranty (Guarantee): A warranty specifically written and signed by Contractor for a defined portion of the Work and, where required, countersigned by subcontractor, installer, manufacturer, or other entity engaged by Contractor.

• Specified Product Warranty: A warranty that is required by contract documents to be provided for a manufactured product incorporated into the Work, regardless of whether manufacturer has published a similar warranty without regard for specific incorporation of product into the Work or has written and executed a special project warranty as a direct result of contract document requirements.

• Coincidental Product Warranty: A warranty that is not specifically required by contract documents (other than as specified in these Requirements), but that is available on a product incorporated into the Work, by virtue of the fact that manufacturer of product has published warranty in connection with purchases and uses of product without regard for specific applications except as otherwise limited by terms of warranty.

7. SCHEDULE OF DELIVERABLES/TASK

Acceptance: The satisfactory completion of each task and acceptance of each deliverable are subject to inspection by the Project Manager and/or the COR. The Project Manager and/or the COR shall have ten (10) working days for inspection following completion or delivery to the Project Manager and/or the COR. If any item or service is found to be unsatisfactory the PM and/or COR will contact the Contractor.

8. CONTRACTING AND ADMINISTRATIVE AUTHORITY

8.1 The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this modification to the current contract, and not withstanding any provision contained elsewhere in this modification to the current contract, the said authority remains solely with the Contracting Officer.

8.2 In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustments shall be made in the modification to the current contract price, delivery schedule, terms or conditions to cover any increase in costs incurred as a result.

8.3 The Contractor shall submit requests for modifications to this modification to the current contract to the Contracting Officer, with a copy of the request to the Project Manager and COR.

8.4 Contractual problems, of any nature, that may arise during the performance of this modification to the current contract must be handled in conformance with specific public laws and regulations (e.g., Federal Acquisition Regulation).

8.5 Only the Contracting Officer is authorized to resolve such problems. Requests for information on matters related to this modification to the current contract action, such as explanations of terms and conditions or contractual interpretations, shall be submitted to the Contracting Officer.

9. CONSTRAINTS / NETWORK STANDARDS AND PROTOCOLS

Offerors must ensure compliance with section 508 of the rehabilitation act of 1973, 1998 amendments.

DEFINITIONS

Information System: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(Note: Information systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.) Peripheral Device: Any auxiliary device that connects to and works with a computer or information system in some way. Examples of peripherals are image scanners, tape drives, microphones, loudspeakers, and webcams.

9.1 NETWORK STANDARDS AND APPROVED PROTOCOLS

All electronic and information (EIT) provided through this action via the resulting contract, task order, delivery order, or purchase order must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR implements Section 508 of the

Rehabilitation Act of 1973 as amended and is viewable at http:\\www.section508.gov.

Applicable standards for this requirement include:

Information systems must meet the following network standards to be deployed on an administrative network:

• 36 CFR 1194.21 - Software Applications and Operating Systems

• 36 CFR 1194.22 - Web-based Intranet and Internet Information and Applications.

• 36 CFR 1194.31 - Function Performance Criteria

• 36 CFR 1194.41 - Information, Documentation and Support

Compliance with all Information Technology U.S. Regulations, Policies, and Guidance for the Department of Justice, Federal Bureau of Prisons, and Solicitation Requirements which include but not limited to:

• PS 1237.14 –Personal Computers and Network Standards

• PS 1237.15 –Information Resource Protection

• PS 1237.16 –Information Security

• DOJ Order 0903 –Information Technology Management

• DOJ Order 0904 –Cybersecurity Program

• Federal Information Security Modernization Act (FISMA) of 2014

• Federal Information Technology Acquisition Reform Act (FITARA)

• OMB Circular No. A-130 –Managing Information as a Strategic Resource

• NIST SP 800-53 –Security and Privacy Controls for Federal Information Systems and

Organizations.

• NIST FIPS 200 –Minimum Security Requirements for Federal Information and

Information Systems.

• NIST SP 800-171 - Protecting Controlled Unclassified Information in Nonfederal

• Information Systems and Organizations.

• Supports IPv4/v6 Dual Stack and provides full and equal functionality when utilizing

IPv6 as when using IPv4.

• Does not require or enable wireless of any type (Wi-Fi, Bluetooth, 3G/4G, etc.) unless an exception is granted by the CIO and is implemented per BOP and DOJ guidelines.

• All devices that make up the system must have a single network connection, only one

IPv4 address, one Globally Unique IPv6 address, and not be capable of routing.

• If internet accessible, can transmit traffic thru a proxy server to access the internet.

• Does not require direct inbound connections from the public internet.

• Does not allow out-of-band access (no modems, etc.).

• Does not require media converters.

• Does not directly connect to other IP networks.

• Does not use IPv4 Multicast.

• Cabling is IEEE Gigabit standard compliant.

• Power over Ethernet (POE) devices are IEEE 802.3af compliant.

• Cannot act (or is disabled from acting) as a DHCP server.

9.2 INSECURE PROTOCOLS

In accordance with current NIST standards, insecure protocols must be disabled and not planned for use. The information system must have the capability of disabling any insecure protocols including, but not limited to, the protocols listed below:

i. Telnet

ii. FTP

iii. SNMP v1/2

iv. HTTP

9.3 INFORMATION SYSTEM REQUIREMENTS

9.3.1 APPLICABILITY

All information systems deployed within the BOP, or on behalf of BOP to include contractor built and operated on-prem, private cloud systems, or government cloud, must be developed to include support for the standards detailed in this section to the greatest extent possible regardless of whether the system is connected to the BOP's administrative network (BOPNet). All systems will be evaluated prior to acquisition and/or deployment to determine that each system supports the technical standards contained in this section. Approval to connect to BOPNet will not be granted to any system that cannot support these standards unless a waiver has been granted by the CIO.

Additionally, all systems must acquire an Authority to Operate (ATO) prior to use, and an Authority to Test (ATT) prior to system testing. Testing will not leverage live data (must use data created for the sole purpose of verifying functional capability and contain neither BOP nor BOP user information). A pilot, if needed, will also be performed without the use of live data.

All the system environments, including development, test, quality assurance, integration, production, and any other environment related to the system, must reside within the authorization boundary.

9.4 OPERATING SYSTEMS AND APPLICATIONS

9.4.1 OPERATING SYSTEMS

All systems should be developed to use BOP standard workstations, laptops, and servers with versions of operating systems that are supported by the operating systems manufacturer/developer and will continue to be supported by the manufacturer/developer for at least three years after the BOP system goes live. Any systems that will rely on operating systems that are no longer supported or will be approaching their end-of-life or the end of extended support date, are prohibited from being installed unless a waiver is granted by the CIO.

All devices must have Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Category I settings applied. Workstations and laptops with Windows operating systems must have DISA STIG settings applied for the versions of Windows currently in standard use in the BOP. Servers, workstations, laptops, and other devices running non-Windows operating systems must be approved for use by the CIO prior to acquisition and must be the latest supported versions by the vendor. If a DISA STIG exists for any non-Windows operating system, the operating system must be configured in accordance with that DISA STIG.

9.4.2 APPLICATIONS

All systems on an administrative network should be capable of using a BOP standard image for workstations. Systems should be developed to minimize the installation of new applications directly onto workstations. Systems that require a client application be installed on workstations are strongly discouraged.

Web-based applications should be installed on standard BOP servers running approved server operating systems and meet the following requirements:

i. Support TLS (non-deprecated version);

ii. Be browser-agnostic;

iii. Not require browser plug-ins, helper objects, specific ActiveX controls, or Java dependencies on the client.

All applications must be able to operate with the latest version of any supporting applications or services required to run that application (i.e., Java, Apache, IIS, etc.).

9.4.3 AUDITING/LOGGING

All operating systems and/or applications must be capable of auditing events and maintaining logs with sufficient information to be able to account for the actions of individual users and record system events and processes.

9.5 IDENTIFICATION, AUTHENTICATION, AND AUTHORIZATION

In order to reduce the amount of effort required to administer the information systems that are connected to any network and to comply with Homeland Security Presidential Directive 12 (HSPD-12), all new information systems should use a centralized directory for identification, authentication, and authorization to control, provision, and de-provision access to those systems.

To connect information systems to an administrative network, all information systems must be capable of supporting Lightweight Directory Access Protocol (LDAP v3 or successor). Systems that cannot support either a BOP directory service or DOJ federated service and require the management of a separate credential store for identification, authentication, and authorization are prohibited.

Each system user must be uniquely identified. Access to information is controlled using a “Least Privilege” role- or assignment-based methodology that provides the user with only the information and access required to perform his/her duties and nothing more. Systems must be capable of tiered-role privileges that distinguish between users and administrators and their authorized functions.

9.6 ENCRYPTION

9.6.1 DATA AT REST

All information systems that store data must have the capability to encrypt the drives on which the data is stored using FIPS 140-2 compliant encryption. If the system cannot support encryption of system drives, it must be approved for use by the CIO prior to acquisition and use.

9.6.2 DATA IN MOTION

All information systems that transmit data over administrative networks must use protocols that encrypt data as it traverses the network. Information systems must support the most current version of secure protocols and encryption standards and must be capable of being configured to prevent the use of insecure protocols.

9.6.3 PUBLIC FACING WEBSITES

Any information system that hosts a publicly accessible website and web services must only provide service through a secure connection (HTTPS) and must use HTTP Strict Transport Security (HSTS) to ensure this connection.

9.7 ENDPOINT SECURITY AND MANAGEMENT AND VULNERABILITY

MANAGEMENT

All networked information systems should be capable of being managed through an approved endpoint security and management application and be fully operational while being scanned for security vulnerabilities without disruption of service. All networked systems should also be capable of being patched using a centrally managed patch management application.

Computer workstations, laptops, tablets, servers, and other computing devices using an operating system must employ anti-virus software protection. Anti-virus software and virus definition files must be updated with the most current versions and the anti-virus software must be configured to:

i. Begin protection when the devices are powered on;

ii. Scan daily;

iii. Check all files processed by the system in real time.

9.8 CLOUD SERVICES

Any system that will connect to or be hosted in a non-BOP cloud service must use cloud service providers (CSP) that have been independently evaluated by an authorized FedRAMP 3PAO and are FedRAMP-certified, and the CSP has provided the most current System Security Plan (SSP), Control Implementation Summary (CIS), Customer Responsibility Matrix (CRM), Security Assessment Report (SAR), and list of any open Plans of Actions and Milestones (POAMs) to the BOP CISO for consideration, and has received an ATO from the BOP Authorizing Official

(AO).

9.8.1 CLOUD APPLICATIONS – REQUIREMENTS FOR COTS AND CUSTOM

DEVELOPED

Contractors must develop or provide administration and user guides for applications, whether the application is custom developed for the BOP or is a Commercial Off the Shelf (COTS) product.

All applications must adhere to Section 508 accessibility standards.

9.8.2 CLOUD APPLICATIONS – CUSTOM DEVELOPED

The BOP owns any and all source code generated for applications custom developed for the BOP. The source code for any application custom developed for the BOP must be delivered to the BOP before the contract expires.

Contractors should use an Agile development strategy (or similar strategy) to enable rapid development with routine opportunities for stakeholders to review progress and provide feedback during the development process.

Applications should adhere to usability principles, plain language, and industry best practices.

Applications should interface with the BOP's IdP using SAML2.0 or OAuth 2.0 to appropriately authenticate users and protect sensitive resources.

Application data should be made available via webservices that are built using REST APIs, with endpoints appropriately protected.

Applications intended for deployment in the BOP’s cloud environment will either be hosted in AWS GovCloud West or AWS GovCloud East, depending on the FISMA classification of the information contained in the system.

Contractors shall identify exact cloud services and resources (i.e. Lambda, RDS types, EC2 instance types, etc.) that will be required to build the system, and use the AWS cost estimation tool to provide a breakdown of the anticipated system cost.

Contractors will make necessary changes to the application, configuration, or cloud infrastructure/services script (i.e. IaC) if required by the BOP cloud team.

Contractors will create CloudFormation scripts that will be used to build the Virtual Private Clouds (VPC) and infrastructure needed, and make necessary changes as identified by the BOP cloud team.

9.9 PERIPHERAL REQUIREMENTS LOCALLY ATTACHED PERIPHERALS

Peripherals that are locally attached to standard BOP workstations must:

i. Not be shared on the network;

ii. Not require software to operate that requires access to the internet or other network resources;

iii. Not require software to operate that requires older versions of software to operate such as Java; iv. Not broadcast wireless signals (i.e., Bluetooth, WiFi, etc.);

v. Not require a change to the workstation local security policy to operate.

9.9.1 LOCALLY ATTACHED PRINTERS AND SCANNERS

Locally attached printers and scanners must have 64-bit drivers and cannot be shared to workstations other than the workstation to which it is directly connected.

9.9.2 NETWORKED-ATTACHED PERIPHERALS

Peripherals must connect directly to an administrative network should be part of a larger system or sub-system authorized to operate on that network. Each system or sub-system must provide controls to the peripherals attached to the network that comply with the system standards detailed above or provide mitigating controls for peripherals that cannot meet a system standard.

The following sections detail the minimum additional standards for common peripherals attached to an administrative network:

9.9.3 MULTI-FUNCTION DEVICES AND NETWORKED PRINTERS

All multi-function devices (MFD) and networked printers must be capable of being configured in accordance with the Multifunction Device and Network Printers DISA STIG.

MFDs must be capable of supporting PIV authentication either directly or via a peripheral attachment/software but are not required to use PIV authentication at this time.

9.9.4 PRIVACY AND RECORDS MANAGEMENT

All systems must be evaluated prior to ATT or ATO for privacy and records management requirements. An Initial Privacy Assessment (IPA) must be completed and if BOP Privacy and Records Management Branch, and DOJ Office of Privacy and Civil Liberties (OPCL) determines that the system collects, processes, stores or disseminates personally identifiable information (PII), a Privacy Impact Assessment (PIA) must be done to evaluate the impact on the confidentiality, integrity, and availability of the data. If required, the Office of General Counsel (OGC) will prepare a System of Records Notice (SORN) to be published in the federal register prior to system’s use. All systems must complete a Records and Information Management Certification (RIMCert) evaluation regardless of PII status.

10. STAFFING

The Contractor may hire key personnel to be approved by the BOP to meet the Statement of Work (SOW) requirements. The Contractor shall identify the key personnel by name, position, and responsibility. The Contractor shall staff all key personnel positions throughout the performance of the contract. The Contractor shall notify the COR and Contracting Officer in writing if any key personnel vacate a position permanently and indicate when an equivalent replacement shall be made. The replacement staff shall be equivalent in credentials and experience. The notification to COR shall occur within three calendar days of the vacancy. The BOP reserves the right to pursue contractual remedies if the Contractor cannot provide a staff member with equivalent credentials and experience to the staff that were originally approved at contract award.

The Prime Contractor shall notify the COR and Contracting Officer in advance of executing any subcontract or modification, including the following information:

• Description of the services to be subcontracted;

• Identification and selection of the proposed subcontractor.

All contract employees shall be approved by the COR before starting work.

After the Contractor determines that a person is appropriate for employment, the Contractor shall request a background check by the COR.

The Contractor shall submit to the COR all relevant information, including a completed and signed National Crime Information Center (NCIC) Check form and driver’s license. This begins the background check process. The information provided on the form includes full name, all aliases used, date of birth, and place of birth, sex, race, and social security number.

The Contractor shall notify this person that a NCIC/National Law Enforcement Telecommunication System (NCIC/NLETS), criminal records and other appropriate background checks shall be processed by the BOP to verify this information.

Contract staff shall not begin working prior to obtaining clearance from the COR. The COR may grant the person clearance after the NCIC/NLETS check is conducted and the results of the check are appropriate.

The Contractor shall understand that granting final approval shall not occur until after the COR receives a response(s) from the background checks and these checks yield acceptable results.

This action does not prevent, preclude, or bar the withdrawal or termination of any prior clearance or approval by the COR at any time during the term of the contract.

Contractors shall adhere to the Residency Requirement Clause. The clause applies to all employees, volunteers, interns, and subcontractors working with Federal inmates as follows:

DOJ CONTRACTOR RESIDENCY REQUIREMENT BUREAU OF PRISONS (JUNE

2004) For three (3) of the five (5) years immediately prior to submission of an offer/bid/quote, or prior to performance under a contract or commitment, individuals or Contractor employees providing services shall have:

1. Legally resided in the United States (U.S.);

2. Worked for the U.S. overseas in a Federal or military capacity; or

3. Been a dependent of a Federal or military employee serving overseas.

4. If the individual is not a U.S. citizen, they shall be from a country allied with the U.S.

The following website provides current information regarding allied countries:

http://www.state.gov/s/l/treaty/collectivedefense/

HSPD-12, FISMA, AND SECURITY CLEARANCE REQUIREMENTS

52.204-9 Personal Identity Verification of Contractor Personnel (Sept 2007) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

The Contractor shall insert FAR clause 52.204-9 in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a Federal information system.

Homeland Security Presidential Directive 12 (HSPD-12) was issued to implement the policy of the United States to enhance security, increase Government efficiency, reduce identity fraud, and protect personal privacy by establishing a mandatory, Government-wide standard for secure and reliable forms of identification issued by the Federal Government to its employees and contractors (including contractor employees). Under this directive, the heads of executive departments and agencies are required to implement programs to ensure that identification issued by their departments and agencies to Federal employees and contractors meets the Standard.

This policy can be found at the following website:

http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html

All contractor and subcontractor personnel shall have personnel security clearances commensurate with the highest level of information accessed. The provisions of Department of Justice Order DOJ 2640.2D, Bureau of Prisons Computer Security Program Statements 1237.11 and 1237.12, and the Bureau of Prisons’ Human Resource Management Manual 3000.02D or their successors, have been used to establish security requirements for all IT-related services.

Contractor and subcontractor personnel working in computer system design, development and support, or maintenance positions shall have security investigations commensurate with the http://www.state.gov/s/l/treaty/collectivedefense/ http://www.state.gov/s/l/treaty/collectivedefense/ http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html highest level of information processed by the system. The positions assumed by the contractor and subcontractor personnel may be categorized as one of the following:

a. Critical Sensitive

b. Non-Critical Sensitive and

c. IT-Related Services - No Sensitive Data Accessed

Types of clearances include the following: 1) National Agency Check with Inquiries Investigation; 2) A critical-sensitive position shall be required to have a full field investigation (BI); and 3)a non-critical sensitive position shall be required to have a limited background investigation (LBI), as defined in the Human Resources Management Manual. For those contractors who shall not have access to sensitive data, appropriate security checks shall be completed commensurate with Bureau security regulations. The Human Resources Manager or Personnel Security Officer shall determine the level of security clearance required.

The specific work that shall be required is classified at the Sensitive but Unclassified (SBU) risk level. The corresponding clearance is Full Field Background Investigation.

NOTE: The Bureau may permit other Government security clearances, to be substituted for the above background investigations, if determined by the Bureau to be equal, current, and provided the contractor submits adequate documentation to support the Bureau’s determination.

It is the responsibility of the contractor, Program Manager (PM), the respective Contracting Officer Representative (COR), and/or COR alternate designee to ensure that all necessary forms and information is completed and submitted in a timely manner. Contractor security clearances, including the submission of security clearance forms, etc., shall be coordinated with the PM and/or COR prior to contract employee engagement at the Bureau’s Central Office.

In addition to the aforementioned background investigations, the Bureau’s security requirements include, but are not necessarily limited to the following:

a. National Crime Information Center (NCIC)

b. National Agency Check with Inquiries (NACI)

c. Law Enforcement Agency Checks

d. National Law Enforcement Telecommunications (NLETS) Checks

e. Credit Check

f. Fingerprint Check (FD-258)

g. Completed OF-306, Declaration of Federal Employment and Appropriate Resume and

Optional Application

h. Completed Contractor Pre-employment Form

i. Release of Information

j. Urinalysis

k. Employment Vouchering over the past five years

NOTE: If it is determined that a urinalysis test is required, it shall be administered at the closest Bureau site. If a test is positive for drug usage, the assigned individual(s) shall be excluded from performance of work for this requirement, and subject to the same security requirements, the contractor shall provide acceptable replacement staff.

Access to any IT sensitive information shall be based on the completion of successful background investigations and security clearances, to include the receipt of a National Agency Check with Inquiries (NACI) case number. The contractor shall not begin any performance on this contract until authorized by the Contracting Officer, PM and/or COR. Once the appropriate of 26 security and clearances have been completed, the Personnel Security Officer shall notify the PM/COR and respective Contracting Officer in writing. At this time, the Contracting Officer shall issue a Notice to Proceed, and the contractor and subcontractor personnel shall have the authority to commence contract performance.

Access shall be based on the completion of successful background investigations and security clearances, to include the receipt of a National Agency Check with Inquiries (NACI) case number. Once the appropriate security and clearances have been completed, the Personnel Security Officer shall notify the COR and respective Contracting Officer in writing. At this time, the Contracting Officer shall issue a Notice to Proceed, and the contractor and subcontractor personnel shall have the authority to commence contract performance.

The contractor shall employ effective safeguards and security controls to ensure that information associated with the work shall be protected from loss, damage, computer viruses or other destructive incidents. The safeguards employed shall ensure that materials and services shall be secured in a manner that prevents tampering, sabotage, and/or other means of deliberate alteration. This provision applies to all Bureau information resources while under the control of the contractor.

The Bureau reserves the right to reject any applicant put forth by the contractor for this project.

Prior to diverting/replacing any personnel for this project, the contractor shall notify the PM and/or COR and the Contracting Officer in writing 30 days in advance and shall submit proposed substitutions. All proposed substitutions shall have equivalent or better qualifications than the individual being replaced. No diversion or substitution shall be made by the contractor without the written approval of the PM and/or COR The PM and/or COR shall be responsible for ensuring all appropriate security clearance procedures are followed. Copies of all documentation shall be provided to the CO by the COR.

The Contractor shall submit a Personnel List spreadsheet (to be used for information purposes only) to the COR or alternate designee within 30 (thirty) working days of location specific task being performed. Anytime a change in personnel takes place, an updated spreadsheet shall be submitted to the COR or alternate designee within ten (10) working days of the change. The first line of the spreadsheet shall contain the contract number, Organization Name being supported, and columns labeled as follows:

• Name of Individual Clearance Level Individual CLIN/SLIN Job Title

• ADP Sensitivity Level (I, II or III)

• Status of Bureau NAC with Written Inquiries (NACI) – Yes/No.

• Date – Use: Approved dd/mm/yyyy or Projected dd/mm/yyyy

DOJ Policy Statement 1700.01 The Department of Justice does not permit the use of Non-U.S. citizens in the performance of this contract or commitment for any position that involves access to or development of any DOJ IT system. By signing the contract document or beginning performance, the contractor agrees to this restriction.

DOJ Residency Requirement

The Residency requirement implemented by the Department of Justice requires that contractors providing services for DOJ components for three of the five years immediately prior to applying for a position, must have: 1) resided in the United States; 2) worked for the United States overseas in a federal or military capacity; or 3) be a dependent of a Federal or military employee serving overseas.

In performance of services under this task, contractor shall insure all its personnel who require physical access to federally controlled facilities and access to federally controlled information systems have been issued identification in compliance with HSPD-12 policy. In the proposal, offerors shall confirm they shall comply with the government client’s identification procedure that is implementing HSPD-12 policy.

Compliance with Section 508 of the Rehabilitation Act of 1973, 1998 amendments The Industry Partner shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) requires that when Federal agencies develop, procure, maintain, or use electronic information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Applicable standards are 1194.21-1194-26. The Industry Partner shall review the following websites for additional 508 information: http://www.section508.gov/index.cfm?FuseAction=Content&ID=12 http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

The contractor must indicate in its proposal where full details of compliance to the identified standards can be found, such as vendor’s website, etc.

Requirement for Procurement of Critical Assets.

Every effort must be made to ensure that supplies are provided and integrated, and services are performed using sound security components, practices, and procedures. Acquisition of supplies or services from concerns under Foreign Ownership, Control, or Influence (FOCI) or of supplies developed, manufactured, maintained, or modified by concerns under FOCI (any or all of which shall be referred to herein as "Use of FOCI source") is of serious concern and must be approved prior to contract award. Approval decisions shall be made on a case-by-case basis after the source or technology has been identified by the Offeror and subjected to a risk assessment. The risk assessment process shall vary depending on the acquisition type and proposed use of a FOCI source, available risk mitigation measures, and the information/justification provided by the Offeror.

http://www.section508.gov/index.cfm?FuseAction=Content&ID=12 http://www.section508.gov/index.cfm?FuseAction=Content&ID=12 http://www.section508.gov/index.cfm?FuseAction=Content&ID=12 http://www.access-board.gov/508.htm http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources http://www.w3.org/WAI/Resources

Any Offeror responding to this Request for Proposal (RFP), acknowledges the Government’s requirements to secure services or equipment from firms which are not under Foreign Ownership, Control, or Influence (FOCI), or where any FOCI, in the opinion of the Government, adversely impacts on National Security or security requirements. The Offeror understands and agrees that the Government retains the right to reject any response to this RFP, RFQ, or Sealed Bid made by the Offeror, without any further recourse by or explanation to the Offeror, if the FOCI for that Offeror is determined by the Government to be an unacceptable security risk. Risk assessments shall be on a case-by-case basis and shall be used to determine whether the use of a FOCI source poses an unacceptable security risk. If an unacceptable security risk is determined, the Government retains the right to reject the use of a FOCI source or to require that certain risk mitigation measures be taken by the Offeror. Similarly, the Government retains the unilateral right to approve the use of a FOCI source when the risk assessment indicates that such use would be in the Government’s best interests. If the use of a FOCI source is not approved, no SBU information shall be disclosed to the Offeror as part of the Government's rationale for nonapproval.

The Offeror (prime and subs) may not seek reimbursement from the Government for any costs associated with responding to this RFP, RFQ or Sealed Bid, as a result of a FOCI nonapproval decision.

Offerors shall complete the Acquisition Risk Questions and Key Management Personnel Listing (KMPL) for the prime contractor and all proposed subcontractors. Provision of false information shall be cause for default under the Default Clause of this contract.

The information regarding Key Management Personnel, which may identify U.S. persons, is being requested pursuant to the National Security Act of 1947, as amended, Executive Order 12829, National Industrial Security Program, and Director of Central Intelligence Directive 7/6, Community Acquisition Risk Center, or superseding Acts, Orders or Directives. The Bureau shall use this information to conduct the acquisition risk determination and may share the information internally and externally with members of the Intelligence Community and other U.S. Government entities, if necessary, consistent with appropriate routine uses for its ‘‘Prison Security and Intelligence Record System, JUSTICE/Bureau–001’’ published in 67 FR 41449 (06-18-02) or any updates thereto. In the absence of proof of death of any of the Key Management Personnel, their consent, or an overriding public interest, the information shall not otherwise be disseminated except pursuant to the routine uses in the applicable system of records notice (SORN).

The Government reserves the right to prohibit individuals who are not U.S. citizens from all or certain aspects of the work to be performed under this Contract.

PRIVACY ACT

Work on this contract requires that personnel have access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, section 552a and applicable agency rules and regulations. This task order is subject to the terms of FAR 52.224-1, "Privacy Act Notification," and FAR 52.224-2, "Privacy Act."

NON-DISCLOSURE AND PROPRIETARY INFORMATION

The Contractor may have access to acquisition sensitive information during the performance of this contract. The Contractor shall ensure that all deliverable and service project(s) acquisition information is tightly controlled and remains within the government domain. The Contractor agrees that all personnel having access to all deliverable and service non- public information shall sign a contractor furnished non-disclosure statement and be bound by U.S. Regulation, DOJ Policies, and Bureau Policies conforming to sensitive information, Privacy Act, and any other related regulation, policies, laws, and contract governance specifications. A copy of each nondisclosure shall be given to the CO, COR, and/or COR alternate designee and remain on file in the COR, Contracting Officer, and/or COR alternate designee’s Office for the duration of this contract, delivery order, task order, and/or purchase order. If the Contractor enters into associate Contractor agreements or sub-contractor agreements within the scope of this contract services/products, the Contractor shall, among other things, protect the unauthorized use of disclosure of proprietary information of those companies.

The contractor shall agree: The deliverable and associated working papers and other material which have been generated by the contractor in the performance of this contract are the property of the U.S. Government.

The Contracting Officer shall be the sole authorized official to release verbally, or in writing, any date, the deliverable or any other written or printed materials pertaining to this project. The contractor shall release no information.