Appendix_A_--_Required_Supplies_and_Services.doc

APPENDIX A

REQUIRED SUPPLIES AND SERVICES

PERFORMANCE WORK STATEMENT

Procuraduría General de la Republica de Mexico (PGR)

PGR Data Loss Prevention (DLP) Solution

1. GENERAL.

The Contractor shall provide all labor, services, materials, equipment, transportation, supervision, and all requirements necessary to accomplish the efforts described in this Performance Work Statement (PWS).

2. BACKGROUND.

The Government of Mexico (GoM) has requested support from the Government of the United States to assist with Mexico’s efforts in justice reform and strengthening of the rule of law. This project is undertaken as part of the US- Mexico action plan for projects that will enhance GoM capabilities to detect, deter, prevent, and mitigate criminal activity in Mexico and along the US- Mexican border.

The project will primarily support the efforts of the Procuraduría General de la República (PGR) and its associated sub-agencies, whose primary focus is to ensure that the democratic rule of law is in strict compliance with the Constitution of the United Mexican States. This type of Institution Building is a critical element of increasing the capabilities of the PGR and its sub-agencies to perform their respective duties in prosecuting criminal activity.

Towards this end, the project entails the implementation of an enterprise-wide Data Loss Prevention (DLP) tool that will enable the PGR and its sub-agencies to identify, monitor, and protect sensitive institutional data. This tool will be instrumental in ensuring the consistency and integrity of investigative data required for prosecuting cases.

Through the Merida Initiative, INL is proposing to leverage the technological resources of both

GoM federal and state entities to deploy an information technology infrastructure that provides the PGR and its sub-agencies with the necessary technological tools to identify, gather, analyze, and disperse intelligence data and information. This is necessary for deployment of effective strategies for the interdiction/apprehension/prosecution of illegal trafficking activities in Mexico and along the border, as well as combating Organized Crime efforts.

3. OBJECTIVES.

The primary focus of PGR investigations is information collection in support of cases. The collection of information can take on many different formats and can involve experts from several disciplines and/or sub-agencies. This informational evidence is collected and stored in distributed systems at the PGR and its sub-agencies.

The DLP system to be implemented must have the ability to track and segregate those having access to certain types of evidence, to maintain the “evidence’s chain of custody” and to avoid evidence tampering or contamination.

The PGR’s sub-agency, the National Center for Analysis, Planning and Information to Combat Crime (CENAPI) implemented an integrated DLP system under the Merida Initiative JET program, in 2012. This integrated DLP system features data-centric protection and central policy management across the CENAPI IT infrastructure. As a result of this project, CENAPI now has the capability of up-to-the minute situational awareness across its IT infrastructure to rapidly identify threats and respond to incidents.

The objective of this project is to take the concepts deployed in CENAPI and expand them to implement a centrally managed unified data protection solution at the PGR and its sub-agencies. This will enable the PGR to manage information assets and ensure critical or protected data is not transferred to another individual or system without the approval of the data owner. The DLP system shall provide the ability to determine sensitive data, and based on institutional policies, define how the data is stored, accessed, distributed, and protected. High level objectives/requirements include:

· Multiple network security zones.

· Network Data Monitoring.

· Email Security.

· Filtering of content and internet searches.

· Intrusion Detection.

· Prevention/detection of information leaks.

· Detection and elimination of malware.

· Secure internet investigations.

· Seamless integration with existing software and hardware.

· Advanced specialized training.

4. SCOPE.

The Contractor shall provide all required equipment, software, and services necessary to accomplish the objectives of this contract. In general terms, the contractor shall:

· Procure, deliver, inventory, install, integrate, and test all hardware, software, and associated equipment necessary to meet the objectives of this contract;

· Provide complete system documentation;

· Provide required end-user and system administrator training; and

· Provide necessary Project Management services for the duration of the project.

5. APPLICABLE DOCUMENTS. – N/A

6. ACRONYMS.

· CO: Contracting Officer.

· COR: Contracting Officer’s Representative.

· DoS: U.S. Department of State.

· DoS-INL: U.S. Department of State, International Narcotics and Law Enforcement.

· PGR: Procuraduría General de la Republica (Mexican Attorney General).

· CENAPI: National Center for Analysis, Planning and Information to Combat Crime.

· GoM: Government of Mexico.

7. PERIOD OF PERFORMANCE OR DELIVERY DATE.

All work shall be completed no later than one hundred eighty (180) calendar days from the date of contract award.

8. PLACE OF PERFORMANCE.

The work under the contract will be performed at five locations (PGR agencies or sub-agencies), all located within Mexico City.

9. DATA DELIVERABLES / REPORTS.

9.1. The Government will have up to ten (10) business days, unless specifically denoted below or extended by notification, to review each deliverable product and provide oral and written comments. The Contractor shall review and incorporate comments or implement directed changes, after discussion or clarification with the designated Contracting Officer’s Representative (COR), and, if necessary, submit a final version of the product no later than ten (10) business days thereafter.

9.2. All documentation and reports shall be delivered in electronic format. All documentation and reports developed or provided by the contractor shall become the property of the U.S. Government.

9.3. All deliverables, including attachments, shall comply with the data right clauses incorporated in the contract. The Government will reject all deliverables containing markings contradicting said clauses.

9.4. All deliverables shall include a cover page incorporating the following information:

· Deliverable name and number;

· Contract number;

· Project title;

· Date of submission;

· Document version number; and

· Contractor’s name.

9.5. Deliverables longer than 5 pages shall include a table of contents. All Attachments shall include the attachment number, deliverable name and number, and contract number.

9.6. The contractor shall distribute the documents identified in the table below to the following individuals, as specified for each deliverable.

GTM: TBD

PGR: TBD

CO: TBD

COR: TBD

10. SPECIAL REQUIREMENTS / CONSTRAINTS. – N/A

11. PERFORMANCE REQUIREMENTS.

11.1. Project Management. The Contractor shall provide project management services to ensure all services are accomplished in accordance with contract requirements and performed in a timely manner.

11.1.1. Project Management Plan. The contractor shall provide a Project Management Plan (PMP) in Microsoft Word format, and a Microsoft Project 2007 project file. The PMP shall include a detailed representation of tasks, and required subtasks, to be performed (cross-referenced to the requirements of this PWS and the contractor’s technical proposal) for timely completion of the project. The plan shall define in detail all project milestones and associated completion schedules. Particular attention shall be placed on identifying interdependencies between tasks, importation requirements and processes, and identifying milestones dependent upon successful interaction amongst parties. The PMP shall include, at minimum, the following management plans:

· Requirements Management Plan: This plan shall identify in detail how planning, tracking, and reporting of requirements activities will occur. How changes to requirements will be requested, tracked, and analyzed; how requirements will be prioritized; what metrics will be used to trace project requirements; and a requirements traceability matrix, which shall include at least: Unique ID, description of requirement, objective, priority, accepted/denied, and status.

· Scope Management Plan: This plan shall identify:

a) Project Scope Description: Shall have the characteristics of the product, service, or result of the project.

b) Project Acceptance Criteria: Shall identify the processes and criteria that will be used to determine whether project deliverables are acceptable and satisfactory; and the process stakeholders will use to indicate their acceptance of deliverables, and how will verify project scope.

c) Project Deliverables: Shall identify measurable outcomes, results, or specific items that must be produced to consider the project completed. Deliverables shall be identified in a specific and verifiable manner.

d) Project Exclusions: Shall identify items not included within the scope of the project.

e) Project Constraints: Shall identify activities that may restrict the actions of the project. This sections shall identify, time, scope, quality, schedule, resource, technology, and directive (management and political) constraints.

f) Project Assumptions: Shall identify tasks believed to be true.

· Approval Requirements: Shall define and identify the requirements that must be met in order for project approval.

· Work Breakdown Structure: The WBS shall identify major deliverables, and subprojects decompose each into smaller units of work, or work-packages. Each work-package shall reliably identify cost, resource, and schedule estimates and have a unique identifier.

· Procurement Management Plan: This plan shall identify the equipment and services required for project final acceptance. This plan shall include the methodology of procuring equipment and services; importation process; IVA invoicing procedures for local purchases; procurement schedule. This plan shall also include equipment and services selection criteria, which shall clearly identify the methods used to identify the best value to the USG, and prior approval and coordination with CO and COR shall be required before equipment procurement.

· Quality Control Plan: This plan shall identify the criteria for gauging project activity and deliverable quality. This plan shall be coordinated with GoM and INL COR for stakeholder expectations. This plan shall include quality metrics, quality checklists, process improvement plan, and a quality baseline.

· Closeout Plan: The contractor shall provide a communications plan, which shall provide at the minimum: Final invoice procedures, project acceptance documentation; contract closeout documentation; project operational status certificate; and project closeout briefing.

11.1.2. Weekly Project Report. The contractor shall provide (electronically) weekly project reports on activities completed, pending action items, and activities planned for the following week on each Friday during the duration of the project. The Weekly Project Report shall be structured in such a way to permit cross-reference to the PWS and contractor’s technical proposal, and shall include at the minimum the following sections:

· Document Control Section. Shall include document number, contract number, date, and project name.

· Report Details. Preparer, delivery date, and distribution list.

· Directory of Project Stakeholders. Shall include name, phone number, agency, e-mail address, and title.

· Activity Tracking. Shall include a milestone chart of current and projected activities; and status.

· Technical Progress Section. This section shall compare actual to planned performance and indicate the progress made in accomplishing each contract task. The report shall include relevant details for assessing the status of performance, i.e., a brief, factual summary description of the technical progress made. The section shall identify any unforeseen technical difficulties, which may threaten on-time completion of the contract. The section shall indicate the specific task that is not progressing according to plan; the reasons for the difficulty; and specific recommendations for remedial action.

· Travel Section. Shall include travel plan, status, and required dependencies with communication planning section (e.g. Travel plan shall be coordinated with COR and GoM before action is taken). Shall define dates, location, and personnel travelling.

· Invoice Notification. Shall include a notification of invoice submission, which shall include at the minimum: invoice amount, invoice number, and date.

· Communication Section. Merida Initiative projects require timely communication and approvals between Contractor, INL COR, Contracting Officer, and GoM. The Contractor shall include a communication section, which shall specify the required communication, notification, or approval; required approval request date, and pertinent documentation.

11.1.3. Monthly Progress Review Meetings. The contractor shall arrange and conduct monthly progress review meetings at a location to be determined with the representatives of PGR and the USG. The contractor shall develop a proposed meeting agenda. After obtaining COR approval of the proposed agenda, the contractor shall distribute to all participants a copy of the agenda and any other documentation to be used during the in-person or teleconference meeting. The approved agenda and documentation shall be distributed by the contractor at least five (5) business days before the scheduled meeting. The contractor shall record meeting minutes and distribute via e-mail within two (2) business days of holding the meeting.

11.2. Provision, Delivery, Inventory, Installation, Integration and Testing of Hardware, Software, and Associated Equipment.

11.2.1. The Contractor shall procure, deliver, install, integrate, and test all required hardware, software, licenses, and miscellaneous items for the four Contract Line Item Numbers (CLINs) below. This includes providing any required maintenance/support, warranties, and training, as may be specified for each CLIN.

· CLIN 001: System for the Prevention of Data Loss (DLP-RSA).

· CLIN 002: Network Analysis of Traffic and Filtering Data SSL (Blue Coat).

· CLIN 003: Monitoring Personal Computer Equipment, Centralized and Communications.

· CLIN 004: Equipment and Central Perimeter Security.

The specific requirements for each of the above CLINs (hardware, software, services, etc.) are detailed in Appendix B (System Requirements). The contractor shall provide all items and complete all work as specified for each CLIN in Appendix B.

The contractor shall provide new equipment only, no grey market or refurbished products. Items must be in original packaging, never used, and not altered in any way. Components of the requested equipment, to include memory, must be manufacturer-approved and may not be compatible, remanufactured, or refurbished equipment. All items must be covered by manufacturer’s warranty and procured through a manufacturer approved distribution channel.

All software shall be licensed originally to PGR as the original licensee authorized to use the software. Contractor shall, upon request, provide the Contracting Officer with a copy of the End User License Agreement.

The Contractor shall provide a comprehensive Bill of Material for all hardware and software delivered under the contract. The list shall include: Item Description, Name of Manufacturer, Model Number, Serial Numbers, Delivered Quantity, Unit Price, Extended Price, and Warranty Expiration Date.

11.2.2. All project hardware, software, and equipment shall be consolidated in a contractor-provided location in Mexico City for inventory by INL Mexico prior to final delivery to the installation sites. Final inspection and acceptance will take place at the five installation sites.

11.2.3. The Contractor shall conduct a pre-installation site inspection at each installation location to ensure the location is ready for equipment delivery and installation. The Contractor shall provide a report detailing the condition of each location. If the location is not prepared for equipment delivery and installation, the contractor shall provide a list of items that must be rectified by the PGR prior to delivery and installation.

11.2.4. The Contractor shall coordinate all deliveries and installation services with the GTM and PGR at least 15 calendar days prior to commencing work onsite. No equipment shall be delivered and no labor shall be dispatched until written confirmation has been obtained from the GTM that the location is ready for work to commence.

11.2.5. The Contractor shall install and integrate all hardware, software, and equipment at the five installation locations (PGR agencies or sub-agencies all within Mexico City), in accordance with OEM recommended specifications and installation instructions. All services shall be performed in Spanish.

11.2.6. Upon completion of installation and integration at each location, the contractor shall perform operational capability testing to ensure compliance with all contract requirements and proper operation of all hardware and software. Upon successful completion of required testing the Contractor shall provide the COR and GTM a complete inventory of all items delivered and installed at each location and the results of the operational capability tests.

The contractor shall deliver a testing plan for Government review and approval. All testing shall be conducted in accordance with the approved testing plan.

11.3. Training. The contractor shall provide training for GoM personnel after operational status of equipment and software has been achieved. Training shall be limited to 25 GoM employees. The training classes shall be conducted in Spanish and all training materials shall be provided in Spanish, when available from the equipment manufacturer. The training shall cover system operation, administration, and maintenance.

11.4. Warranty. The Contractor shall provide a 2-year local onsite warranty on all hardware and software components. For software the contractor shall also provide all updates and patches that are released by the manufacturer for the duration of the warranty period. All services under the warranty will be performed in Spanish. The warranty shall supply phone support, onsite component replacement and/or problem resolution, as needed.

11.5. Project Closeout. The contractor shall provide complete documentation for all hardware and software delivered under this contract. At a minimum the closeout documentation must include:

· Installation diagrams detailing cable layouts, rack locations and installed equipment for the system.

· Equipment configurations and schematic wiring plans.

· Manufacturer user and administration manual of all hardware and software.

· Description of training provided and attendance information for GoM personnel.

· Results of Operational Capability tests.

· Equipment and software warranty documentation. Documentation shall include an explanation of coverage, the process to obtain warranty service, and all applicable manufacturer/distributor contact information.

· Project Completion Certificate signed by COR, PGR Principal Project Officer, and the Contractor Representative.

12. QUALITY ASSURANCE.

12.1. Quality Control Plan. The Contractor shall establish a quality control program/plan that shall be submitted as a part of its comprehensive Project Management Plan. The Contractor shall implement and adhere to the approved quality control program/plan when performance begins, and throughout the performance period. The Contractor shall provide the Contracting Officer updates of the quality control plan as changes occur. As a minimum, the quality control plan shall include the following:

12.1.1. An inspection system covering all services required by the contract. It shall specify the services to be inspected on both a scheduled or unscheduled basis, how often inspections will be accomplished, and the tasks of the individuals who will perform the inspections.

12.1.2. A method of identifying deficiencies in the quality of services performed before the level of performance becomes unacceptable.

12.1.3. A method of documenting and enforcing quality control operations.

12.1.4. A customer complaint program. The program shall include:

12.1.4.1. A way for customers to report complaints, deficiencies, and noncompliance with the terms and conditions of the contract. The medium chosen by the Contractor shall be easily accessed by PGR personnel.

12.1.4.2. A description of the manner in which the Contractor shall promptly investigate any customer complaint and respond to the customer. The Contractor shall forward a monthly synopsis of complaints received and actions taken to the COR not later than 5 days after the end of each month.

12.2. Quality Control Records. Records of all inspections conducted by the Contractor and necessary corrective actions taken shall be maintained by the Contractor. The Contractor shall make these documents available to the Government throughout the term of this contract.

12.3. This Quality Assurance and Surveillance Plan (QASP) is designed to provide an effective surveillance method to promote effective Contractor performance. The QASP provides a method for the COR to monitor Contractor performance, and advise the Contracting Officer of unsatisfactory performance. The Contractor, not the Government, is responsible for management and quality control to meet the terms of the contract. The role of the Government is to conduct quality assurance to ensure that contract standards are achieved.

Negative Incentive:

Low rating in CPARS; appropriate action under the inspection and termination clauses of the contract.

Performance: number of valid written complaints during the month.

Deliverables and reports are high quality, complete, and timely.

Deliverables and reports are written clearly and concisely, comply with all contract requirements, and are professionally sound.

Deliverables and reports are timely distributed to all parties identified in the contract.

Spell and grammar checks are accomplished on all deliverables.

No deliverables or reports are submitted late.

No more than three (3) deliverables require resubmission during the entire contract period of performance.

Negative Incentive:

Low rating in CPARS; appropriate action under the inspection or termination clauses of the contract.

Number of deliverables or reports that are either untimely or not in accordance with contract requirements.

12.4. Surveillance. The COR will receive and document all complaints from Government personnel regarding the services provided. If appropriate, the COR will send the complaints to the Contracting Officer for transmittal to the Contractor for corrective action.

12.5. Standard. The performance standard is that the Government receives no more than one (1) customer complaint per month. The COR shall notify the Contracting Officer of the complaints so that the Contracting Officer may take appropriate action to enforce the applicable inspection clause, if any of the services exceed the standard.

12.6. Procedures.

12.6.1. If any personnel observe unacceptable services, either incomplete work or required services not being performed, they should immediately contact the COR.

12.6.2. The COR will complete appropriate documentation to record the complaint.

12.6.3. If the COR determines the complaint is invalid, the COR will advise the complainant. The COR will retain the annotated copy of the written complaint for his/her files.

12.6.4. If the COR determines the complaint is valid, the COR will inform the Contracting Officer who will contact the Contractor and give the Contractor additional time to correct the defect, if additional time is available. The Contracting Officer shall determine how much time is reasonable.

12.6.5. The Contracting Officer shall, as a minimum, notify the Contractor by email of any valid complaints.

12.6.6. If the Contractor disagrees with the complaint and challenges the validity of the complaint, the Contractor shall notify the Contracting Officer. The Contracting Officer will review the matter to determine the validity of the complaint.

12.6.7. The Contracting Officer will consider complaints as resolved unless notified otherwise by the complainant.

12.6.8. Repeat customer complaints are not permitted for any services. If a repeat customer complaint is received for the same deficiency during the service period, the COR will contact the Contracting Officer for appropriate action under the Inspection clause.

12.6.9. If the contractor fails to meet the performance standard, the Government reserves the right to take action under the Inspection clause, including a deduction from the invoice.

APPENDIX A – Supplies and Services – PGR Data Loss Prevention Solution