Tab 3c_SOW.pdf

PR #: 75110PR220000428

STATEMENT OF WORK

LAST UPDATED: XX/XX/XXXX PAGE 1/10

STATEMENT OF WORK (SOW)

FOR

SMTC Firearms Training Simulator Defense Information Systems Agency (DISA) Windows 10 Long Term Servicing Channel

(LTSC) Operating System Install & Acceptance Test

1.0 GENERAL

1.1 BACKGROUND

Existing Firearms Training Simulator (FATS) is utilized to train 64% of all students for all initial weapons training.

1.2 SCOPE

The installation of the Defense Information Systems Agency (DISA) Windows 10 Long Term Servicing Channel (LTSC) Operating System will bring the FATS, a critical training tool, in compliance with DISA and Coast Guard standards for Off-Network information technology equipment. The goal is to use a Coast Guard-provided Windows 10 OS that removes certain features from the commercially available Windows 10 operating system which present security vulnerabilities to be in compliance with Department of Defense requirements. Without this simulation system, the training provided would have to be converted to a live fire environment, increasing logistical, financial and manpower requirements considerably.

1.3 OBJECTIVE

The Contractor must use and install the USCG-provided Windows10 operating system to the FATS simulator system. The Contractor shall make any software or hardware modifications required to ensure the FATS systems will maintain all existing functionality after all the FATS computers have been upgraded to Coast Guard-provided Windows 10 OS.

2.0 SPECIFIC REQUIREMENTS/TASKS

The Contractor shall preform the following tasks regarding installation of the USCG-provided DISA Windows 10 LTSC Operating System (OS) on existing FATS simulator system, located at SMTC and testing thereafter. The Contractor shall make the necessary modification to the FATS system and software and ensure compatibility and fully functional with the installed DISA Windows 10 LTSC Operating System.

2.1 Installation of Coast Guard Windows 10 Operating System.

2.1.1 The Contractor must use and install the USCG-provided Windows10 operating system to the FATS simulator system.

2.1.2 The Coast Guard Windows 10 OS, for the purposes of this SOW has been designated as Sensitive But Unclassified (SBU), “For Official Use Only (FOUO)” and as an “Information Technology Resource.” The Coast Guard Windows 10 OS is the only information, to which the contractor will have access, that is Sensitive or FOUO.

2.1.3 The Contractor shall conform to SBU handling and access requirements per CG policy or physical security and force protection program COMDTINST M5530.

2.2 Testing and Modifications.

file://///hqnas/SHARED/G-A/G-ACS/CAAT%20Team/TOOLBOX/SCOPE%20PARAGRAPHS.doc

LAST UPDATED: XX/XX/XXXX PAGE 2/10

2.2.1 The Contractor shall conduct System Verification testing of the FATS system using the designated Coast Guard-provided Windows 10 OS to ensure the FATS system and software meets the specified system requirements.

2.2.2 The Contractor shall make any software or hardware modifications required to ensure the FATS systems will maintain all existing functionality after all the FATS computers have been upgraded to Coast Guard-provided Windows 10 OS. Any modifications the contractor makes or requires to be made to the default settings of the image shall be reported to STMC Technical Representative.

2.2.3 No Later than 15 calendar days following completion of System Verification testing, the contractor shall submit a sufficiently detailed Windows 10 Test and Evaluation report detailing the result of the testing to STMC Technical Representative.

2.2.4 The Contractor shall develop and work with USCG to conduct a customer-witnessed User Acceptance Test, of each FATS to ensure the FATS systems meet all functional requirements for SMTC’s training.

2.2.5 Successful completion of installation and testing will be determined by Government acceptance of a System Verification Test and User Acceptance Test for each FATS system.

3.0 CONTRACTOR PERSONNEL

Shall provide personnel for onsite setup, installation, and system testing, calibration, and reporting. It is the responsibility of the contractor to propose qualified contractor personnel to perform all requirements specified in the SOW.

3.1 QUALIFIED PERSONNEL

The Contractor shall provide qualified personnel to perform all requirements specified in this

SOW.

3.2 CONTINUITY OF SUPPORT

The Contractor shall ensure that the contractually required level of support to install and test the FATS system for this requirement is maintained at all times. The Contractor shall ensure that contractor personnel are present for the specified hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to SMTC Technical Representative prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 KEY PERSONNEL

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note:

The Government may designate additional Contractor personnel as Key at the time of award.

LAST UPDATED: XX/XX/XXXX PAGE 3/10

3.3.1 Contractor Key personnel shall not be assigned by the Contractor to more than one key position for this requirement.

3.4 PROJECT MANAGER

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW. The Project Manager shall be a single point of contact for the Contracting Officer and the Technical Representative. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the Project Manager without prior approval from the Contracting Officer.

3.4.1 The Project Manager shall be available to the Technical Representative via telephone between the hours of 0800 and 1600 EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 36 hours of notification.

3.5 EMPLOYEE IDENTIFICATION

3.5.1 Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

3.5.2 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

3.6 EMPLOYEE CONDUCT

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

3.7 REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons.

Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

LAST UPDATED: XX/XX/XXXX PAGE 4/10

4.0 OTHER APPLICABLE CONDITIONS

4.1 SECURITY

Contractor access to classified information is not currently required under this SOW. Contractor access to classified information is not currently required under this SOW. Under this task order, the Contractor will require regular physical access to the U.S. government facilities. Therefore, contractor personnel will be required to undergo a security check and obtain a Common Access Card (CAC). This task order will involve access to Government IT systems and Sensitive but Unclassified Information (SBU) in performance of tasking

4.1.1 FACILITY AND COMPUTER ACCESS

The following applies when the contractor(s) are required to access a Coast Guard, Department of Defense, or other federally-controlled computer information system(s), or needs public key infrastructure (PKI) authentication to perform their contractual duties, or requires physical access to multiple Coast Guard facilities on a recurring basis. USE THE FOLLOWING

VERSION IN PLACE OF WHAT IS CURRENTLY AT CGAP SUBCHAPTER 3004.1301-90

Contract Clause.

Trusted Associate Sponsorship System (TASS)

(a) "Contractor employee" means an employee of a firm, or an individual, under contract or subcontract to the Coast Guard to provide services who also requires one or more of the following:

Physical access to multiple Coast Guard facilities or multiple federally controlled facilities on behalf of the Coast Guard on a recurring basis (a minimum of 2 times per week and/or 8 times per month) for a period of 6 months or more.

Remote access, via logon, to Coast Guard network using Coast Guard-approved remote access procedures.

Both physical access to Coast Guard facility and logical access, via logon, to Coast Guard networks on-site or remotely. Access to the Coast Guard network must require the use of a computer with Government-controlled configuration or use of Coast Guard-approved remote access procedure in accordance with the Defense Information Systems Agency (DISA) Security Technical Implementation Guide.

(b) Homeland Security Presidential Directive (HSPD)-12 mandates a Federal standard for secure and reliable forms of identification for Federal employees and contractor employees. The Common Access Card (CAC) is a personal identification card for the Department of Defense/Uniformed Services and complies with HSPD-12. The Coast Guard has instituted the CAC as its HSPD-12 compliant personal identification card for contractor and subcontractor employees who are required to access a Coast Guard, Department of Defense (DOD), or other federally-controlled computer information system and/or facility, or need public key infrastructure (PKI) authentication to perform their contractual duties. The Trusted Associate Sponsorship System (TASS) is the automated application process for obtaining a CAC.

(c) Contractor and subcontractor employees working pursuant to this contract who are required to access a Coast Guard, DOD, or other federally-controlled computer information system https://www.dhs.gov/homeland-security-presidential-directive-12

LAST UPDATED: XX/XX/XXXX PAGE 5/10

and/or facility, or need PKI authentication to perform their contractual duties shall use TASS to obtain a CAC.

(d) The Contracting Officer Representative (COR) or Assisting Contracting Officer Representative (ACOR) is the TASS Trusted Agent (TA) and initiates contractor accounts in the TASS, approving, returning, or rejecting CAC applications (as applicable); re-verifying assigned contractors every six months; revoking contractor and employee eligibility for a CAC.

(e) The TA ensures that contractor personnel satisfy the security requirements for CAC issuance prior to creating the CAC application in TASS. Current investigative requirements shall be verified according to Commandant Instruction COMDTINST 5500.18, Coast Guard Trusted Associate Sponsorship System. The initial CAC issuance requires a favorably adjudicated Tier 1 investigation (equivalent or higher) or a Tier 1 background investigation (BI) (equivalent or higher) package that has been successfully scheduled with the investigative service provider (ISP) and a FBI fingerprint check with favorable results. The TA and Sponsor or other appropriate Federal Government representative must coordinate with the unit BI Verifier (Command Security Officer /Trusted Agent Security Manager) or the U.S. Coast Guard Security (SECCEN) to confirm the appropriate investigation has been favorably adjudicated or scheduled at the ISP with favorable FBI fingerprint results.

(f) STMC Technical Representative or Contracting Officer provides such forms to, or requests such information from, contractor employees that may be necessary for obtaining a CAC via the TASS. The Contractor submits completed forms and information as directed by the STMC Technical Representative or Contracting Officer. Contractors are responsible for the accuracy and completeness of the information submitted and for any liability resulting from the Government's reliance on inaccurate or incomplete information.

(g) Contractor employees who are declined via the TASS are ineligible to perform work under this contract.

(h) When an employee with a CAC is no longer performing work under this contract, the employee must return the CAC to the STMC Technical Representative /TA or Contracting Officer on the same day the employee stops working.

(i) The contractor shall insert this clause in all subcontracts when a subcontractor's employee is required to access a Coast Guard, DOD, or other federally-controlled computer information system and/or facility, or need PKI authentication to perform contractual duties.

(End of Clause)

4.1.2 CONTRACTOR PROPOSED CYBER/ IT-RELATED SOLUTIONS

The offeror or contractor shall identify all cyber/IT-related hardware, software and/or services that are included as part of its solution to the government’s requirement to store or process Coast Guard data or connect to Coast Guard networks or other assets. The offeror or contractor shall provide this information in an electronic delimited file format (for example, csv file, docx table, xlsx table, rtf table or HTML file) as follows in its government response to the solicitation.

Contractor Proposed Cyber/IT Related Solutions for CG-6 Review

Product Manufacturer Version Release Quantity Brief Cost Recurring

LAST UPDATED: XX/XX/XXXX PAGE 6/10

Name or Service or Company (if any) (if any) (if any) Description (If not FFP.

Contractor is responsible for also ensuring inclusion in the cost proposal) or Non- Recurring?

If recurring, state frequency

4.2 PERIOD OF PERFORMANCE

The period of performance for this contract shall not exceed 90 calendar days from the date of award.

4.3 PLACE OF PERFORMANCE

The primary place of performance will be the United States Coast Guard Special Missions Training Center, BB-6, Camp Lejeune, NC 28542

4.4 HOURS OF OPERATION

Contractor employees shall generally perform all work between the hours of 0800 and 1600 EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this SOW.

4.5 TRAVEL

4.6 POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the Contracting Officer and the Technical Representative no later than 10 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility, located at USCG SMTC Camp Lejeune, NC or via teleconference.

4.7 PROJECT PLAN

The Contractor shall provide a draft Project Plan at the Post Award Conference for Government review and comment. The plan, at a minimum, shall include: (a) list of work to be performed;(b) project schedule; (c) description of intended results; (d) role of key personnel, if applicable and

(e) how quality of service (project) will be maintained throughout life of contract. The Contractor shall provide a final Project Plan to the Technical Representative not later than 20 business days after the Post Award Conference.

4.8 BUSINESS CONTINUITY PLAN

LAST UPDATED: XX/XX/XXXX PAGE 7/10

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government.

The BCP Plan shall be due 30 business days after the date of award, and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

A description of the Contractor’s emergency management procedures and policy

A description of how the Contractor will account for their employees during an emergency

How the Contractor will communicate with the Government during emergencies

A list of primary and alternate Contractor points of contact, each with primary and alternate:

Telephone numbers E-mail addresses

4.9 PROGRESS REPORTS

The Project Manager shall provide a weekly progress report to the Contracting Officer and Technical Representative via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

4.10 PROGRESS MEETINGS

The Project Manager shall be available to meet with the Technical Representative upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place via teleconference.

4.11 GENERAL REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Microsoft Office Applications).

4.12 PROTECTION OF INFORMATION

Contractor access to sensitive information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement (DHS Form 11000-6). Further, sensitive information shall be protected in accordance to DHS Class Deviation 15-01 for proper handling and safeguarding of the security of all such USCG information, as defined in the terms and conditions of this task order.

4.13 SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

LAST UPDATED: XX/XX/XXXX PAGE 8/10

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05- 001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

4.13.1.1 Section 508 Requirements for Technology Services

When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance. The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

When developing or modifying software functions of ICT, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including the requirements in Chapter 5 and WCAG 2.0 Level A and AA Success Criteria). When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall demonstrate conformance to the Functional Performance Criteria specified in Chapter 3. The Contractor shall use a test process capable of validating conformance to all applicable Section 508 standards for software functionality delivered pursuant to this contract. The Contractor may utilize the DHS Trusted Tester Methodology for Web and Software Version 4.0 as a component of the overall test process used. This version of the test process provides partial test coverage of the Section 508 standards that apply to software. If the Contractor uses this test process, the Contractor shall address the test coverage gaps through additional test procedures. Information on the DHS Trusted Tester Methodology for Web and Software Version 4.0, including coverage against the applicable Section 508 standards for software as well as gaps that need to be addressed

LAST UPDATED: XX/XX/XXXX PAGE 9/10

through other test methods, related test tools, and training is published at https://www.dhs.gov/trusted-tester.

4.13.1.2 Section 508 Deliverables

Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards.

The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat.

Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

5.0 GOVERNMENT FURNISHED RESOURCES

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources.

The Government will provide the following property to the Contractor for work required under this contract:

Coast Guard Windows 10 Image (DISA Windows 10 LTSC operating system), Qty: 3

6.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 2.0 and SOW 5.0.

7.0 GOVERNMENT ACCEPTANCE PERIOD

The Technical Representative will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the Technical Representative will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

7.1 The Technical Representative will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

The following paragraphs are highly recommended, but not required. If you decide not to include these paragraphs, you will need to specify Government review times and Contractor https://www.dhs.gov/trusted-tester

LAST UPDATED: XX/XX/XXXX PAGE 10/10

response times in the Deliverables chart in SOW 9.0 in the “Due By” column.

7.2 The Technical Representative will have 30 business days to review deliverables and make comments. The Contractor shall have 45 business days to make corrections and redeliver.

7.3 All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review.

The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

8.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to next deliverable or event in this SOW.

ITEM

SOW

REFERENCE

DELIVERABLE / EVENT DUE BY

DISTRIBUTION

1 4.6 Post Award Conference 10 business days after the date of award

N/A

2 4.6, 4.7 Draft Contractor Project Plan

20 business days after the Post Award Conference.

Technical Representative, Contracting Officer

3 4.7 Final Contractor Project Plan

20 business days after the Post Award Conference.

Technical Representative, Contracting Officer

4 4.8 Original Business Continuity Plan

30 business days after the date of award

Technical Representative, Contracting Officer