W25G1V22C0019 Award.pdf

SEE ADDENDUM

(No Collect Calls)

W25G1V22R0038 07-Jul-2022

b. TELEPHONE NUMBER

570-615-7671

8. OFFER DUE DATE/LOCAL TIME

04:30 PM 08 Aug 2022

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

X

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.610-960-0318

W25G1V9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

W25G1V22C0019 26-Aug-2022

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

PATRICIA M REX

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

W25G1V211500VM

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

STEPHANIE M. COLEMAN / CONTRACT SPECIALIST

See Schedule $442,450.00

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS: SEE SCHEDULE

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE 4MR83 4MR83FACILITY

OFFEROR CODE

ACC-APG, TOBYHANNA DIVISION

11 HAP ARNOLD BLVD

TOBYHANNA PA 18466-5100

ALTA ENTERPRISES, INC.

MR. PETER ROUMELIOTIS

2600 E SAUCON VALLEY RD

CENTER VALLEY PA 18034-9418

DFAS COLUMBUS

DFAS COLUMBUS

DFAS-ROCK ISLAND / JAIQBAC

P. O. BOX 182316 ATTN: ROCK ISL

COLUMBUS OH 43218-2316

18a. PAYMENT WILL BE MADE BY CODE HQ0303

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

W25G1VCODE15. DELIVER TO CODE W25G1V 16. ADMINISTERED BY

Net 30 Days

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

ACC-APG, TOBYHANNA DIVISION

PATRICIA REX 570-615-7671

PATRICIA.M.REX.CIV@ARMY.MIL

FAX 570-615-6794

TOBYHANNA PA 18466-5100

SEE BELOW FOR SEPARATE SHIPPING INSTRUCT

XXX

XXX PA 00000

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

NAICS:

333517

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

X

EMAIL: stephanie.m.coleman17.civ@army.mil

570-615-5043TEL:

31c. DATE SIGNED

26-Aug-2022

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF73

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W25G1V22C0019

Section SF 30 - BLOCK 14 CONTINUATION PAGE

AWARD

The following constitutes award on solicitation W25G1V-22-R-0038:

1. This award document W25G1V-22-C-0019.

2. Alta Enterprises lnc.'s signed SF1449 dated 08 August 2022, inclusive of representations and certifications although not physically attached are incorporated by reference.

3. Alta Enterprises lnc.'s Responses to Clarification Email dated 17 August 2022.

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each $442,450.00 $442,450.00

CNC VERTICAL MACHINING CENTER

FFP

HURCO Part Number VMX84I-40 See Statement of Work for detailed Specs, Supply, Delivery and Install

Point of Contact Michael Sudimak 570-615-8420 or michael.j.sudimak.civ@army.mil

Delivery will be to:

Tobyhann Army Depot Building 1C, Bay 2 11 Hap Arnold Blvd.

Tobyhanna, PA 18466 POC: Mr. Michael Sudimak - 570-615-8420 FOB: Destination

NSN: VMX84I-40TAPER:1KVM6

MILSTRIP: W25G1V211500VM

VENDOR PART NR: VMX84I-40

PURCHASE REQUEST NUMBER: W25G1V211500VM

PSC CD: 3417

NET AMT $442,450.00

ACRN AA

CIN: W25G1V211500VM0001

$442,450.00

STATEMENT OF WORK

Statement of Work for Computer Numerical Controlled (CNC) Vertical Machining Center (VMC) for Tobyhanna Army Depot

1.0 General Scope

1.1 This Statement of Work (SOW) is for the turn-key design, supply, delivery, off-loading, transporting, locating, installation, cleaning, assembly, set-up and training for one each Computer Numerical Controlled (CNC) Vertical Machining Center (VMC) at Tobyhanna Army Depot (TYAD) in Tobyhanna, PA 18466. The Contractor shall supply all materials, supplies, freight, delivery, tools, equipment, consumables, labor, and supervision for the turn-key design, supply, delivery, off-loading, transporting, locating, installation, cleaning, assembly, set-up and training for the machine. The Contractor shall also disconnect an existing VMC and transport it to another Building on site. The Contractor will also be responsible for disconnecting all equipment associated with the central coolant filtration system on the existing VMC and turning such equipment over to the Government for future use. The Contractor shall supply only new machines and new associated equipment. Used and refurbished machines and used and refurbished equipment are unacceptable and will not be considered. All repair and replacement parts for the machine and associated equipment shall be new. All repair and replacement parts shall be available for purchase and supplied from within the continental United States.

1.2 The Contractor shall provide machine operation and machine maintenance training for Government personnel. Training shall be conducted by the Contractor’s qualified training representative and shall be conducted on-site at the machine location in Bldg. 1C Bay 2 at TYAD. This training shall focus on basic operations, programming, preventive maintenance, general maintenance, cleaning and housekeeping, and features familiarization. Instruction shall also include the maintenance that needs to be done by machine operators on a daily basis. All materials used during training shall become the property of TYAD.

1.3 The Bldg. 1C Bay 4 cargo door is the closest and most easily accessible door to the project installation worksite in Bldg. 1C Bay 2. The Contractor shall verify cargo door access dimensions. The Contractor shall be responsible to ensure that all material fits through this opening. All material handling equipment that is used by the Contractor, likewise, shall fit through this clearance WHILE MOVING AND HANDLING all material that is being delivered.

1.4 Power available for the machine is both 208V/3 Phase/60Hz and 480V/3 Phase/60 Hz. For machines that are not designed and constructed for this power, the Contractor shall supply, install and connect the necessary transformers that permit the use of this available power by the machine.

1.5 It shall be the responsibility of the Contractor to verify all machine and worksite dimensions and ensure the machine and ancillary pieces fit and can be operated normally within the available floor space at the project installation worksite in Bldg. 1C Bay 2. The Contractor shall be responsible to verify overhead clearance dimensions for the machine and ancillary pieces at the project installation worksite in Bldg. 1C Bay 2. The general available site footprint space is 18 feet by 25 feet and is 13.5 feet high. Within this footprint is a support post for the connections to the central coolant filtration system that may require relocation along with the coolant plumbing piping and controls attached thereto. Should relocation of the central coolant filtration system components be necessary, their relocation shall be prior approved by the Government representative.

1.6 TYAD currently uses CNC Software’s MasterCAM Computer-Aided Manufacturing (CAM) software for the programming of all on-site VMCs. The Contractor shall ensure the Contractor-proposed and the Contractor-installed VMC shall be CNC programmable using MasterCAM Computer- Aided Manufacturing (CAM) software. It shall be the responsibility of the Contractor to develop and supply the appropriate post-processor to achieve the necessary CNC programming compatibility. The Contractor’s post-processor shall be given to Automation Support Branch personnel by the Contractor in accordance with section 3.0 Cyber Requirements for loading onto the Government network.

1.7 A site visit will be scheduled and it is advised that interested Contractors attend. The site visit is for the purpose of interested Contractors to consider the layout and floor space of the project area and to enable the viewing of the delivery, utility and installation sites. The site visit shall be used by the Contractors to identify structures or conditions that may impede, obstruct or prevent completion of the work. It shall be the responsibility of the Contractor to identify obstructions and impediments to the project and to make appropriate accommodations for correction and modification to mitigate the problem. If a corrective measure conflicts with other requirements listed in the SOW or is outside the work area the Contractor shall identify these issues in the proposal submittal to the Government. Answers not contained in the SOW to all questions that are raised during the site visit shall be submitted in writing. Should the Contractor fail to identify an obstruction and hindrance to the project that is identifiable from a site visit the Contractor shall provide a solution to the problem that is to the satisfaction of the Government and at no additional cost to the Government. It shall be the responsibility of the Contractor for all dimensioning of the system including all auxiliary pieces and materials. It shall be the responsibility of the Contractor to supply his personal protective equipment (PPE) for the site visit. At a minimum, the PPE needed is protective eyewear, hearing protection and protective footwear. A Contractor in non-compliance with the PPE requirement will not be permitted on the site visit.

1.8 Following installation completion and prior to Final Acceptance the Contractor shall supply to the Contracting Officer’s Representative (COR) a computer-aided design and drafting (CADD) as-built drawing of the installed machine in Bldg. 1C Bay 2. The drawing shall be furnished in both .pdf and .dwg format to the CPOC and shall also be provided in hardcopy, ANSI D paper sized 22”x34”, in triplicate.

1.9 The Contractor shall agree that the system being purchased is considered an Information Technology (IT) asset to be operated at a Government facility and as such must adhere to all local and Government regulations outlined in this document under section 3.0 Cyber Requirements.

1.10 TYAD currently uses TYAD Distributed Numerical Control (DNC) software for machine code programming file transfer of all on-site VMCs. The Contractor shall ensure the Contractor-proposed and the Contractor-installed VMC shall be compatible with TYAD DNC. It shall be the responsibility of the Contractor to develop and supply any necessary hardware and/or software to support this.

1.11 The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

2.0 Minimum Specifications, Characteristics and Features for the Machine

1. The machine shall have both conversational and numerical control programming capability.

2. X-axis travel shall be 83.5-86.0 inches.

3. Y-axis travel shall be 34.0-35.0 inches.

4. Z-axis travel shall be 30.0-31.0 inches.

5. All axes shall incorporate direct drive servos.

6. Table working surface shall be 84.0-86.0 inches by 34.0-35.0 inches.

7. X, Y and Z positioning accuracy shall be at least +/- 0.0002 inches or better by 10 pass

VDI 3441 Method.

8. Repeatability of all axes shall be at least +/- 0.0001 inches or better by 10 pass VDI 3441

Method.

9. The machine shall allow programming in increments of 0.0001 inches or less.

10. Maximum cutting feed rate shall be at least 500 inches per minute. Rapid transverse for

X and Y shall be at least 700 inches per minute and 500 inches per minute for Z.

11. The machine shall also be equipped with a remote jog control with a display screen.

12. Spindle nose-to-table distance shall be 5.0, or less, to 35.0, or more, inches.

13. Table shall be furnished with seven each T-Slots, minimum, evenly spaced across the table.

14. Table shall have a weight capacity of 5,000 pounds, minimum.

15. Spindle taper shall be Big Plus Dual Contact CAT40.

16. The spindle shall be designed to permit a continuous spindle speed range from 15 to

12,000 rpm, minimum.

17. The spindle shall be 24 horsepower one minute rating, minimum.

18. The spindle shall be direct drive.

19. The spindle shall have a bearing lubrication system.

20. The automatic tool changer (ATC) shall have 40 tool minimum, CAT40, capacity. Tool to tool change time shall be two (2) seconds or less.

21. The maximum tool diameter shall be at least three (3) inches

22. The maximum tool length shall be at least 11.75 inches.

23. The machine shall be equipped with a flood coolant and wash down system. The

Contractor shall furnish and install all filters and pumps for the system.

24. The machine shall be equipped with a through-spindle coolant delivery system that provides up to 300 psi, minimum, coolant to the cutting tool. Any retention devices shall also be provided. The Contractor shall furnish and shall install all filters and pumps for the through-spindle coolant delivery system.

25. The machine shall be equipped with linear thermal compensation.

26. The machine controls shall be temperature controlled within their normal operating range.

27. The machine shall be equipped with door and window interlocks. The machine spindle shall automatically cease operation while the machine doors and windows remain in an open position. The spindle shall resume operation only upon closing of all doors and windows.

28. The machine shall be equipped with a three-color (red, amber/yellow, green) and on light visible from the operator position.

29. The machine shall be equipped with a automatic centralized lubrication system and a way lubricant separation system.

30. The machining area shall be enclosed and equipped with an integrated coolant mist collection system that clears the coolant mist generated during the machining process from the enclosed machining area.

31. The coolant mist collection system shall be activated and powered by the machine.

32. The machine shall be equipped with high-intensity lighting that can be adjusted by the machine operator to illuminate the entire machining area.

33. The high-intensity lights shall be integrated to turn ON when the machine doors open and turn OFF when the machine doors close.

34. The high-intensity lights shall permit manual turning ON and turning OFF by the machine operator.

35. The machine shall provide a system capable of granular access permissions. Granular access permissions are used to grant system privileges, allowing you to construct site-specific roles with privileges to match your requirements. Required system privileges capable of this should include but are not limited to: running machine code programs, editing machine code programs, editing machine parameters, and administrative machine functions. The system must accommodate the following roles at a minimum: Operator, Setup Technician, and Administrator.

36. The machine shall be equipped with an air blast system to permit the removal of chips during dry machining operations.

37. The machine shall be equipped with an automatic chip extractor auger or conveyor system for removal of chips from the machining area.

38. The machine shall come equipped with Renishaw tool and part probing capability. Part probing shall determine a part’s position regardless of orientation.

39. Machine shall come equipped with an oil skimmer system.

40. The machine shall be capable of importing data from Computer Aided Design (CAD)

.dxf files.

41. Programming shall allow the machining of pockets with islands and boundaries as well as permitting a helical ramp feature when plunging.

42. The machine shall allow features from a numerically controlled (NC) program to be brought into a conversational program.

43. The conversational programming shall allow a two dimensional shape to be moved along a contour to create a surface using the conversational program.

44. The machine shall have solid model 3D import capability.

45. The machine shall be able to save tool and material parameters for multiple and future use.

46. The machine shall include a monitoring and self-diagnostics feature to aid in troubleshooting.

47. The primary method of sending and receiving files shall be over serial RS-232 communication. Other methods can exist but cannot be used in place of RS-232.

48. The machine shall at minimum be proven to receive files from Tobyhanna’s DNC system. The system sends files over serial RS-232 from a Tobyhanna provided workstation using a method commonly known as drip-feeding.

3.0 Cyber Requirements

3.1 Applicable Publications

The Vendor, and all sub-contractors, must abide by all applicable regulations, publications, manuals, and local policies and procedures. This includes, but is not limited to; AR 25-1 as well as STIGs and SRGs as published on https://public.cyber.mil.

3.2 Acronyms

AO Approving Official AR Army Regulation APMS Army Portfolio Management System ARCYBER United States Army Cyber Command ASB Automation Support Branch ATO Authority to Operate CCB Configuration Control Board CD Compact Disc CMVP Cryptographic Module Validation Program COOP Continuity of Operations COR Contracting Officer Representative COTR Contracting Officer’s Technical Representative CPLD Complex Programmable Logic Device CSR Certificate Signing Request DISA Defense Information Systems Agency DOD United States Depart of Defense ELTY Electronic Tobyhanna Army Depot Form eMASS Enterprise Mission Assurance Support Service EULA End User License Agreement FIPS Federal Information Processing Standard FPGA Field Programmable Gate Array GIG Government Information Grid HBSS Host Based Security System IAVA Information Assurance Vulnerability Alert IAVB Information Assurance Vulnerability Bulletin ICAN Internal Campus Area Network IMD Information Management Division IRB Industrial Review Board IS Information System IT Information Technology NETCOM United States Army Network Enterprise Technology Command NIST National Institute of Standards and Technology OEM Original Equipment Manufacturer PKI Public Key Infrastructure PLC Programmable Logic Controller RMF Risk Management Framework SD Secure Digital SME Subject Matter Expert

SOW Statement of Work SRG Security Requirements Guide STIG Security Technical Implementation Guide TRC Technical Review Cell USB Universal Serial Bus USCYBERCOM United States Cyber Command

3.3 Definitions

This section contains explanations of terms used in this document. They are taken from, and not to supersede, those definitions given in Army Regulation (AR) 25-1. All terms used in this document are in accordance with AR 25-1. This section shall be considered the authoritative source for definitions of terms not contained within AR 25-1 and/or its supporting documents.

3.3.1 Automation Support Branch

The Automation Support Branch (ASB), under the Mission Support Division, under the Directorate of Production Engineering, is the single point of contact for all mission-related IT equipment at TYAD. The ASB develops, protects, and maintains specialty IT equipment, both networked and standalone, in support of unique workloads across TYAD.

3.3.2 Configuration Control Board

The Configuration Control Board (CCB) is the local approving authority, composed of Supervisory personnel, for all actions regarding IT equipment at TYAD. Receiving an ATO for an IT equipment, from NETCOM, does not automatically guarantee that the system can be utilized at TYAD. The IT equipment must also obtain approval from the TYAD CCB, before it may be used with Army ISs at TYAD. The CCB is the local entity responsible for approving the STIGs and SRGs deemed applicable by the TRC, before the ATO accreditation package is submitted to NETCOM for approval.

3.3.3 Government

Any federal civilian, or military personnel employed by the United States Department of Defense (DOD), United States Army (Army), and/or Tobyhanna Army Depot (TYAD).

3.3.4 Industrial Review Board

The Industrial Review Board (IRB) is the local governing body that oversees all industrial mission assets to ensure compliance with TYAD production requirements. Composed of SMEs from the Directorates of Production Engineering (D/PE) and Systems Integration and Support (D/SIS), the IRB collects requirements, reviews contracting documents, plans industrial capabilities, and oversees contract implementation in alignment with current and future production needs. The three voting members of the IRB are the Division Chiefs for the Mission Support Division, Design, Development and Fabrication Division, and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) Finishing Division.

3.3.5 Information Management Division

Part of the Directorate of Installation Services, the Information Management Division (IMD) is responsible for the development, protection, and maintenance of the TYAD SBU LAN. The IMD operates all critical infrastructure upon which TYAD’s IT equipment operate.

3.3.6 Information System

Information System (IS) is defined as the organized collection, processing, transmission, and dissemination of information in accordance with defined procedures, whether automated or manual. For the purposes of Army Portfolio Management System (APMS), the terms "application" and "information system" are both IT investments describing a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (see JP 1–02).The application of IT to solve a business or operational (tactical) problem creates an information system.

3.3.7 Information Technology

Information technology (IT) is any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used directly or is used by a contractor under a contract with the executive agency, which 1) requires the use of such equipment; or 2) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term "information technology" also includes computers, ancillary equipment, software, firmware, and similar procedures, services (including support services), and related resources. The term "information technology" does not include any equipment that is acquired by a Federal contractor incidental to a Federal contract. (Reference 40 USC Subtitle III (Clinger-Cohen Act of 1996).)

3.3.8 Technical Review Cell

Composed of technical experts from both the ASB, and IMD, the Technical Review Cell (TRC) conducts the preliminary review of all actions, related to IT equipment at TYAD, prior to either ATO submission, or CCB approval. The TRC is responsible for determining which security technical implementation guides (STIGs), and security requirements guides (SRGs) are applicable to a given system, based on the direction given by NETCOM, and higher headquarters.

3.3.9 Tobyhanna Army Depot

Tobyhanna Army Depot (TYAD) is responsible for the development, and protection of the TYAD Internal Campus Area Network (TYAD-ICAN). To obtain an ATO, all IT equipment Vendors will provide the resources necessary to obtain an ATO to TYAD, so that the TYAD entities, named in this sub-section, can assemble, and submit, the information to NETCOM for consideration. In addition to approval from NETCOM, local approvals must be obtained, from the entities named in this sub-section, for an IT equipment to operate both on the TYAD-ICAN, and standalone.

3.3.10 United States Army Network Enterprise Technology Command

The 9th Army Signal Command, otherwise known as United States Army Network Enterprise Technology Command (NETCOM), is responsible for all Army network development, and protection. In accordance with AR 25-1, all ISs must obtain an Authority to Operate (ATO) from NETCOM, before being permitted to communicate with any Army system. It is the responsibility of the Vendor, of any IT equipment, to provide all requested documentation, software, hardware, and licenses to the Tobyhanna Army Depot (TYAD) for ATO submission.

3.3.11 Vendor

Any non-Government personnel, whether the original equipment manufacturer (OEM), reseller, or third-party personnel involved in the procurement, installation, and/or maintenance of the IT equipment.

3.4 Hardware Requirements

Without exception, all IT equipment shall comply with any, and all, applicable security technical implementation guides (STIGs) and security requirement guides (SRGs) as published by the Defense Information Systems Agency (DISA). This includes STIGs and SRGs regarding physical security. In addition, all IT equipment will comply with relevant Department of Defense (DOD) guidance, and mandates regarding hardware lifecycle upgrades. Without exception, all hardware must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.4.1 Communication Interfaces

All IT equipment must utilize at least RS-232 serial, or Universal Serial Bus (USB) communication methods. USB connections are to function as a peripheral device only, such as a printer. USB Mass Storage Devices are strictly prohibited. Additional communication interfaces, such as Ethernet, or RS-485, are acceptable, but cannot be in lieu of an RS-232, or USB interface. Full system functionality must be provided via all communication methods present in the IT equipment. All communication interfaces must be enabled, and available for use by the Government, upon delivery of the IT equipment to the Government. This is to ensure continuity of operations (COOP) should a communication interface become either inoperable, or prohibited for security, or technical reasons.

3.4.2 Cryptographic Devices

Any, and all, hardware implementing cryptographic functionality must utilize a Federal Information Processing Standard (FIPS) 140-2 Level 1, or better, compliant device, certified by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).

3.4.3 Workstations and Servers

Only standardized, Government owned, managed, and maintained computing hardware shall be utilized.

3.4.4 Removable Storage Media

The use of removable storage media, including, but not limited to, Universal Serial Bus (USB) flash drives, CompactFlash cards, and Secure Digital (SD) cards is prohibited, except by authorized Government personnel. Neither the Vendor, nor their sub-contractors, shall utilize such devices, and will provide data via optical media, such as a compact disc (CD) or the DOD SAFE available at https://safe.apps.mil/.

3.4.5 Memory Contents

In the event of main, and backup power failure, it is preferred that the IT equipment shall not utilize volatile memory to store information including, but not limited to, parameters, configurations, or passwords. Upon restoration of power, the IT equipment must return to a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. The Vendor must state which form of memory (volatile or non-volatile) they will be using for which system functionalities. Further demonstration of memory is required in section 3.8.2.

3.4.6 Smart Card Readers

DOD personnel utilize a smartcard, called a Common Access Card (CAC) to access IT equipment. All user identification, and authentication, is to be accomplished with a FIPS 201 compliant smartcard reader.

3.4.7 Testing Hardware

The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

3.4.8 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.5 Software Requirements

Without exception, all IT equipment shall comply with any, and all, applicable STIGs, and SRGs developed by DISA, as well as relevant Army guidance, and mandates. Any, and all software, firmware, or operating systems intended to be used on, with, or in support of any IT equipment is required to have a current, and valid, ATO, approval from the TYAD CCB, a unique name to identify the product, and employ a version numbering system to enable tracking of outdated software. All data delivered to TYAD will be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data. Without exception, all software, firmware, and data must come from sources approved by the DOD, and abide by all current restrictions. Without exception, all software, firmware, data, and/or operating systems must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.5.1 Operating Systems

All IT equipment shall utilize only operating systems, approved by the Army, and configured according to applicable STIGs, SRGs, Army, and local TYAD guidance, and mandates. All operating system installations must be protected by the DOD’s Host Based Security System (HBSS) software suite.

3.5.2 Install Location

Unless authorized by the TYAD CCB, all software, firmware, and data provided the Vendor, and all sub-contractors, must be installed within, and provide full system functionality while running from, standard locations appropriate for the particular operating system on which it is installed (e.g., Program Files, Program Files (x86), etc.)

3.5.3 Account Credentials

The IT equipment must integrate with TYAD’s Active Directory infrastructure in order to utilize the existing public key infrastructure (PKI), operated by the Army, for user, service, and machine accounts. In addition, the Government must have the ability to change and/or disable, any, and all, built-in administrative, user, and service accounts in the system, including those in embedded sub-systems (e.g., microcontrollers, FPGAs, PLCs, CPLDs, etc.).

3.5.4 Cryptographic Functionality

All cryptographic functions must be FIPS 140-2 Level 1 compliant, or better, and utilize an implementation certified by the NIST CMVP.

3.5.5 Encryption Certificates

For cryptographic functionality, requiring use of a certificate, the system must be able to generate a certificate signing request (CSR) for submission to a DOD Certificate Authority. The CSR must be in a FIPS 140-2 Public Key Cryptography Standards (PKCS) #10 format of at least 2048 bits.

3.5.6 Connections to Outside Systems

All data shall remain within the bounds of the DOD Global Information Grid (GIG).

Connections to outside entities for purposes including, but not limited to, performance metric reporting, or remote support are prohibited.

3.5.7 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.6 Support Requirements

All IT equipment are required to have a valid support contract for at least the software, and firmware. While a support contract is in effect, the following requirements, and all those listed in applicable STIGs, and SRGs from DISA, as well as relevant DOD guidance, and mandates shall apply in order for the system to maintain the ATO. The information contained within the Acceptance section 3.8 of this document shall also apply for the duration of the support contract.

In addition an upgrade path for the system for its planned life cycle must be outlined by the vendor. The upgrade path must be able to address all potential issues discussed under heading

3.6 and its subheadings.

3.6.1 Response Time

The Government will receive a response from either the Vendor, or one of their sub-contractors, no later than 24 hours after the Government initiated a service request with either the Vendor, or one of their sub-contractors.

3.6.2 Replacement Hardware

Any, and all, replacement hardware shall be new, or functionally, and aesthetically, equivalent to new, in performance, and appearance.

3.6.3 Software Updates

Software support will include software updates and enhancements on covered software products.

Covered software products is defined as any software, or firmware provided, by the Vendor and/or any subcontractors, to the Government.

3.6.4 Operating System Compatibility

The IT equipment must remain compatible with future updated operating systems in accordance with DOD migration schedules during the entirety of the system’s planned lifecycle. Delivery, to the Government, of all materials required to perform upgrades for compatibility must be completed within the timelines set by DISA, NETCOM, U.S. Army Cyber Command (ARCYBER), U.S. Cyber Command (USCYBERCOM), and any additional DOD organizations tasked with the security of the GIG.

3.6.5 Security Updates

The Vendor, and all of their sub-contractors, shall address all security-related issues for the duration of the support contract. Delivery, to the Government, of all materials required to perform mitigation, and/or remediation of Information Assurance Vulnerability Alerts and Bulletins (IAVAs and IAVBs) must be completed within the timelines set by DISA, NETCOM, ARCYBER, USCYBERCOM, and any additional DOD organizations tasked with the security of the GIG.

3.6.6 Safety Issues

The Vendor, and all of their sub-contractors, shall address all safety-related issues, as identified by the TYAD Safety Office, for the duration of the support contract. Delivery of all materials required to perform mitigation and/or remediation of safety hazards must be completed within the timelines set by the TYAD Safety Office.

3.7 Cyber Documentation

The Vendor, and all sub-contractors, shall provide at least a digital copy of the following information, in a file format to be approved by the TYAD CCB. All the following information must be delivered with a valid cryptographic hash using an approved method. The cryptographic hashes of any products built using the information provided by the Vendor, and all sub-contractors, must match the cryptographic hashes of the compiled data provided to the Government.

3.7.1 Manuals

The Vendor, and all sub-contractors, shall provide a complete set of instruction manuals containing all information necessary to operate, maintain, administer, and reinstall software and hardware contained within the system.

3.7.2 Disaster Recovery

The vendor shall also provide step-by-step instructions to facilitate a complete restoration of the system, to the state in which it was initially accepted by TYAD, in the event of a fatal system error.

3.7.3 System Backups

The Vendor, and all sub-contractors, shall also provide a backup copy of all configuration settings in effect at the time of successful demonstration of system functionality.

3.7.4 Source Code

If any software, firmware, or data has been customized for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government. If any software, firmware, or data, governed by an open source license has been provided for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government.

3.7.5 Calibrations and Certifications

The vendor and all sub-contractors must provide a digital copy of any documentation related to certifications received by the system or information of calibrations performed on the system.

3.7.6 Implementation Plan

The Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. All IT IT equipment, components, software, and firmware must have an associated version number.

3.7.7 Digital Copies of Paper Deliverables

In addition all documentation requested in section 7.0 Documentation must be provided digitally.

3.8 Acceptance

The following criteria must be met before any IT equipment can be accepted, and put into use, by TYAD. Upon acceptance, all assets provided to TYAD by the Vendor, and all sub-contractors, shall become the sole property of the Government. All data delivered to TYAD shall be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data, and must not be initially provided after receipt of the data by TYAD. Data received by TYAD which does not match the associated cryptographic hashes shall not be considered valid, and will not be accepted.

3.8.1 Proof of Implementation

Upon solicitation, the Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. This plan, and the associated list of components will be verified by TYAD personnel to ensure the promised assets have not been tampered with prior to system delivery at TYAD. The same component list will be used to verify that no assets are tampered with during the install phase, after delivery, but prior to acceptance by TYAD. The component list will continue to be used to verify system integrity, and track changes made, after acceptance by TYAD.

3.8.2 Proof of COOP

A successful demonstration of disaster recovery is required. The demonstration must include removing any power or backup power, battery or otherwise, from the system followed by the return of a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. Any files and/or passwords used in the disaster recovery demonstration must be provided to TYAD by the vendor. This demonstration must be carried out in accordance with demonstration guidelines defined in section 3.6.3.

3.8.3 Proof of Functionality

The IS must obtain written confirmation, from the Contracting Office Representative (COR), of successful demonstration of full system functionality, a demonstration of COOP (section 3.8.2), and any demonstrations agreed to by the vendor during the solicitation or performance periods.

The demonstration must occur at TYAD, in the presence of either the COR, or the Contracting Office Technical Representative (COTR) and at least one TYAD subject matter expert (SME).

The COTR cannot serve as the only SME, at least one SME shall be from the Cost Center where the asset is to be utilized. Full system functionality demonstrations shall only be performed on the fully installed IT equipment. The written confirmation, from the COR, will contain an itemized list of checks performed during the demonstration. Each check will detail the steps taken, inputs/commands given, and results received. The TYAD COR/COTR and TYAD SMEs shall sign and date the verified component list, previously provided as Proof of Implementation, as well as the completed system functionality demonstration checklist. End-user license agreements (EULA) and similar documents will be signed by the TYAD COR/COTR and TYAD SMEs, after signing both the verified component list, and completed system functionality demonstration checklist. If the COTR is present for the full system functionality demonstration test, and signs on behalf of the COR, then the COR must sign and date the same documents, upon receipt from the COTR.

3.8.4 Proof of Documentation

The COR will provide a signed and dated memo once all documentation outlined in Section 3.7 has been delivered to and verified by TYAD.

3.8.5 Proof of Authority to Operate

IT products, such as software to be installed on Army computing resources, must undergo the Risk Management Framework (RMF) Assess Only process. Systems fitting the description of an IS, such as those provided by a Vendor with software, firmware, or operating system not controlled by the Army, are required to undergo the RMF Assess and Authorize process. Both an IT product, and an IS must be registered in the Enterprise Mission Assurance Support Service (eMASS). Proof of an Authority to Operate (ATO) is only valid once the relevant entry in eMASS receives a signature from the Approving Official (AO). Without an AO signature, no ATO exists, and the IT/IS cannot be accepted.

3.8.6 Proof of TYAD TRC Approval

The IS must obtain an ELTY 1642 Requirement Document form, digitally signed by all approving authorities listed on the form. The TYAD TRC approval process typically occurs in parallel with the ATO approval process.

3.8.7 Proof of TYAD CCB Approval

The IS must obtain an ELTY 6353 Change Request form, digitally signed by all approving authorities listed on the form. TYAD TRC approval is required before consideration by the

TYAD CCB.

4.0 Site Preparation

4.1 Within 10 working days after receipt of order (ARO) the Contractor shall coordinate with the COR for a post-award pre-installation meeting to be scheduled at TYAD and attended by the Contractor at TYAD. No video conferencing and no teleconferencing with the Contractor is acceptable; the Contractor shall be personally present at the meeting. It is at this meeting the Contractor shall furnish a project timeline. It is suggested the Contractor’s sub-contractor personnel attend the post-award pre-installation meeting.

4.2 Contractor personnel will remove an existing VMC machine from the project installation worksite and transport it to another building on the TYAD site.

4.3 The floor at the project installation worksite in Bldg. 1C Bay 2 is, on average, 6 inch non-reinforced concrete. If the existing on-site floor does not meet the manufacturer’s floor specifications to accommodate the installation of the machine, the Contractor shall be responsible for the turn-key installation of the manufacturer’s specified foundations for the machine.

4.4 For the turn-key installation of the manufacturer’s specified machine foundations the Contractor shall be responsible for supplying all equipment, tools, materials, supervision and labor. Notify TYAD Garrison Engineering prior to drilling for anchors, cutting concrete or installing ground rods. The contractor shall use a HEPA Vacuum with a dust/Silica capture device when drilling or cutting concrete. Commonly, wet methods can also be used in conjunction with HEPA Vacuum Dust and Particulate capture while cutting or drilling concrete.

The contractor shall use a HEPA Vacuum with a Dust/Silica capture device when drilling or cutting concrete, in conjunction with applicable wet methods with appropriate additional housekeeping measures to ensure that any slurry generated by the wet control method is cleaned up when the work is completed to avoid a secondary dust exposure hazard. The Contractor shall saw-cut the existing concrete floor at the required locations in Bldg. 1C Bay 2. The Contractor shall remove the saw-cut concrete pieces and excavate to the required depths. The Contractor shall supply and install the manufacturer’s specified steel reinforcements; pour and level the concrete. Contractor is responsible for ensuring that work areas are free from dust at the end of each shift. The Contractor shall clean the work areas and equipment covered by dust by the end of every shift and before departing on weekends and holidays, utilizing a HEPA filter vacuum.

Dry sweeping and the use of compressed air are prohibited for removing dust and debris containing silica. The Contractor shall perform the saw-cutting and excavation work between the hours of 5:00 PM Friday and 6:00 PM Sunday. The Contractor may perform concrete installation and finishing during normal 1st-shift duty hours, Monday—Thursday from 7:30 AM to 4:00 PM.

4.5 The Contractor shall supply and have delivered to TYAD a refuse receptacle for rubbish and debris collection and for rubbish and debris removal from TYAD. Location for placement of the Contractor’s refuse receptacle will be provided by the Government to the Contractor in advance of Contractor work initiation, to ensure the location and method used to store waste will not allow silica containing dust to re-enter the workplace. The Contractor shall remove the refuse receptacle within 5 working days following completion of all contractual work.

4.6 It shall be the responsibility of the Contractor to contact the TYAD Fire Department to obtain a Hot Work Permit prior to the Contractor performing welding, torch cutting, metal cutting and grinding, soldering, and the performance of all activities in which an open flame and burning are needed.

4.7 The Contractor shall be responsible to supply all necessary PPE for all Contractor personnel.

5.0 Delivery, Assembly, and Installation

5.1 The Contractor shall use only electric-powered equipment inside all Government buildings.

For all Contractor-supplied electrical equipment that require battery recharging it shall be the responsibility of the Contractor to supply battery-charging equipment. Connection of the Contractor-supplied battery-charging equipment to TYAD power shall be the responsibility of the Contractor. A location for the battery-charging equipment will be provided by the Government to the Contractor.

5.2 It shall be the responsibility of the Contractor to deliver, off-load, transport, place, and properly position the new machine within Bldg.1C Bay 2 at the designated floor locations at TYAD. The Contractor shall be responsible to provide all personnel and equipment necessary to deliver, off-load, transport, place, and properly position the new machine at the designated floor locations in Bldg. 1C Bay 2. Only electric-powered material handling equipment shall be used by the Contractor inside all Government buildings. Delivery date and time shall be coordinated by the Contractor with the COR a minimum 14 calendar days in advance of the anticipated delivery at TYAD. The Contractor shall be able to provide delivery of the machine on a Saturday. Delivery shall include all accessory and assembly pieces and materials. A partial delivery is not acceptable.

5.3 Within 7 calendar days after delivery of the machine the Contractor shall arrive on-site to begin machine…