W25G1V-22-R-0039 Amendment 02.pdf

ACC-APG, TOBYHANNA DIVISION

NICOLE TOKASH

NICOLE.TOKASH.CIV@ARMY.MIL

11 HAP ARNOLD BLVD

TOBYHANNA PA 18466

W25G1V207600D3

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to change Attachment 1 Statement of Work, Section 4.2 from "Contractor personnel w ill remove an existing VMC machine from the project installation w orksite and transport it to another building on the TYAD site." to "The present proposed position for the new machine w ill not require another VMC machine to be removed. The Government w ill remove the Bridgeport and a steel table from the area w here the new machine w ill be located."

1. CONTRACT ID CODE PAGE OF PAGES

1 52

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 28-Jun-2022

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street , County, State and Zip Code) X W25G1V22R0039

X 9B. DATED (SEE ITEM 11)

09-Jun-2022

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

28-Jun-2022

CODE

ACC-APG, TOBYHANNA DIVISION

11 HAP ARNOLD BLVD

TOBYHANNA PA 18466-5100

W25G1V 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE W25G1V

FACILITY CODECODE

EMAIL:TEL:

W25G1V22R0039

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

SOW

Statement of Work for a Small Computer Numerical Controlled (CNC) Vertical Machining Center (VMC) for Tobyhanna Army Depot

1.0 General Scope

1.1 This Statement of Work (SOW) is for the turn-key design, supply, delivery, off-loading, transporting, locating, installation, cleaning, assembly, set-up and training for one each Computer Numerical Controlled (CNC) Vertical Machining Center (VMC) at Tobyhanna Army Depot (TYAD) in Tobyhanna, PA 18466. The Contractor shall supply all materials, supplies, freight, delivery, tools, equipment, consumables, labor, and supervision for the turn-key design, supply, delivery, off-loading, transporting, locating, installation, cleaning, assembly, set-up and training for the machine. The Contractor shall supply only new machines and new associated equipment. Used and refurbished machines and used and refurbished equipment are unacceptable and will not be considered. All repair and replacement parts for the machine and associated equipment shall be new. All repair and replacement parts shall be available for purchase and supplied from within the continental United States.

1.2 The Contractor shall provide machine operation and machine maintenance training for Government personnel. Training shall be conducted by the Contractor’s qualified training representative and shall be conducted on-site at the machine location in Bldg. 1C Bay 2 at TYAD. This training shall focus on basic operations, programming, preventive maintenance, general maintenance, cleaning and housekeeping, and features familiarization. Instruction shall also include the maintenance that needs to be done by machine operators on a daily basis. All materials used during training shall become the property of TYAD.

1.3 The Bldg. 1C Bay 4 cargo door is the closest and most easily accessible door to the project installation worksite in Bldg. 1C Bay 2. The Contractor shall verify cargo door access dimensions. The Contractor shall be responsible to ensure that all material fits through this opening. All material handling equipment that is used by the Contractor, likewise, shall fit through this clearance WHILE MOVING AND HANDLING all material that is being delivered.

1.4 Power available for the machine is both 208V/3 Phase/60Hz and 480V/3 Phase/60 Hz. For machines that are not designed and constructed for this power, the Contractor shall supply, install and connect the necessary transformers that permit the use of this available power by the machine.

1.5 It shall be the responsibility of the Contractor to verify all machine and worksite dimensions and ensure the machine and ancillary pieces fit and can be operated normally within the available floor space at the project installation worksite in Bldg. 1C Bay 2. The Contractor shall be responsible to verify overhead clearance dimensions for the machine and ancillary pieces at the project installation worksite in Bldg. 1C Bay 2.

1.6 TYAD currently uses CNC Software’s MasterCAM Computer-Aided Manufacturing (CAM) software for the programming of all on-site VMCs. The Contractor shall ensure the Contractor-proposed and the Contractor-installed VMC shall be CNC programmable using MasterCAM Computer- Aided Manufacturing (CAM) software. It shall be the responsibility of the Contractor to develop and supply the appropriate post-processor to achieve the necessary CNC programming compatibility. The Contractor’s post-processor shall be given to Automation Support Branch personnel by the Contractor in accordance with section 3.0 Cyber Requirements for loading onto the Government network.

1.7 A site visit will be 22 June 2022 at 9AM EST and it is advised that interested Contractors attend. The site visit is for the purpose of interested Contractors to consider the layout and floor space of the project area and to enable the viewing of the delivery, utility and installation sites.

The site visit shall be used by the Contractors to identify structures or conditions that may impede, obstruct or prevent completion of the work. It shall be the responsibility of the Contractor to identify obstructions and impediments to the project and to make appropriate accommodations for correction and modification to mitigate the problem. If a corrective measure conflicts with other requirements listed in the SOW or is outside the work area the Contractor shall identify these issues in the proposal submittal to the Government. Answers not contained in the SOW to all questions that are raised during the site visit shall be submitted in writing. Should the Contractor fail to identify an obstruction and hindrance to the project that is identifiable from a site visit the Contractor shall provide a solution to the problem that is to the satisfaction of the Government and at no additional cost to the Government. It shall be the responsibility of the Contractor for all dimensioning of the system including all auxiliary pieces and materials. It shall be the responsibility of the Contractor to supply his personal protective equipment (PPE) for the site visit. At a minimum, the PPE needed is protective eyewear and protective footwear. A Contractor in non-compliance with the PPE requirement will not be permitted on the site visit.

1.8 Following installation completion and prior to Final Acceptance the Contractor shall supply to the Contracting Officer’s Representative (COR) a computer-aided design and drafting (CADD) as-built drawing of the installed machine in Bldg. 1C Bay 2. The drawing shall be furnished in PDF and .dwg to the CPOC and shall be provided in hardcopy, ANSI D paper sized 22”x34”, in triplicate.

1.9 The Contractor shall agree that the system being purchased is considered an Information Technology (IT) asset to be operated at a Government facility and as such must adhere to all local and Government regulations outlined in this document under section 3.0 Cyber Requirements.

1.10 TYAD currently uses TYAD Distributed Numerical Control (DNC) software for machine code programming file transfer of all on-site VMCs. The Contractor shall ensure the Contractor-proposed and the Contractor-installed VMC shall be compatible with TYAD DNC. It shall be the responsibility of the Contractor to develop and supply any necessary hardware and/or software to support this.

1.11 The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

2.0 Minimum Specifications, Characteristics and Features for the Machine

1. The machine shall have both conversational and numerical control programming capability.

2. X-axis travel shall be 42.0-48.0 inches.

3. Y-axis travel shall be 24.0-30.0 inches.

4. Z-axis travel shall be 24.0-30.0 inches.

5. All axes shall incorporate direct drive servos.

6. Table working surface shall be 50.0-66.0 inches by 24.0-30.0 inches.

7. X, Y and Z positioning accuracy shall be at least +/- 0.0002 inches or better by 10 pass

VDI 3441 Method.

8. Repeatability of all axes shall be at least +/- 0.0001 inches or better by 10 pass VDI 3441

Method.

9. Maximum cutting feedrate shall be at least 1250 inches per minute. Rapid transverse rate for X and Y shall be at least 1400 inches per minute and 1200 inches per minute for Z.

10. Drive encoders shall have a minimum of 1,000,000 counts per revolution.

11. The machine shall also be equipped with a remote jog control with a display screen.

12. Spindle nose-to-table distance shall be 6.0 or less to 30.0 or more, inches.

13. Table shall be furnished with five each T-Slots, minimum, evenly spaced across the table.

14. Table shall have a weight capacity of 3,800 pounds, minimum.

15. Spindle taper shall be CAT40 Big Plus Dual Contact.

16. The spindle shall be direct drive and be designed to permit a continuous spindle speed of

15,000 rpm, minimum.

17. The spindle shall be 20 horsepower one minute rated, minimum.

18. The spindle shall be direct drive.

19. The spindle shall have a bearing lubrication system and utilize a thermal chiller.

20. The automatic tool changer (ATC) shall be random access and have a 30 tool minimum capacity. The machine shall allow for the assignment of tool pockets.

21. The tool changer shall be capable changing tools in 1.5 seconds or less.

22. The maximum tool diameter shall be at least three (3) inches.

23. The maximum tool length shall be at least 11.5 inches.

24. The machine shall be equipped with a 18 inch, minimum, color monitor screen.

25. The machine shall be equipped with a flood coolant and washdown delivery system. The Contractor shall furnish and install all filters and pumps for the system.

26. The machine shall be equipped with a through-spindle coolant delivery system that provides up to 300 psi, minimum, coolant to the cutting tool. The Contractor shall furnish and shall install all filters and pumps for the through-spindle coolant delivery system.

27. At a minimum, the machine computer shall be equipped with a nonvolatile solid state storage device, 8GB of random access memory, and utilize a processor with at least two physical cores dedicated to the operating system the user interacts with.The machine shall be capable of making rapid cornering moves without stopping when changing direction.

28. The machine shall be capable of up to 10,000 block look-ahead, minimum.

29. The machine shall be capable of S-curve motion and double arc smoothing.

30. The machine shall allow graphical verification of a solid or wire frame models and tool path to verify the part program in both conversational and numerical control modes.

31. The machine shall be able to create contour programs using lines and arcs.

32. Mirror images shall be capable of being milled in the same manner on both halves.

33. Conversational programming shall allow the machining of pockets with islands and boundaries as well as permitting a helical ramp feature when plunging.

34. The machine shall be capable of importing 2D data from Computer Aided Design (CAD)

.dxf files to create a conversational program.

35. The machine shall be able to save tool and material parameters for multiple and future use.

36. The machine shall be capable of analyzing the machining program to automatically optimize the number of tool changes for reduced cycle time.

37. The machine controls and power cabinet shall be temperature controlled within their normal operating range.

38. The machine shall support Industry Standard Numerical Control codes, EIA/ISO or G-code, to allow the use of existing part programs.

39. The machine shall allow the creation and editing of numerical control programs and indicate if there are syntax errors.

40. The machine shall at minimum be proven to receive files from Tobyhanna’s DNC system. The system sends files over serial RS-232 from a Tobyhanna provided workstation using a method commonly known as drip-feeding.

41. The machine shall allow features from a numerically controlled program to be brought into a conversational program.

42. The conversational programming shall allow a two dimensional shape to be moved along a contour to create a surface using the conversational program.

43. The machine shall allow the machining cycle to be interrupted, the machine repositioned and then the cycle resumed at the point it was interrupted.

44. The machine shall permit mid-program restarts without the need of additional programming.

45. The machining program shall be capable of producing the surface finish selected automatically.

46. The graphics screen shall allow for touching a feature and automatically displaying the code that can then be edited as needed.

47. The program shall be capable of computing the run time of the machining operation.

48. Feed and speed adjustments shall be capable of being made and stored in part programs.

49. The machine shall be equipped with an interactive help feature.

50. The machine shall allow for offline programming while the machine is running.

51. The machine shall be equipped with door safety interlocks.

52. The machining area shall be fully enclosed and equipped with a coolant mist collection system that clears the coolant mist generated during the machining process from the enclosed machining area.

53. The X, Y and Z axes servos shall be direct drive.

54. The machine shall be equipped with way covers that telescope, an automatic central lubrication system and a way lubricant separation system.

55. The machine shall be equipped with light emitting diode (LED) lights to illuminate the entire machining area.

56. The machine shall provide a system capable of granular access permissions. Granular access permissions are used to grant system privileges, allowing you to construct site-specific roles with privileges to match your requirements. Required system privileges capable of this should include but are not limited to running machine code programs, editing machine code programs, editing machine parameters, and administrative machine functions. The system must accommodate the following roles at a minimum: Operator, Setup Technician, and Administrator.

57. The machine shall be equipped with an automatic chip extractor auger or conveyor system for removal of chips from the machining area.

58. The machine shall come equipped with a Renishaw part probing capability with at least a

1.0 um repeatability.

59. The machine shall be capable of both conversational tool and part probing. Part probing shall determine a part’s position regardless of orientation.

60. Machine shall come equipped with an oil skimmer system.

61. An optional eight (8) inch (200 mm) rotary table shall be provided and be capable of horizontal or vertical mounting.

3.0 Cyber Requirements

3.1 Applicable Publications

The Vendor, and all sub-contractors, must abide by all applicable regulations, publications, manuals, and local policies and procedures. This includes, but is not limited to; AR 25-1 as well as STIGs and SRGs as published on https://public.cyber.mil.

3.2 Acronyms

AO Approving Official AR Army Regulation APMS Army Portfolio Management System ARCYBER United States Army Cyber Command ASB Automation Support Branch ATO Authority to Operate CCB Configuration Control Board

CD Compact Disc CMVP Cryptographic Module Validation Program COOP Continuity of Operations COR Contracting Officer Representative COTR Contracting Officer’s Technical Representative CPLD Complex Programmable Logic Device CSR Certificate Signing Request DISA Defense Information Systems Agency DOD United States Depart of Defense ELTY Electronic Tobyhanna Army Depot Form eMASS Enterprise Mission Assurance Support Service EULA End User License Agreement FIPS Federal Information Processing Standard FPGA Field Programmable Gate Array GIG Government Information Grid HBSS Host Based Security System IAVA Information Assurance Vulnerability Alert IAVB Information Assurance Vulnerability Bulletin ICAN Internal Campus Area Network IMD Information Management Division IRB Industrial Review Board IS Information System IT Information Technology NETCOM United States Army Network Enterprise Technology Command NIST National Institute of Standards and Technology OEM Original Equipment Manufacturer PKI Public Key Infrastructure PLC Programmable Logic Controller RMF Risk Management Framework SD Secure Digital SME Subject Matter Expert SOW Statement of Work SRG Security Requirements Guide STIG Security Technical Implementation Guide TRC Technical Review Cell USB Universal Serial Bus USCYBERCOM United States Cyber Command

3.3 Definitions

This section contains explanations of terms used in this document. They are taken from, and not to supersede, those definitions given in Army Regulation (AR) 25-1. All terms used in this document are in accordance with AR 25-1. This section shall be considered the authoritative source for definitions of terms not contained within AR 25-1 and/or its supporting documents.

3.3.1 Automation Support Branch

The Automation Support Branch (ASB), under the Mission Support Division, under the Directorate of Production Engineering, is the single point of contact for all mission-related IT equipment at TYAD. The ASB develops, protects, and maintains specialty IT equipment, both networked and standalone, in support of unique workloads across TYAD.

3.3.2 Configuration Control Board

The Configuration Control Board (CCB) is the local approving authority, composed of Supervisory personnel, for all actions regarding IT equipment at TYAD. Receiving an ATO for an IT equipment, from NETCOM, does not automatically guarantee that the system can be utilized at TYAD. The IT equipment must also obtain approval from the TYAD CCB, before it may be used with Army ISs at TYAD. The CCB is the local entity responsible for approving the STIGs and SRGs deemed applicable by the TRC, before the ATO accreditation package is submitted to NETCOM for approval.

3.3.3 Government

Any federal civilian, or military personnel employed by the United States Department of Defense (DOD), United States Army (Army), and/or Tobyhanna Army Depot (TYAD).

3.3.4 Industrial Review Board

The Industrial Review Board (IRB) is the local governing body that oversees all industrial mission assets to ensure compliance with TYAD production requirements. Composed of SMEs from the Directorates of Production Engineering (D/PE) and Systems Integration and Support (D/SIS), the IRB collects requirements, reviews contracting documents, plans industrial capabilities, and oversees contract implementation in alignment with current and future production needs. The three voting members of the IRB are the Division Chiefs for the Mission Support Division, Design, Development and Fabrication Division, and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) Finishing Division.

3.3.5 Information Management Division

Part of the Directorate of Installation Services, the Information Management Division (IMD) is responsible for the development, protection, and maintenance of the TYAD SBU LAN. The IMD operates all critical infrastructure upon which TYAD’s IT equipment operate.

3.3.6 Information System

Information System (IS) is defined as the organized collection, processing, transmission, and dissemination of information in accordance with defined procedures, whether automated or manual. For the purposes of Army Portfolio Management System (APMS), the terms "application" and "information system" are both IT investments describing a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (see JP 1–02).The application of IT to solve a business or operational (tactical) problem creates an information system.

3.3.7 Information Technology

Information technology (IT) is any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used directly or is used by a contractor under a contract with the executive agency, which 1) requires the use of such equipment; or 2) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term "information technology" also includes computers, ancillary equipment, software, firmware, and similar procedures, services (including support services), and related resources. The term "information technology" does not include any equipment that is acquired by a Federal contractor incidental to a Federal contract. (Reference 40 USC Subtitle III (Clinger-Cohen Act of 1996).)

3.3.8 Technical Review Cell

Composed of technical experts from both the ASB, and IMD, the Technical Review Cell (TRC) conducts the preliminary review of all actions, related to IT equipment at TYAD, prior to either ATO submission, or CCB approval. The TRC is responsible for determining which security technical implementation guides (STIGs), and security requirements guides (SRGs) are applicable to a given system, based on the direction given by NETCOM, and higher headquarters.

3.3.9 Tobyhanna Army Depot

Tobyhanna Army Depot (TYAD) is responsible for the development, and protection of the TYAD Internal Campus Area Network (TYAD-ICAN). To obtain an ATO, all IT equipment Vendors will provide the resources necessary to obtain an ATO to TYAD, so that the TYAD entities, named in this sub-section, can assemble, and submit, the information to NETCOM for consideration. In addition to approval from NETCOM, local approvals must be obtained, from the entities named in this sub-section, for an IT equipment to operate both on the TYAD-ICAN, and standalone.

3.3.10 United States Army Network Enterprise Technology Command

The 9th Army Signal Command, otherwise known as United States Army Network Enterprise Technology Command (NETCOM), is responsible for all Army network development, and protection. In accordance with AR 25-1, all ISs must obtain an Authority to Operate (ATO) from NETCOM, before being permitted to communicate with any Army system. It is the responsibility of the Vendor, of any IT equipment, to provide all requested documentation, software, hardware, and licenses to the Tobyhanna Army Depot (TYAD) for ATO submission.

3.3.11 Vendor

Any non-Government personnel, whether the original equipment manufacturer (OEM), reseller, or third-party personnel involved in the procurement, installation, and/or maintenance of the IT equipment.

3.4 Hardware Requirements

Without exception, all IT equipment shall comply with any, and all, applicable security technical implementation guides (STIGs) and security requirement guides (SRGs) as published by the Defense Information Systems Agency (DISA). This includes STIGs and SRGs regarding physical security. In addition, all IT equipment will comply with relevant Department of Defense (DOD) guidance, and mandates regarding hardware lifecycle upgrades. Without exception, all hardware must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.4.1 Communication Interfaces

All IT equipment must utilize at least RS-232 serial, or Universal Serial Bus (USB) communication methods. USB connections are to function as a peripheral device only, such as a printer. USB Mass Storage Devices are strictly prohibited. Additional communication interfaces, such as Ethernet, or RS-485, are acceptable, but cannot be in lieu of an RS-232, or USB interface. Full system functionality must be provided via all communication methods present in the IT equipment. All communication interfaces must be enabled, and available for use by the Government, upon delivery of the IT equipment to the Government. This is to ensure continuity of operations (COOP) should a communication interface become either inoperable, or prohibited for security, or technical reasons.

3.4.2 Cryptographic Devices

Any, and all, hardware implementing cryptographic functionality must utilize a Federal Information Processing Standard (FIPS) 140-2 Level 1, or better, compliant device, certified by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).

3.4.3 Workstations and Servers

Only standardized, Government owned, managed, and maintained computing hardware shall be utilized.

3.4.4 Removable Storage Media

The use of removable storage media, including, but not limited to, Universal Serial Bus (USB) flash drives, CompactFlash cards, and Secure Digital (SD) cards is prohibited, except by authorized Government personnel. Neither the Vendor, nor their sub-contractors, shall utilize such devices, and will provide data via optical media, such as a compact disc (CD) or the DOD SAFE available at https://safe.apps.mil/.

3.4.5 Memory Contents

In the event of main, and backup power failure, it is preferred that the IT equipment shall not utilize volatile memory to store information including, but not limited to, parameters, configurations, or passwords. Upon restoration of power, the IT equipment must return to a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. The Vendor must state which form of memory (volatile or non-volatile) they will be using for which system functionalities. Further demonstration of memory is required in section 3.8.2.

3.4.6 Smart Card Readers

DOD personnel utilize a smartcard, called a Common Access Card (CAC) to access IT equipment. All user identification, and authentication, is to be accomplished with a FIPS 201 compliant smartcard reader.

3.4.7 Testing Hardware

The Vendor, and all of their sub-contractors, shall provide additional hardware, and licenses to simulate all electronic system functionality in a laboratory environment. These assets are to be used for TYAD DNC integration testing and cyber security purposes only, and will not be deployed for production use. In order to ensure that security updates, and configurations do not interfere with IT equipment in production use, the Government requires the ability to test a representative system in a controlled, laboratory environment.

3.4.8 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.5 Software Requirements

Without exception, all IT equipment shall comply with any, and all, applicable STIGs, and SRGs developed by DISA, as well as relevant Army guidance, and mandates. Any, and all software, firmware, or operating systems intended to be used on, with, or in support of any IT equipment is required to have a current, and valid, ATO, approval from the TYAD CCB, a unique name to identify the product, and employ a version numbering system to enable tracking of outdated software. All data delivered to TYAD will be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data. Without exception, all software, firmware, and data must come from sources approved by the DOD, and abide by all current restrictions. Without exception, all software, firmware, data, and/or operating systems must come from sources approved by the DOD, abide by all current restrictions, and be able to obtain and maintain an ATO throughout planned life cycle.

3.5.1 Operating Systems

All IT equipment shall utilize only operating systems, approved by the Army, and configured according to applicable STIGs, SRGs, Army, and local TYAD guidance, and mandates. All operating system installations must be protected by the DOD’s Host Based Security System (HBSS) software suite.

3.5.2 Install Location

Unless authorized by the TYAD CCB, all software, firmware, and data provided the Vendor, and all sub-contractors, must be installed within, and provide full system functionality while running from, standard locations appropriate for the particular operating system on which it is installed (e.g., Program Files, Program Files (x86), etc.)

3.5.3 Account Credentials

The IT equipment must integrate with TYAD’s Active Directory infrastructure in order to utilize the existing public key infrastructure (PKI), operated by the Army, for user, service, and machine accounts. In addition, the Government must have the ability to change and/or disable, any, and all, built-in administrative, user, and service accounts in the system, including those in embedded sub-systems (e.g., microcontrollers, FPGAs, PLCs, CPLDs, etc.).

3.5.4 Cryptographic Functionality

All cryptographic functions must be FIPS 140-2 Level 1 compliant, or better, and utilize an implementation certified by the NIST CMVP.

3.5.5 Encryption Certificates

For cryptographic functionality, requiring use of a certificate, the system must be able to generate a certificate signing request (CSR) for submission to a DOD Certificate Authority. The CSR must be in a FIPS 140-2 Public Key Cryptography Standards (PKCS) #10 format of at least 2048 bits.

3.5.6 Connections to Outside Systems

All data shall remain within the bounds of the DOD Global Information Grid (GIG).

Connections to outside entities for purposes including, but not limited to, performance metric reporting, or remote support are prohibited.

3.5.7 Registration and Licensing

Sensitive information shall not be provided by the Government to the Vendor, or any sub-contractors. This information includes, but is not limited to; computer hostnames, IP addresses, usernames, or passwords. All products shall be registered to:

Commander Tobyhanna Army Depot 11 Hap Arnold Boulevard Tobyhanna, PA 18466

Unless approved by the TYAD CCB, physical security tokens are restricted to server use only, and prohibited in end-user IT equipment. No licensing terms between the Vendor, or any sub-contractors, may supersede any requirements from either TYAD, or higher DOD headquarters.

3.6 Support Requirements

All IT equipment are required to have a valid support contract for at least the software, and firmware. While a support contract is in effect, the following requirements, and all those listed in applicable STIGs, and SRGs from DISA, as well as relevant DOD guidance, and mandates shall apply in order for the system to maintain the ATO. The information contained within the Acceptance section 3.8 of this document shall also apply for the duration of the support contract.

In addition an upgrade path for the system for its planned life cycle must be outlined by the vendor. The upgrade path must be able to address all potential issues discussed under heading

3.6 and its subheadings.

3.6.1 Response Time

The Government will receive a response from either the Vendor, or one of their sub-contractors, no later than 24 hours after the Government initiated a service request with either the Vendor, or one of their sub-contractors.

3.6.2 Replacement Hardware

Any, and all, replacement hardware shall be new, or functionally, and aesthetically, equivalent to new, in performance, and appearance.

3.6.3 Software Updates

Software support will include software updates and enhancements on covered software products.

Covered software products is defined as any software, or firmware provided, by the Vendor and/or any subcontractors, to the Government.

3.6.4 Operating System Compatibility

The IT equipment must remain compatible with future updated operating systems in accordance with DOD migration schedules during the entirety of the system’s planned lifecycle. Delivery, to the Government, of all materials required to perform upgrades for compatibility must be completed within the timelines set by DISA, NETCOM, U.S. Army Cyber Command (ARCYBER), U.S. Cyber Command (USCYBERCOM), and any additional DOD organizations tasked with the security of the GIG.

3.6.5 Security Updates

The Vendor, and all of their sub-contractors, shall address all security-related issues for the duration of the support contract. Delivery, to the Government, of all materials required to perform mitigation, and/or remediation of Information Assurance Vulnerability Alerts and Bulletins (IAVAs and IAVBs) must be completed within the timelines set by DISA, NETCOM, ARCYBER, USCYBERCOM, and any additional DOD organizations tasked with the security of the GIG.

3.6.6 Safety Issues

The Vendor, and all of their sub-contractors, shall address all safety-related issues, as identified by the TYAD Safety Office, for the duration of the support contract. Delivery of all materials required to perform mitigation and/or remediation of safety hazards must be completed within the timelines set by the TYAD Safety Office.

3.7 Cyber Documentation

The Vendor, and all sub-contractors, shall provide at least a digital copy of the following information, in a file format to be approved by the TYAD CCB. All the following information must be delivered with a valid cryptographic hash using an approved method. The cryptographic hashes of any products built using the information provided by the Vendor, and all sub-contractors, must match the cryptographic hashes of the compiled data provided to the Government.

3.7.1 Manuals

The Vendor, and all sub-contractors, shall provide a complete set of instruction manuals containing all information necessary to operate, maintain, administer, and reinstall software and hardware contained within the system.

3.7.2 Disaster Recovery

The vendor shall also provide step-by-step instructions to facilitate a complete restoration of the system, to the state in which it was initially accepted by TYAD, in the event of a fatal system error.

3.7.3 System Backups

The Vendor, and all sub-contractors, shall also provide a backup copy of all configuration settings in effect at the time of successful demonstration of system functionality.

3.7.4 Source Code

If any software, firmware, or data has been customized for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government. If any software, firmware, or data, governed by an open source license has been provided for use by the Government, the Vendor, and all sub-contractors shall provide the associated source code, firmware, build environment, and build instructions to the Government.

3.7.5 Calibrations and Certifications

The vendor and all sub-contractors must provide a digital copy of any documentation related to certifications received by the system or information of calibrations performed on the system.

3.7.6 Implementation Plan

The Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. All IT IT equipment, components, software, and firmware must have an associated version number.

3.7.7 Digital Copies of Paper Deliverables

In addition all documentation requested in section 7.0 Documentation must be provided digitally.

3.8 Acceptance

The following criteria must be met before any IT equipment can be accepted, and put into use, by TYAD. Upon acceptance, all assets provided to TYAD by the Vendor, and all sub-contractors, shall become the sole property of the Government. All data delivered to TYAD shall be provided with FIPS 140-2 compliant cryptographic hashes to enable TYAD to verify the integrity of the received files. The provided hashes shall not reside solely on the same physical media as the associated data, and must not be initially provided after receipt of the data by TYAD. Data received by TYAD which does not match the associated cryptographic hashes shall not be considered valid, and will not be accepted.

3.8.1 Proof of Implementation

Upon solicitation, the Vendor will submit a written implementation plan for review and acceptance by the TYAD CCB. This plan will include, but is not limited to, detailed information of all IT equipment, components, software, firmware, and data to be delivered to TYAD. This plan, and the associated list of components will be verified by TYAD personnel to ensure the promised assets have not been tampered with prior to system delivery at TYAD. The same component list will be used to verify that no assets are tampered with during the install phase, after delivery, but prior to acceptance by TYAD. The component list will continue to be used to verify system integrity, and track changes made, after acceptance by TYAD.

3.8.2 Proof of COOP

A successful demonstration of disaster recovery is required. The demonstration must include removing any power or backup power, battery or otherwise, from the system followed by the return of a state such that the Government can continue to use the IT equipment without requiring service by either the Vendor, or any of their sub-contractors. Any files and/or passwords used in the disaster recovery demonstration must be provided to TYAD by the vendor. This demonstration must be carried out in accordance with demonstration guidelines defined in section 3.6.3.

3.8.3 Proof of Functionality

The IS must obtain written confirmation, from the Contracting Office Representative (COR), of successful demonstration of full system functionality, a demonstration of COOP (section 3.8.2), and any demonstrations agreed to by the vendor during the solicitation or performance periods.

The demonstration must occur at TYAD, in the presence of either the COR, or the Contracting Office Technical Representative (COTR) and at least one TYAD subject matter expert (SME).

The COTR cannot serve as the only SME, at least one SME shall be from the Cost Center where the asset is to be utilized. Full system functionality demonstrations shall only be performed on the fully installed IT equipment. The written confirmation, from the COR, will contain an itemized list of checks performed during the demonstration. Each check will detail the steps taken, inputs/commands given, and results received. The TYAD COR/COTR and TYAD SMEs shall sign and date the verified component list, previously provided as Proof of Implementation, as well as the completed system functionality demonstration checklist. End-user license agreements (EULA) and similar documents will be signed by the TYAD COR/COTR and TYAD SMEs, after signing both the verified component list, and completed system functionality demonstration checklist. If the COTR is present for the full system functionality demonstration test, and signs on behalf of the COR, then the COR must sign and date the same documents, upon receipt from the COTR.

3.8.4 Proof of Documentation

The COR will provide a signed and dated memo once all documentation outlined in Section 3.7 has been delivered to and verified by TYAD.

3.8.5 Proof of Authority to Operate

IT products, such as software to be installed on Army computing resources, must undergo the Risk Management Framework (RMF) Assess Only process. Systems fitting the description of an IS, such as those provided by a Vendor with software, firmware, or operating system not controlled by the Army, are required to undergo the RMF Assess and Authorize process. Both an IT product, and an IS must be registered in the Enterprise Mission Assurance Support Service (eMASS). Proof of an Authority to Operate (ATO) is only valid once the relevant entry in eMASS receives a signature from the Approving Official (AO). Without an AO signature, no ATO exists, and the IT/IS cannot be accepted.

3.8.6 Proof of TYAD TRC Approval

The IS must obtain an ELTY 1642 Requirement Document form, digitally signed by all approving authorities listed on the form. The TYAD TRC approval process typically occurs in parallel with the ATO approval process.

3.8.7 Proof of TYAD CCB Approval

The IS must obtain an ELTY 6353 Change Request form, digitally signed by all approving authorities listed on the form. TYAD TRC approval is required before consideration by the

TYAD CCB.

4.0 Site Preparation

4.1 Within 10 working days after receipt of order (ARO) the Contractor shall coordinate with the COR for a post-award pre-installation meeting to be scheduled at TYAD and attended by the Contractor at TYAD. No video conferencing and no teleconferencing with the Contractor is acceptable; the Contractor shall be personally present at the meeting. It is at this meeting the Contractor shall furnish a project timeline. It is suggested the Contractor’s sub-contractor personnel attend the post-award pre-installation meeting.

4.2 The present proposed position for the new machine will not require another VMC machine to be removed. The Government will remove the Bridgeport and a steel table from the area where the new machine will be located.

4.3 The floor at the project installation worksite in Bldg. 1C Bay 2 is, on average, 6 inch non-reinforced concrete. If the existing on-site floor does not meet the manufacturer’s floor specifications to accommodate the installation of the machine, the Contractor shall be responsible for the turn-key installation of the manufacturer’s specified foundations for the machine.

4.4 For the turn-key installation of the manufacturer’s specified machine foundations the Contractor shall be responsible for supplying all equipment, tools, materials, supervision and labor. Notify TYAD Garrison Engineering prior to drilling for anchors, cutting concrete or installing ground rods. The contractor shall use a HEPA Vacuum with a dust/Silica capture device when drilling or cutting concrete. The Contractor shall saw-cut the existing concrete floor at the required locations in Bldg. 1C Bay 2. The Contractor shall remove the saw-cut concrete pieces and excavate to the required depths. The Contractor shall supply and install the manufacturer’s specified steel reinforcements; pour and level the concrete. The Contractor shall clean the work site prior to the Contractor departing for evenings, weekends, and holidays. The Contractor shall perform the saw-cutting and excavation work between the hours of 5:00 PM Friday and 6:00 PM Sunday. The Contractor may perform concrete installation and finishing during normal 1st-shift duty hours, Monday—Thursday from 7:30 AM to 4:00 PM.

4.5 The Contractor shall supply and have delivered to TYAD a refuse receptacle for rubbish and debris collection and for rubbish and debris removal from TYAD. Location for placement of the Contractor’s refuse receptacle will be provided by the Government to the Contractor in advance of Contractor work initiation. The Contractor shall remove the refuse receptacle within 5 working days following completion of all contractual work.

4.6 It shall be the responsibility of the Contractor to contact the TYAD Fire Department to obtain a Hot Work Permit prior to the Contractor performing welding, torch cutting, metal cutting and grinding, soldering, and the performance of all activities in which an open flame and burning are needed.

4.7 The Contractor shall be responsible to supply all necessary PPE for all Contractor personnel.

5.0 Delivery, Assembly, and Installation

5.1 The Contractor shall use only electric-powered equipment inside all Government buildings.

For all Contractor-supplied electrical equipment that require battery recharging it shall be the responsibility of the Contractor to supply battery-charging equipment. Connection of the Contractor-supplied battery-charging equipment to TYAD power shall be the responsibility of the Contractor. A location for the battery-charging equipment will be provided by the Government to the Contractor.

5.2 It shall be the responsibility of the Contractor to deliver, off-load, transport, place, and properly position the new machine within Bldg.1C Bay 2 at the designated floor locations at TYAD. The Contractor shall be responsible to provide all personnel and equipment necessary to deliver, off-load, transport, place, and properly position the new machine at the designated floor locations in Bldg. 1C Bay 2. Only electric-powered material handling equipment shall be used by the Contractor inside all Government buildings. Delivery date and time shall be coordinated by the Contractor with the COR a minimum 14 calendar days in advance of the anticipated delivery at TYAD. The Contractor shall be able to provide delivery of the machine on a Saturday. Delivery shall include all accessory and assembly pieces and materials. A partial delivery is not acceptable.

5.3 Within 7 calendar days after delivery of the machine the Contractor shall arrive on-site to begin machine assemblies and installations.

5.4 The Contractor shall be responsible to remove all packaging, packing and crating material from the machine, the accessory pieces and the assembly pieces and remove all of the packaging, packing and crating materials from TYAD. It shall be the responsibility of the Contractor to completely and thoroughly clean the machine, accessory pieces and assembly pieces.

5.5 The Contractor shall be responsible to supply a refuse receptacle. Location for placement of the Contractor’s refuse receptacle will be provided by the Government to the Contractor in advance of work initiation. The Contractor shall remove the refuse receptacle within 5 working days following completion of all contractual work.

5.6 For machines that have manufacturer’s specifications for machine grounding, it shall be the full responsibility of the Contractor to ground the machine per manufacturer’s specifications.

Notify TYAD Garrison Engineering prior to drilling for anchors, cutting concrete or installing ground rods. The contractor shall use a HEPA Vacuum with a dust/Silica capture device when drilling or cutting concrete. The Contractor shall furnish all materials, tools and labor to ground the machine per manufacturer’s specifications.

5.7 The Contractor shall anchor the machine to the floor, per manufacturer’s specifications.

The Contractor shall supply all materials, tools, labor and equipment to anchor the machine to the floor per manufacturer’s specifications.

5.8 The Contractor shall be responsible to level the machine, per the manufacturer’s specification. The Contractor shall furnish all equipment, tools, materials and personnel to level the machine per…