Attach_0001_-_NEC_RI_ITSS_PWS_31Aug2016.pdf

TABLE OF CONTENTS

1.1. PURPOSE

1.2. BACKGROUND

1.2.1. SINGLE NETWORK ENTERPRISE CENTER (NEC)

1.2.2. COMMAND, CONTROL, COMMUNICATIONS, COMPUTER AND INFORMATION MANAGEMENT

(C4IM)

1.2.3. STANDARDIZED COMPUTER/NETWORK CONFIGURATIONS AND ENTERPRISE SYSTEMS

1.3. SCOPE

1.3.1. NOTE1:

1.3.2. NOTE2:

1.3.3. PERIOD AND PLACE OF PERFORMANCE

1.4. HOURS OF OPERATIONS

1.4.1 EMPLOYEE ROSTER:

1.5. AFTER-HOURS SUPPORT

1.5.1. SCHEDULED MAINTENANCE

1.5.2. OUTAGE AND EMERGENCY RESPONSE NOTIFICATION

1.6 PHASE IN/PHASE OUT

1.6.1 PHASE IN

1.6.2 PHASE OUT

1.7. KEY CONTROL

1.8. ACCESS TO PROTECTED INFORMATION

1.9. SECURITY REQUIREMENTS

1.10. PROTECTION

1.10.1 INFORMATION ASSURANCE

1.10.2. INFORMATION ASSURANCE WORKFORCE CERTIFICATION

1.10.3. NON-GOVERNMENT-OWNED COMPUTING SYSTEMS OR DEVICES

1.10.4. PROTECTION OF SENSITIVE UNCLASSIFIED DATA

1.11. ANTITERRORISM

1.11.1. ANTITERRORISM LEVEL I TRAINING

1.11.1.1. iWATCH

1.11.1.2. EMERGENCIES AND FORCE PROTECTION CONDITIONS

1.11.1.3. OPERATIONS SECURITY (OPSEC)

1.12. ACCOUNTING FOR CONTRACTOR SUPPORT

1.13. CONTRACTOR IDENTIFICATION REQUIREMENTS

1.14. COMMON ACCESS CARD (CAC)

1.15. STAFF AND KEY PERSONNEL

1.15.1. SITE MANAGER

1.15.2. QUALITY CONTROL MANAGER (QCM)

1.15.3. ORGANIZATIONAL STRUCTURE AND KEY PERSONAL

1.15.4 RECRUITMENT AND RETENTION PLAN

1.16. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

1.17. IN-PROGRESS REVIEW AND PROGRAM REVIEWS

1.17.1. MEETINGS

1.17.2. IN-PROCESS REVIEWS (IPR)

1.18. QUALITY CONTROL

1.19. QUALITY ASSURANCE (QA)

1.20. CONTRACTOR RESPONSIBILITIES TO COMPLY WITH LAWS AND REGULATIONS. 17

1.21. TECHNICAL ASSISTANCE

1.22. TRANSPORT OF EQUIPMENT

1.23. REPORTING REQUIREMENTS

1.24. SAFETY

1.25. ACCESS TO PROTECTED INFORMATION

1.26. TRAVEL

1.26.1. TRAVEL/TRAINING COSTS

1.27. TRAINING

1.27.1. TRAINING FOR NEW REQUIREMENT

1.27.2. REMOTE SITE TRAVEL

1.27.3. SOLDIER, CIVILIAN INTEGRATION PROGRAM (SCIP)

1.28. CONTRACTOR RESPONSIBILITY TO OBTAIN MATERIALS AND SUPPLIES IN A

TIMELY MANNER

1.29. PROCESSES AND PROCEDURES DOCUMENTATION:

1.30. RECORDS MANAGEMENT PLAN

SECTION C2

DEFINITIONS & ACRONYMS

2.1. DEFINITIONS:

2.2. ACRONYMS: …..………………………………………………………………………………… 22

SECTION C3

GOVERNMENT FURNISHED PROPERTY

3. GOVERNMENT FURNISHED PROPERTY

3.1. FACILITIES

3.2. UTILITIES

3.3 PROPERTY

3.4 INCIDENTAL PROPERTY

3.5 CONTRACTOR PROPERTY

3.6. PROPER DISPOSAL OF EQUIPMENT AND MATERIAL

SECTION C4

CONTRACTOR FURNISHED PROPERTY

4. CONTRACTOR SUPPLIED PROPERTY

SECTION C-5

WORK REQUIREMENTS

5.1. PURPOSE

5.1.1. HOURS OF OPERATIONS

5.1.2. DOCUMENTS ASSOCIATED WITH THIS PWS

5.1.3. SERVICE ORDER/TROUBLE TICKET SYSTEM

5.1.4. INTERACTIVE CUSTOMER EVALUATION (ICE) SYSTEM

5.1.5. ARMY ENTERPRISE SERVICE DESK (AESD)

5.1.6. PRIORITY REQUIREMENTS

5.1.7. DATA CALLS

5.1.8. PROJECT IMPLEMENTATION AND MANAGEMENT

5.1.9. INTERFACING WITH GOVERNMENT PERSONNEL AND OTHER CONTRACTORS

5.1.10. MEETINGS AND DAILY INTERACTIONS

5.1.11. CONFIGURATION CONTROL BOARD (CCB)

5.1.12. CERTIFICATE OF NETWORTHINESS (CoN)

5.1.13. WARRANTY REPAIR

5.1.14. REPORTS AND DATA REQUIREMENTS

5.1.15. COMPUTER ROOM ORGANIZATION AND CLEANLINESS

5.2. AUTOMATION

5.2.1. DIRECTORY SERVICES AND STORAGE SERVICES:

5.2.1.1. DIRECTORY SERVICES

5.2.1.2. STORAGE SERVICES

5.2.2. DATABASE ADMINISTRATION SERVICES

5.2.2.1. ADMINISTRATION AND MAINTENANCE

5.2.3. DESKTOP/SOFTWARE/PERIPHERAL SUPPORT SERVICES

5.2.3.1. DESKTOP CONFIGURATION

5.2.3.2. DESKTOP SUPPORT SERVICES

5.2.3.3. SOFTWARE/APPLICATION DEVELOPMENT FOR ALL AUTOMATION SYSTEM TYPES:

5.2.3.4. PASSWORD CONTROL MANAGEMENT

5.2.3.5. LIFE CYCLE REPLACEMENT (LCR)

5.2.3.6. TOUCH LABOR SUPPORT

5.2.4. WEB SUPPORT SERVICES

5.2.5. SERVER ADMINISTRATION AND SUPPORT SERVICES

5.2.5.1. SERVER ADMINISTRATION

5.2.5.2. TOUCH LABOR

5.2.6. MANAGEMENT OF DATA NETWORK SERVICES

5.2.6.1. EXTERNAL NETWORKS

5.2.6.2. VIRTUAL PRIVATE NETWORK (VPN)

5.2.6.3. LOCAL AREA NETWORK (LAN) AND CAMPUS AREA NETWORK (CAN)

5.2.6.4. NETWORK MANAGEMENT

5.2.6.5. TOUCH LABOR

5.2.6.6. DATA NETWORK PLANNING

5.2.6.7. WIRELESS COMPUTING SERVICES

5.2.7. AUTOMATION AND NETWORK CONTINUITY OF OPERATIONS (COOP) AND OPLAN SUPPORT

SERVICES

5.2.7.1. COOP ADMINISTRATION

5.2.7.2. DISASTER RECOVERY

5.2.8. AUTOMATION SERVICE SUPPORT

5.3. VIDEO TELECONFERENCE (VTC) SERVICES

5.3.1. VTC STUDIO

5.3.2. VTC BRIDGE

5.3.3. MISSION SPECIFIC VTC SERVICE

5.3.4. SECURE VIDEO TELECONFERENCING (SVTC) SUPPORT

5.4. INFORMATION ASSURANCE (IA)

5.4.1. DOD PUBLIC KEY INFRASTRUCTURE (PKI) SERVICE

5.4.1.1. DoD PKI SERVICES

5.4.1.2. PKI AUTHENTICATION

5.4.1.3. REGISTRATION OF ARMY-OWNED PKI PROTECTED DEVICES

5.4.2. COMMUNICATIONS SECURITY (COMSEC) SERVICE

5.4.3. RISK MANAGEMENT FRAMEWORK/ACCREDITATION/CERTIFICATION POLICY SERVICES

5.4.3.1. SECURITY RISK ASSESSMENT, INFORMATION ASSURANCE CERTIFICATION AND

ACCREDITATION PROGRAM, AND CERTIFICATE OF NETWORTHINESS (CON)

5.4.3.2. VULNERABILITY RISK ASSESSMENT

5.4.3.3. INFORMATION SECURITY (INFOSEC) GUIDANCE AND CERTIFICATION AND ACCREDITATION.

5.4.4. NETWORK SECURITY SERVICES

5.4.4.1. DEFENSE IN DEPTH

5.4.4.2. INFORMATION ASSURANCE (IA) REPORTING

5.4.4.3. WIRELESS INTRUSION DETECTION SENSORS (WIDS)

5.4.4. INSTALLATION NETWORK SECURITY DEMILITARIZED ZONE (DMZ) SERVICE

5.4.5. INFORMATION ASSURANCE VULNERABILITY ALERT MANAGEMENT (IAVM)

5.4.5.1. IAVA PROGRAM

5.4.5.2. NETWORK, WORKSTATION, SERVER SCANS

5.4.5.3. MALICIOUS AND UNAUTHORIZED ACTIVITIES

5.4.5.4. SECURITY COMPLIANCE CHECKS

5.4.6. PASSWORD CONTROL MANAGEMENT

5.4.7. INFORMATION ASSURANCE (IA) POLICY

5.4.7.1. INSTALLATION IA PROGRAM

5.4.7.2. TECHNICAL GUIDANCE AND COURSES OF ACTION

5.4.8. HOST-BASED SECURITY SYSTEM (HBSS)

5.4.9. COMPLIANCE MONITORING AND ENFORCEMENT

5.5. ABOVE BASELINE SERVICES (REIMBURSABLE)

5.5.1. ARMY SUSTAINMENT COMMAND (ASC)

5.5.1.1. NONSTANDARD DATABASE SUPPORT

5.5.1.2. VTC SUPPORT (Secure and Non/Secure)

5.5.1.3. SECURE VIDEO BRIDGE

5.5.1.4. SYSTEM ACCREDITATION AND RE-ACCREDITATION FOR SECURE VIDEO BRIDGE

5.5.1.5. ABOVE BASELINE CONTRACT DATA REQUIREMENTS LIST (CDRL)……..……………………………… 47

5.5.2. ARMY CONTRACTING COMMAND-ROCK ISLAND (ACC-RI)

5.5.2.1. ABOVE BASELINE DESKTOP SUPPORT

5.5.2.2. END OF YEAR REQUIREMENTS. ................................................. Error! Bookmark not defined.

5.5.2.3. VTC SUPPORT (SECURE AND NON-SECURE)

5.5.3. UNITED STATES ARMY GARRISON-ROCK ISLAND ARSENAL (USAG-RIA):

5.5.3.1. VTC SUPPORT – OPERATE AND MAINTAIN MISSION VTC SUITE(S)

5.5.3.2. WEB AND DATABASE APPLICATION SUPPORT:

5.5.4. STANDARDIZED ABOVE-BASELINE SERVICES

5.5.4.1. STORAGE AREA NETWORK

5.5.4.2. SERVER SUPPORT:

5.5.4.3. DATA TRANSFER FOR LIFE CYCLE (Per Machine)

5.5.4.4. EMBEDDED TECH FOR ABOVE BASELINE IT TECH SUPPORT

5.5.4.5. INFORMATION ASSURANCE (IA) SUPPORT

5.5.4.6. ABOVE BASELINE DESKTOP SUPPORT FOR VIPs…..…………………………………………………………….52

5.5.4.7. WEB AND DATABASE APPLICATION SUPPORT:

5.5.4.7.1. WEB AND DATABASE APPLICATION SUPPORT: …..…………………………………………………….……53

SECTION 6

FORMS AND PUBLICATIONS

SECTION C1

GENERAL CONTRACT INFORMATION

1.1. PURPOSE. Provide Command, Control, Communications, Computer, and Information Management (C4IM) services to organizations and users serviced by Network Enterprise Center-Rock Island Arsenal (NEC-RIA).

1.2. BACKGROUND.

1.2.1. SINGLE NETWORK ENTERPRISE CENTER (NEC). The Army has made a concerted effort to align C4IM responsibilities in a standard way throughout the Army. AR 25-1 mandates that each US Army installation have a single NEC responsible for delivering C4IM common-user Baseline services to all users. This requirement complies with the single NEC mandate by combining all Baseline, and certain Above Baseline/Mission services, C4IM services under one requirement.

1.2.2. COMMAND, CONTROL, COMMUNICATIONS, COMPUTER AND

INFORMATION MANAGEMENT (C4IM). This requirement is based on the C4IM Services List, TE-1. Under C4IM, the NEC is responsible for providing Baseline services, including common-user desktop support, voice/data communication systems, infrastructure server support, and other C4IM services to all users on an Installation. Mission organizations may acquire additional Above Baseline/Mission services from the NEC. This solicitation includes both Baseline and Above Baseline/Mission services as defined in this Performance Work Statement (PWS) and associated documents.

1.2.3. STANDARDIZED COMPUTER/NETWORK CONFIGURATIONS AND

ENTERPRISE SYSTEMS. The Army is centralizing and standardizing its computer and network configurations. Personal computers (PCs) and servers must be configured with the Army Golden Master (AGM) configuration; PCs, servers, Local Area Network (LAN) switches, and other devices must be configured in accordance with the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs); and system patching must be performed IAW guidance and deadlines provided by the responsible Army and Department of Defense (DoD) enterprise authorities. The Army has moved to enterprise NIPRNet systems where the hardware is located at RIA but system administration is performed remotely by Second Regional Cyber Center (2RCC) or others. Examples include: DoD Enterprise Email, Firewalls, Host Based Security Systems (HBSS), Active Directory (AD), and System Center Configuration Manager (SCCM). Similar efforts are underway or have been accomplished on SIPRNet (Enterprise Email, HBSS, etc). Enterprise systems may have some physical devices located at RIA (HBSS, Firewalls, AD, and SCCM), which may require NEC-RIA to administer portions of the system, and almost always require the NEC-RIA to perform some functions and to coordinate with system administrators at higher headquarters.

1.3. SCOPE. This is a non-personal services contract to provide IT automation and technical support services in support of the Network Enterprise Center-Rock Island Arsenal (NEC-RIA).

The Contractor shall deliver comprehensive, integrated, end-to-end IT services that include, but are not limited to, Network and Switch Operations, Systems Administration, Systems Integration and Testing, Configuration Management (hardware and software), Infrastructure Management, Network Administration, End-User Support, Fielding of Hardware and Software, Quality Control, Information and Network Security Services, Commercial Off-The-Shelf (COTS), Government Off The Shelf (GOTS) software, and Database Support. NEC-RIA has Mission Assurance

Category (MAC) II Sensitive and MAC II Classified Secret Networks. NEC-RIA provides C4IM support to approximately 6000 users in multiple mission organizations. Services include both C4IM Baseline, Above Baseline/Mission services, and are directly in support of users to maintain, improve, and upgrade NEC-RIA infrastructure, systems, and processes. This PWS is for the following C4IM designated services:

a. 700.0 – Automation

b. 701.0 – Communications and Systems Support (partial, see note 1.3.1 below)

c. 703.0 - Information Assurance

1.3.1. NOTE1: A separate Contractor, under the Army’s Administrative Telephone Services (ATS) contract, is responsible for telephone system administration and telephone/network cabling.

1.3.2. NOTE2: Some services have moved from NEC controlled to Enterprise or Regional services provided. Services specifically excluded from this PWS are maintaining Email server, EPO/HBSS servers (but must provide client services), Firewall management and servers, SCCM (but provides application management), TLA servers (will provide hands-on as needed), ITSM servers (but uses application), Domain Controller servers (but provides hands-on as needed), Proxy servers, and AGM image develop. These services should not be included in the pricing of this requirement.

1.3.3. PERIOD AND PLACE OF PERFORMANCE. Work will be carried out on Rock Island Arsenal), Rock Island, IL, on which NEC-RIA is located. A minor amount of work will be required off RIA. Examples include C4IM support for off-site events sponsored by NEC-RIA supported organizations: TDY to two small NEC-RIA supported Installations, Iowa Army Ammunition Plant (IAAAP), Middletown, IA, and Lake City Army Ammunition Plant (LCAAP), Independence, MO; Office of the Chief Public Affairs (OCPA) Midwest Region, Chicago, IL, and participation in off-site meetings and conferences.

1.4. HOURS OF OPERATIONS. Normal duty hours are defined as Monday through Friday, 0700-1700 local time, except Federal Holidays unless otherwise specified.

1.4.1 EMPLOYEE ROSTER. The Contractor shall provide the Government with an Employee Roster consisting of Employee’s full name, phone extension, support group/team within 5 working days of contract start and within one day of any changes.

1.5. AFTER-HOURS SUPPORT. The Contractor shall provide after-hours support outside the normal duty hours set forth within this PWS including Saturdays, Sundays, and Holidays. The Contractor is responsible for providing the Government with an after-hours recall roster at the beginning of the contract and within one day of any changes. If the support call requires on-site support, response time for a qualified technician to arrive on-site shall be within 2 hours.

Examples of After Hours Support include, support such as:

VIP Support Network Outages Emergency Maintenance Requirements COOP and IA events Negligent Discharge of Classified Information (NDCI) Incidents

1.5.1. SCHEDULED MAINTENANCE. Scheduled maintenance shall occur, at a minimum, once a month (currently Sunday either 0900-1500 or 1000-1600 depending on whether Daylight Savings Time is in effect). Time is aligned to be concurrent with 2RCC’s monthly maintenance schedule, subject to change depending on mission requirements.

1.5.2. OUTAGE AND EMERGENCY RESPONSE NOTIFICATION. The Contractor shall draft customer and management notification for NEC management approval. The Contractor shall follow established processes for outage and emergency response notifications. Certain official communications; e.g., reporting incidents to the Computer Emergency Response Team (CERT), Commander Critical Information Requirements (CCIR), and outages, shall be approved by NEC management before distribution.

1.6 PHASE IN/PHASE OUT.

1.6.1 PHASE IN. The phase-in period shall be in accordance with FAR Clause 52.237- 3, Continuity of Services and is for a maximum period of 30 calendar days prior to the start of the PoP. Please reference Contract Line Item Number (CLIN) 0010 for further details. The purpose of this phase-in, transition period will allow the contractor to begin the process of transferring source codes, passwords, system access, reviewing of documents, reports, etc.

The Contractor shall submit a phase-in plan as part of the Contract/Business Volume VI as referenced in Section L of the RFP. The phase-in plan shall include, at a minimum, a schedule for implementation and the following actions:

• Direct observation of tasks performed by current personnel.

• Familiarizing personnel with all requirements and procedures.

• Selecting trained and experienced personnel.

• Meeting all security requirements.

• Conducting 100% joint property inventory with current Contractor for all accountable property currently in possession of the current Contractor.

• Performing required training.

• Obtaining required certifications, licenses, and endorsements.

• An overview of potential phase-in period problems and how the Contractor shall address those potential problems.

1.6.2 PHASE OUT. The phase-out period shall be in accordance with FAR Clause

52.237-3, Continuity of Services and is for a maximum period of 30 calendar days and is separate from the PoP. Please reference CLIN 4010 for further details. During this period the contractor shall remain fully responsible for all efforts associated with the contract. The Contractor shall fully cooperate in providing all documentation to include but not limited to source codes, passwords, system integration, etc. If required, a joint inventory of any Government owned property utilized by the contractor shall be conducted.

1.7. KEY CONTROL. The Contractor shall establish and implement methods of making sure all keys and simplex access cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include simplex access cards. The Contractor shall appoint a key holder to maintain accountability for all keys in accordance with AR 190-51, Appendix D. The key holder shall coordinate with the NEC-RIA key holder for the assigned keys. The Government will provide the Contractor with keys and inventory. The Contractor shall conduct an initial 100% key inventory and shall provide the COR a key inventory with key number and Contractor’s name within 14 calendar days of the start of contract. The Contractor shall conduct a semi-annual key inventory review with the Government. No keys issued to the Contractor by the Government shall be duplicated.

The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the COR.

1.8. ACCESS TO PROTECTED INFORMATION. Protected information means all non-public information, including but not limited to trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or Personally Identifiable Information (PII), or any other information with distribution limited by the Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons with a need to know and specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized US Government individual. Further, Contractor employees shall use any non-public information for official/authorized Government purposes only, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

1.9. SECURITY REQUIREMENTS. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and any revisions to DoD 5220.22-M

1.9.1. This contract will require access to classified and controlled or sensitive information and facilities. Highest level security clearance requirement for this work effort is SECRET. Contractor personnel performing on this contract must be a US citizen and shall maintain the required security clearance at contract performance start date and shall maintain the required security clearance over the life of the contract, in accordance with the DD Form 254, Contract Security Classification Specification. New or replacement personnel who require a security clearance to perform under this contract shall have the required security clearance at work performance start date. Cleared Contractor personnel may require access to SIPRNET or other classified systems in support of this work effort. Access to classified systems shall only be at specified Government work locations.

1.9.1.1 Contractor personnel who require a Secret security clearance and who will require IT Level I system access or who will be performing IT level I functions require a Single Scope Background Investigation (SSBI) completed with suitability determination for IT Level I access. The Contractor shall contact the supporting Government Security Office/G2/S2 for submission of the SSBI (SF 86). The Contractor shall provide the contract/task order number as authority to request the investigation. Contractor interim privileged level access to Army systems prior to completion and favorable adjudication of the required investigation will be in accordance with AR 25-2. If Contractor personnel have a favorable SSBI or SSBI Periodic

Reinvestigation (SSBI-PR) on record in Joint Personnel Adjudication System (JPAS), the AR 25-2 investigative requirement for IT Level I is satisfied.

1.9.1.2. Contractor personnel who do not require a security clearance but who require an investigation for suitability/trustworthiness purposes shall contact the supporting Government Security Office/G2/S2 at task order start date regarding submission of the required investigation.

1.9.1.3. IT Levels, security clearance requirements, personnel security and suitability/trustworthiness investigation requirements, and IA/CE certification requirements for work to be performed under this task order are reflected by Functional Category in Table 1 (Information Technology and IA Certification Requirements Table) of this PWS.

1.9.1.4. THREAT AWARENESS AND REPORTING SYSTEM (TARP)

TRAINING. All cleared Contractor personnel assigned to this task order shall complete initial TARP training within 30 days of contract start and annually thereafter. Completion of training shall be reported to the COR. Detailed requirements on TARP are stated in the DD Form 254.

1.9.1.5. Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in this PWS, the DD254 and in effect at the Government work sites identified in paragraph 1.3.3.

1.9.1.6. ACCESS AND GENERAL PROTECTION SECURITY POLICY AND

PROCEDURES. The Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office (PMO), Director of Emergency Services (DES), or Security Office. Contractor workforce shall comply with all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.10. PROTECTION.

1.10.1 INFORMATION ASSURANCE.

1.10.1.1 INFORMATON ASSURANCE (IA) TRAINING. All Contractor personnel with access to Government information systems and networks shall successfully all required initial and annual IA awareness training as specified in AR 25-2 and as specified by the Government requiring activity. Training is available at https://ia.signal.army.mil

1.10.1.2 ARMY TRAINING AND CERTIFICATION TRACKING SYSTEM

(ATCTS): Contractor employees and subcontractor employees performing work under this contract/task order who have access to Government information systems and networks shall create a user account and profile in the ATCTS website at https://atc.us.army.mil, in the unit container managed by the COR upon contract start and within 5 days of any changes.

Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

1.10.1.3 The Contractor shall ensure that all Contractor employees and subcontractor employees requiring IA awareness training complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract/task order.

1.10.2. INFORMATION ASSURANCE WORKFORCE CERTIFICATION. DFARS clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract/task order. This contract/task order is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

1.10.2.1. The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

1.10.2.2. The Contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/milconnect/faces/index.jspx.

1.10.2.3. Table 1 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract/task order tasks, in accordance with DoD 8570.01-M.

Table 1. Information Technology Access and IA Certification Requirements.

Functional Category

IT Level Required

(IAW AR

25-2)

Security Clearance

Investigation Required

IA Certification Category and Level

(IAW DoD 8570.01-M and BBP 05-PR-M-

0002)

Computing Environment Certifications

NIPR or SIPR AD Administration / OU Administration IT-I SECRET SSBIT5SSBI IAT-II yes NIPR or SIPR SAN Administration IT-I SECRET SSBI IAT-II yes NIPR or SIPR Network Administration IT-I SECRET SSBI IAT-II yes NIPR or SIPR IA Scanning (ACAS/Qtip) IT-I SECRET SSBI IAT-II yes NIPR or SIPR SCCM Administration IT-I SECRET SSBI IAT-II yes SIPR Server Administration (no AD or OU administration) IT-I SECRET SSBI IAT-II yes SIPR Sharepoint Administration IT-I SECRET SSBI IAT-II yes SIPR Database Administration IT-I SECRET SSBI IAT-II yes SIPR Tier II Desktop Administration IT-I SECRET SSBI IAT-I yes

Functional Category

IT Level Required

(IAW AR

25-2)

Security Clearance

Investigation Required

IA Certification Category and Level

(IAW DoD 8570.01-M and BBP 05-PR-M-

0002)

Computing Environment Certifications

NIPR Server Administration (no AD or OU administration) IT-II SECRET Tier 3 (T3) IAT-II yes NIPR Sharepoint Administration IT-II SECRET T3 IAT-II yes NIPR Database Administration IT-II SECRET T3 IAT-II yes NIPR Web Administration/Development IT-II SECRET T3 IAT-II yes NIPR Tier II Desktop Administration IT-II SECRET T3 IAT-I yes Project Management IT-III none Tier 1 (T1) N/A no QA/Documentation/Business Operations IT-III none T1 N/A no VTC Operations IT-III SECRET T3 N/A no Site Management IT-III SECRET T3 N/A no Administrative Support IT-III none T1 N/A no Information Assurance II IT II SECRET T3 IAM II no Information Assurance I IT II SECRET T3 IAM I no

1.10.3. NON-GOVERNMENT-OWNED COMPUTING SYSTEMS OR DEVICES. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives; e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives, removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

1.10.4. PROTECTION OF SENSITIVE UNCLASSIFIED DATA. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to laptop, netbook, notebook, or tablet computers. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives), floppy disks, and other portable digital storage devices

1.11. ANTITERRORISM.

1.11.1. ANTITERRORISM LEVEL I TRAINING. The Contractor shall ensure that all contractor employees, including sub-contractors, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I Awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after completion of training, the Contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I Awareness training. AT Level I Awareness training is available at https://jkodirect.jten.mil, course #JS-

US007.

1.11.1.1. iWATCH. The Contractor shall ensure that all contractor employees and subcontractor employees performing work under this contract, are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract with the results reported to the COR NLT 45 calendar days after contract award. The requiring activity Anti-Terrorism Officer will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

1.11.1.2. EMERGENCIES AND FORCE PROTECTION CONDITIONS. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, Contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor’s Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

1.11.1.3. OPERATIONS SECURITY (OPSEC). The Contractor shall comply with DoD Directive 5205.02, Army Regulation 530-1, and the requiring activity OPSEC program. The Contractor shall ensure all employees, including sub-contractors performing work under this contract, complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

1.12. ACCOUNTING FOR CONTRACTOR SUPPORT. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection where the Contractor shall report all Contractor manpower (including sub-contractor manpower) required for performance of this contract. The Contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil. The required information includes: (1) Contracting Office, Contracting Officer, (2) Contract number, including task or delivery order number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, email address, identity of Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractors; (6) Estimated direct labor dollars paid this reporting period (including sub-Contractors); (7) Total payments (including sub-Contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor, if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (11) Locations where the Contractor and sub-contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML https://cmra.army.mil/ data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a Contractor's systems to the secure web site without the need for separate data entries for each required data element at the web site. The specific formats for the XML direct transfer may be downloaded from the web site. The Contractor shall report all contractor labor hours (including sub-contractor labor hours) required for performance of services provided under this contract for the Army via the eCMRA secure data collection site.

The Contractor is required to completely fill-in all required data fields within the eCMRA.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2016. Contractors may direct questions to the Help Desk at:

http://www.ecmra.mil/.

1.13. CONTRACTOR IDENTIFICATION REQUIREMENTS. In accordance with FAR 37.114(c), all Contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee's name, the contractor's name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees to wear the ID badges visibly when performing work at Government workplaces.

Contractor personnel shall also ensure that all emails, documents, or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on emails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

1.14. COMMON ACCESS CARD (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://www.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems (reference DD254 for additional security requirements) to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

1.15. STAFF AND KEY PERSONNEL. All employees must be US citizens and be able to read, speak, and write in English. The Contractor shall identify the staffing plan and organization required to meet the objectives and requirements identified in this PWS. The following must be included in the staffing plan:

1.15.1. SITE MANAGER. The Contractor shall have an On-Site Manager who shall be responsible for the performance of all work identified in this PWS. The Contractor shall designate the Site Manager and an alternate Site Manager (who has the same authority as the primary Site Manager) in writing to the KO and the COR prior to the completion of the Phase In period. The Contractor shall ensure that the COR can contact the Site Manager to meet within http://www.ecmra.mil/ https://www.dmdc.osd.mil/tass

30 minutes during normal duty hours at a specific location. After normal duty hours, the Site Manager or designated representative shall be available to meet with Government representatives at the work site (location) specified within two hours of notification. A Site Manager shall immediately report any imminent system failure to the COR or a NEC Manager and provide a recommended operational or repair solution. The Contractor shall follow up the action with a written report (email or memorandum). If, in the Contractor’s judgment substandard conditions exist, the Site Manager shall document the conditions to the COR in writing for review and final disposition. In the event of a safety hazard, the Contractor may request and obtain verbal approval for corrective action from the COR and follow-up with a written report.

1.15.2. QUALITY CONTROL MANAGER (QCM). The Contractor shall designate a full-time QCM. The QCM shall be responsible for the overall management and implementation of the Contractor’s Quality Control Plan and the Customer Satisfaction Surveys. The Contractor shall make full use of the Interactive Customer Evaluation (ICE) Survey System to manage NEC-RIA customer comments, interact with customers, resolve complaints, update comments, and provide reports/metrics.

1.15.3. ORGANIZATIONAL STRUCTURE AND KEY PERSONAL. The Contractor shall include a detailed organizational chart that depicts the roles of responsibilities of each functional area. The Contractor shall identify, maintain, and update a list of Key Personnel within their organization for all requirements identified in the PWS.

1.15.4 RECRUITMENT AND RETENTION PLAN. The Contractor shall provide the Government with a recruitment and retention plan that addresses: their recruitment and hiring practices, retention measures, termination policies and procedures, employee development tools, and compensation policies, any other policies that would serve to obtain and maintain the personnel resources necessary to successfully perform the work specified in the PWS.

1.16. CONTRACTING OFFICER’S REPRESENTATIVE (COR). The Contracting Officer (KO) will provide a COR Designation Letter for this contract upon award. The Contractor shall acknowledge the COR Designation Letter in writing and return to the KO within 5 business days of receipt.

1.17. IN-PROGRESS REVIEW AND PROGRAM REVIEWS.

1.17.1. MEETINGS. The Contractor shall be required to meet periodically with the COR and KO. Meetings will be scheduled as needed.

1.17.2. IN-PROCESS REVIEWS (IPR). The Contractor shall plan and conduct IPRs every two weeks in collaboration with the COR. The purpose of the IPRs is to present, discuss, and analyze trends in system performance, support center performance, and to conduct forecasting with respect to system upgrades, deployments, projects, and other potential, or planned surge situations. On a quarterly basis, the Contractor shall present a new technology, concept, or change to existing technology in an effort to enhance NEC capabilities or efficiencies. After collaboration with the Government COR, the Contractor shall prepare, distribute and use an agenda for the meeting to ensure that all participants are prepared to address pertinent issues and to serve as a mechanism for ensuring that all issues are addressed by the leadership.

1.18. QUALITY CONTROL. The Contractor shall develop, implement, and maintain an effective Quality Control System which includes a written Quality Control Plan (QCP). The QCP shall implement standardized procedure/methodology for monitoring and documenting contract performance to ensure all contract requirements are met. The Contractors’ QCP must contain a systematic approach to monitor operations to ensure acceptable services/products are provided to the Government. The QCP, as a minimum, shall address continuous process improvement; procedures for scheduling, conducting, and documentation of inspection;

discrepancy identification and correction; corrective action procedures to include procedures for addressing non-conformances; procedures for root cause analysis to prevent re-occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints. One copy of the Contractor’s QCP shall be provided to the Contracting Officer at the time the contract proposal is submitted. After Government acceptance of the QCP, any changes to the plan shall be submitted to the KO for written approval/acceptance.

1.19. QUALITY ASSURANCE (QA). The Government will monitor the Contractor's performance under this contract. The Government has the right to conduct inspections and performance evaluation at any time. If any aspect of the performance is not in conformance with the requirements of this contract, the Government has the right to issue to the Contractor a Contract Discrepancy Report (CDR). The Contractor shall explain in writing why performance was not in conformance with the requirements of the contract, how performance will be returned to conformance, and how recurrence of the problem will be prevented in the future. The Contractor shall complete and return the CDR to the Contracting Officer and COR within five workdays after receipt of the CDR. The Contractor shall maintain copies of all inspection and evaluation reports.

1.20. CONTRACTOR RESPONSIBILITIES TO COMPLY WITH LAWS AND REGULATIONS.

Contract functions shall be performed in accordance with the most recent versions of applicable regulations, directives, and headquarters guidance. Primary governing regulations are located in Section C-6, Publication and Forms. All services and supplies provided under this requirement must comply with the Clinger-Cohen Act, Section 508 of the Rehabilitation Act of 1973, as amended (29 USC 794d) and must meet the applicable accessibility standards at 36 CFR Part 1194.

1.21. TECHNICAL ASSISTANCE. The Contractor shall provide technical assistance to the Government in support of the Government’s inspection and acceptance of third-party Contractor installation projects that, upon completion of the projects, will become part of the Contractor’s operation and maintenance (O&M) responsibility through incorporation into the contract. At the direction of the COR, the Contractor shall provide assistance to technical evaluations, Inspector General (IG) inspections and ISEC-CONUS engineering projects. In all cases, the Contractor shall only provide input and shall not make final decisions on acceptability, compliance, or other decisions that require an exercise of Government discretion. Appropriate Contractor support includes providing familiarization with plant drawings and physical location of equipment, among other things.

1.22. TRANSPORT OF EQUIPMENT. The Contractor shall be responsible for packing/unpacking and moving NEC infrastructure equipment; e.g., UPS, servers, racks, switches, etc. The Contractor shall not be responsible for transporting end-user devices; e.g., laptop, desktop, printers. The Contractor shall use Contractor furnished vehicle in Section C4 to move this equipment.

1.23. REPORTING REQUIREMENTS. The Contractor shall provide reports on the IT requirements identified within the PWS and listed in the Contract Data Requirements List (TE- 3). The Contractor shall not be relieved from meeting CDRL requirements if all data required is not available in the Government-furnished service order/trouble ticket system identified in Government Furnished Software (TE-6).

1.24. SAFETY. The Contractor shall perform in a manner that assures maximum safety and protection for their employees and all personnel while performing work for this contract. The Contractor shall exercise surveillance on a continuing basis and shall eliminate or otherwise control existing or potential safety hazards.

1.24.1 The Contractor shall participate in the Government’s safety program.

Compliance with provisions pertaining to safety of site facilities and equipment is mandatory.

The Contractor shall establish and implement a comprehensive Safety Program Plan for use by contractor and sub-contractor employees. This Plan shall incorporate appropriate elements of 29 CFR 1910 and 1926, AR 385-10, NETCOM Reg 385-1 and applicable OSHA regulatory guidance. The Contractor shall provide the COR and KO with its Safety Program Plan within 30 calendar days of contract award for acceptance. The COR and KO will approve all updates to the Safety Program Plan before implementation.

1.24.2. The Contractor shall comply with all federal, state and local policies, directives, laws and regulations. During the performance of tasks requiring protective equipment and clothing, contractor employees shall wear safety items required by OSHA and as specified in the applicable regulations. The Contractor shall be responsible for providing personal protective equipment, clothing and training.

1.24.3. The COR may require the Contractor to cease operations associated with the performance of this contract for safety violation reasons. The Contractor shall correct any safety violations, caused by a contractor employee, during non-duty hours at no additional cost to the Government.

1.24.4. The Contractor shall ensure all employees receive the safety training required by all federal, state and local laws and policies. The Contractor shall maintain the safety training records and make them available to the COR and KO upon request.

1.25. ACCESS TO PROTECTED INFORMATION. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the U.S. Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized U.S. Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent.

Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

1.26. TRAVEL. The Contractor shall obtain all necessary travel documents to execute travel as required. The Contractor shall ensure all Contractor employees comply with all guidance and instructions issued based on the need to ensure mission accomplishment, force protection, and safety. The Government will reimburse the Contractor, in accordance with the Joint Travel Regulation (JTR) and FAR part 31.205-46, for all approved travel incurred during the performance of this task order. The COR will approve all travel requirements before travel begins. The Contractor shall not proceed without this notification and adequate contract funding.

1.26.1. TRAVEL/TRAINING COSTS. The Contractor shall submit all requests for reimbursable travel/training prior to commencing travel or training, to the Government for approval within 10 workdays prior to requested travel/training. Travel is not authorized until written Government approval is received.