NEC-RIA_ITS_PWS_Oct_15.pdf

SECTION C1

GENERAL CONTRACT INFORMATION

1.1. PURPOSE. Provide Command, Control, Communications, Computer, and Information Management (C4IM) services to organizations and users serviced by Network Enterprise Center-Rock Island Arsenal (NEC-RIA).

1.2. BACKGROUND.

1.2.1. SINGLE NETWORK ENTERPRISE CENTER (NEC). The Army has made a concerted effort to align C4IM responsibilities in a standard way throughout the Army. AR 25-1 mandates that each US Army installation have a single NEC responsible for delivering C4IM common-user Baseline services to all users. This solicitation complies with the single NEC mandate by combining all Baseline, and certain Above Baseline/Mission services, C4IM services under one requirement.

1.2.2. COMMAND, CONTROL, COMMUNICATIONS, COMPUTER AND

INFORMATION MANAGEMENT (C4IM). This solicitation is based on the C4IM Services List, TE-2, and on the LandWarNet Services Catalog, TE-1. Under C4IM, the NEC is responsible for providing Baseline services, including common-user desktop support, voice/data communication systems, infrastructure server support, and other C4IM services to all users on an Installation.

Mission organizations may acquire additional Above Baseline/Mission services from the NEC.

This solicitation includes both Baseline and Above Baseline/Mission services as defined in this Performance Work Statement (PWS) and associated documents.

1.2.3. STANDARDIZED COMPUTER/NETWORK CONFIGURATIONS AND

ENTERPRISE SYSTEMS. The Army is centralizing and standardizing its computer and network configurations. Personal computers (PCs) and servers must be configured with the Army Golden Master (AGM) configuration; PCs, servers, Local Area Network (LAN) switches, and other devices must be configured in accordance with the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs); and system patching must be performed IAW guidance and deadlines provided by the responsible Army and Department of Defense (DoD) enterprise authorities. The Army has moved to enterprise NIPRNet systems where the hardware and/or system administrators are remotely located at RIA. Examples include but not limited to: DoD Enterprise Email, Firewalls, Host Based Security Systems (HBSS), Active Directory (AD), and System Center Configuration Manager (SCCM). Similar efforts are underway or have been accomplished on SIPRNet (Enterprise Email, HBSS, etc).

Enterprise systems may have some physical devices located at RIA (HBSS, Firewalls, AD, and SCCM), which may require NEC-RIA to administer portions of the system, and almost always require the NEC-RIA to perform some functions and to coordinate with system administrators at higher headquarters.

1.3. SCOPE. This is a non-personal services contract to provide IT automation and technical support services to the Network Enterprise Center-Rock Island Arsenal (NEC-RIA). The Contractor shall deliver comprehensive, integrated, end-to-end IT services that include, but are not limited to, Network and Switch Operations, Systems Administration, Systems Integration and Testing, Configuration Management (hardware and software), Infrastructure Management, Network Administration, End-User Support, Fielding of Hardware and Software, Quality Control, Information and Network Security Services, Commercial Off-The-Shelf (COTS), Government Off The Shelf (GOTS), and Database Support. NEC-RIA has Mission Assurance Category (MAC)

II Sensitive and MAC II Classified Secret Networks. NEC-RIA provides C4IM support to approximately 6000 users in multiple mission organizations. Services include both C4IM Baseline, Above Baseline/Mission services, and are directly in support of users to maintain, improve, and upgrade NEC-RIA infrastructure, systems, and processes. This PWS is for the following C4IM designated services:

a. 700.0 – Automation

b. 701.0 – Communications and Systems Support (partial, see note 1.3.1 below)

c. 703.0 - Information Assurance

1.3.1. NOTE: A separate Contractor, under the Army’s Administrative Telephone Services (ATS) contract, is responsible for telephone system administration and telephone/network cabling.

1.3.2. PERIOD AND PLACE OF PERFORMANCE. Base Year (1 April 2016 – 31 March 2017) plus four option years. Virtually all work will be carried out on Rock Island Arsenal), Rock Island, IL, on which NEC-RIA is located. A minor amount of work will be required off RIA. Examples include C4IM support for off-site events sponsored by NEC-RIA supported organizations: TDY to two small NEC-RIA supported Installations, Iowa Army Ammunition Plant (IAAAP), Middletown, IA, and Lake City Army Ammunition Plant (LCAAP), Independence, MO; Office of the Chief Public Affairs (OCPA) Midwest Region, Chicago, IL, and participation in off-site meetings and conferences.

1.4. HOURS OF OPERATIONS. Normal duty hours are defined as Monday through Friday, 0700-1700 local time, except Federal Holidays unless otherwise specified

1.5. AFTER-HOURS SUPPORT. The Contractor shall provide after-hours support outside the normal duty hours set forth within this PWS including Saturdays, Sundays, and Holidays. The Contractor is responsible for maintaining and providing the Government with a recall roster for after-hours support. If the support call requires on-site support, response time for a qualified technician to arrive on-site shall be within 2 hours. Examples of After Hours Support include, but are not limited, to:

VIP Support Network Outages Emergency Maintenance Requirements COOP and IA events Unauthorized Negligent Discharge of Classified Information (NDCI) Incidents

1.5.1. SCHEDULED MAINTENANCE. Scheduled maintenance shall occur, at a minimum, once a month (currently Sunday either 0900-1500 or 1000-1600 depending on whether Daylight Savings Time is in effect). Time is subject to change depending on mission requirements. The Contractor shall stagger employee work schedules to avoid overtime costs.

1.5.2. OVERTIME. Non-standard hours may be required to support after-hours requirements in emergency situations or other special situations as specified and approved by the Contracting Officer’s Representative (COR) or Contracting Officer (KO).

1.5.3. OUTAGE AND EMERGENCY RESPONSE NOTIFICATION: Contractor shall draft customer and management notification for NEC management approval. Contractor shall follow established processes for outage and emergency response notifications. Certain official communications; e.g., reporting incidents to the Computer Emergency Response Team (CERT), Commander Critical Information Requirements (CCIR), and outages, shall be approved by NEC management before distribution.

1.6 PHASE IN/PHASE OUT.

1.6.1 PHASE IN. There will be a phase-in period between award and the full performance start date for the Contractor staff, cross-training and familiarization. The phase-in period shall be no longer than 60 calendar days in duration, to commence upon award. The Contractor shall submit a phase-in plan as part of the technical response. The phase-in plan shall include, at a minimum, a schedule for implementation and the following actions:

• Direct observation of tasks performed by current personnel.

• Familiarizing personnel with all requirements and procedures.

• Selecting trained and experienced personnel.

• Meeting all security requirements.

• Conducting 100% joint property inventory with current Contractor for all accountable property currently in possession of the current Contractor.

• Performing required training.

• Obtaining required certifications, licenses, and endorsements.

• An overview of potential phase-in period problems and how the Contractor shall address those potential problems.

1.6.2 PHASE OUT. At least 60 calendar days prior to contract completion, the COR will notify the incumbent Contractor of all outstanding requirements they must complete before the contract ends. The incumbent Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor. The incumbent Contractor shall fully cooperate with the succeeding Contractor and the Government so as not to interfere with their work or duties.

1.7. KEY CONTROL. The Contractor shall establish and implement methods of making sure all keys and simplex access cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include simplex access cards. The Contractor shall appoint a key holder to maintain accountability for all keys in accordance with AR 190-51, Appendix D. The key holder shall coordinate with the NEC-RIA key holder for the assigned keys. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the COR.

1.8. ACCESS TO PROTECTED INFORMATION. Protected information means all non-public information, including but not limited to trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or Personally Identifiable Information (PII), or any other information with distribution limited by the Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized US Government individual. Further, Contractor employees shall use any non-public information for official/authorized Government purposes only, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent.

Accordingly, all Government contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

1.9. SECURITY REQUIREMENTS. This task order will require access to classified and controlled or sensitive information and facilities. All Contractor personnel performing on this task order must be a US citizen with required security clearance or suitability investigation.

Upon task order start date, all Contractor personnel shall possess, obtain, and maintain during the life of the task order the required security clearance over the life of the task order in accordance with DD Form 254, Contract Security Classification Specification. Contractor personnel who require a security clearance for this work effort shall have submitted documentation for a security clearance within two (2) months after task order award and shall maintain the required security clearance throughout employment on this task order. Contractor personnel who require a Top Secret clearance will be required to have a Final Top Secret security clearance based on a current Single Scope Background Investigation (SSBI) or a current SSBI-Periodic Reinvestigation (SSBI-PR). Contractor personnel who require a Secret security clearance and who will be performing IT-I functions will require a Single Scope Background Investigation (SSBI) completed with suitability determination for IT Level I access.

The Contractor shall contact the supporting Government Security Office/G-2/S-2 for submission of the SSBI (SF86) via the Army Investigative Enterprise Solution (AIES). The SF86 will indicate Secret access/IT Level I. The Contractor shall provide the contract/task order number as authority to request the investigation. Contractor interim privileged level access to Army systems prior to completion and favorable adjudication of the required investigation will be in accordance with AR 25-2. If Contractor personnel have a current SSBI on record in JPAS, the AR 25-2 investigative requirement for IT-I is satisfied. Contractor personnel who do not require a security clearance but who require an investigation for suitability/trustworthiness purposes shall have submitted the required investigation documentation within two (2) months after task order award. Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in the PWS and in effect at the work sites. The Contractor shall coordinate with the supporting Government Security Office for submission of required suitability investigations. Security clearance requirements, required personnel security investigation, IT levels, and IAT certification requirements for this task order are reflected in Table 1 below.

1.10. SECURITY TRAINING REQUIREMENTS. All Contractor and sub-contractor employees are required to complete the following training as soon as network access has been granted.

Security In-Process Brief, CUI Briefing, NATO Security Briefing and then sign the following documents and return to the NEC Security Coordinator at usarmy.RIA.106-sig-bde.mbx.nec-ria-security@mail.mil: the NATO Briefing Certification, Privacy Statement, and last page of the Security In-Process Brief. These briefings and documents can be found on the NEC portal at https://it.ria.army.mil/ under Information Assurance/Security Coordinator. Contractors and sub-contractors are also required to take the Initial Security Orientation on the ALMS training website and the Annual Security Refresher Training thereafter. Training is located on the Army Knowledge Online site under Self Service/My Training and then select the ALMS training site.

1.10.1. COMPUTING ENVIRONMENT CERTIFICATION (CE). In addition to the baseline IA certification requirement for their level, IATs with privileged access MUST OBTAIN APPROPRIATE COMPUTING ENVIRONMENT (CE) CERTIFICATIONS for the operating system(s) and/or security related tools/devices they support. This requirement ensures the Contractor can effectively apply IA requirements to the Government’s computer hardware and software systems identified for Operations and Maintenance (O&M) responsibilities as outlined in installation task orders. The Contractor shall be required to release a copy of all certification qualifications to the Department of Defense, as required.

1.10.2. The Contractor personnel performing engineering, system administration, or Network Operations (NetOps) functions with privileged-level access to control, manage, or configure Government information systems shall meet training and certification requirements for the level of performance outlined in duty categories for Information Assurance (IA) Support Personnel as specified by Army Regulation (AR) 25-2, Chapter 3, and Department of Defense (DoD) 8570.01-M. Individuals filling positions identified as Information Assurance Technical (IAT) or Information Assurance Management (IAM) Level I, II, or III (IAT/IAM-I, II or III) must meet training and certification requirements outlined in AR 25-2 and DoD 8570.01-M.

Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged IAW DoD 8570.01-M. All IAT category personnel, whether they perform IA functions as primary or additional/embedded duty, must be certified based on the IA functions of the position and remain current on their certifications in order to continue to have authorized unsupervised privileged access to Government networks. Personnel who are not properly qualified and certified IAW DoD 8570.01-M or who fail to maintain their certification status shall not be permitted privileged access to the Department of Defense Government networks.

Individuals shall complete certification/qualification refresher training every 18-24 months in accordance with AR 25-2.

1.10.3. The DFARS clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract and is subject to the mandates of DOD 8570.01-M which establishes baseline technical and management Information Assurance (IA) skills for personnel performing IA functions within DOD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty. Information Assurance workforce members shall have the certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DOD 8570.01-M at work performance start date. IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. Certification holders shall ensure that their certificates remain active and are renewed prior to expiration. Contractor personnel supporting IA functions in Chapters 3, 4, 10, and 11 shall be appropriately certified prior to starting work on this contract. The Contractor IA Certification holders shall release their certification information to the Department of Defense through the Defense Workforce Certification Application, https://www.dmdc.osd.mil/appj/dwc/index.jsp.

1.10.4. TRAINING RECORDS. The Contractor shall ensure all training records and formal training requirements that require certification are met as outlined in this PWS.

Additionally, the Contractor shall ensure required training is documented within these records and they are available upon request by the KO or COR. Records shall be maintained at the work site. In addition, the Contractor shall ensure a database/system is in place, to which the Government will have access to for periodic review. The KO shall determine what Government personnel will have access.

1.11. TRAINING REQUIREMENT FOR SIPRNet ACCESS. All Contractor and sub-contractor personnel who require access to the SIPRNet will require Derivative Classification Training before access is granted and every two years thereafter. Training is found at http://cdsetrain.dtic.mil/derivative/. A copy of the completion certificate must be provided to the NEC Security Coordinator at usarmy.RIA.106-sig-bde.mbx.nec-ria-security@mail.mil.

1.11.1. Table 1 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M.

Table 1. Information Technology Access and IA Certification Requirements.

1.11.2. NON-GOVERNMENT-OWNED COMPUTING SYSTEMS OR DEVICES. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information Assurance Manager (IAM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives; e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives, removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

Functional Category IT Level

IAW AR

25-2

Security Clearance

Investigation Required

IA Certifi-cation Category and Level (IAW DoD 8570.01-M and BBP

05-PR-M-

0002)

Computing Environment Certifications

Site Management IT-III SECRET NACLC N/A NO

Administrative Support IT-III NONE NACI N/A NO

Planner/Engineer IT-III SECRET NACLC N/A NO

Network Administration IT-I SECRET SSBI IAT-II YES

System Administration IT-I SECRET SSBI IAT-II YES

Database Administration IT-II SECRET NACLC IAT-II YES

Website Administration IT-II SECRET NACLC IAT-II YES

Lead Network Security Administration

IT-I SECRET SSBI IAM-II/IAT-

II

YES

Network Security Administration

IT-I SECRET SSBI IAT-II YES

Computer Support (Hardware/Software)

IT-II SECRET NACLC IAT-II YES

VTC Operation IT-III SECRET NACLC N/A NO

1.11.3. PROTECTION OF SENSITIVE UNCLASSIFIED DATA. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to laptop, netbook, notebook, or tablet computers. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives), floppy disks, and other portable digital storage devices, if authorization to use them is restored. Guidance for protecting DAR information appears in DoD Policy Memorandum, dated 3 July 2007, subject:

Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media and in DoD Component Implementing Instructions.

1.12. ANTITERRORISM.

1.12.1. ANTITERRORISM LEVEL I TRAINING. The Contractor shall ensure that all employees, including sub-contractors, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I Awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after completion of training, the Contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I Awareness training. AT Level I Awareness training is available at https://atlevel1.dtic.mil/at.

1.12.1.1. iWATCH. The Contractor shall ensure that all employees, to include sub-contractors performing work under this contract, are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract with the results reported to the COR NLT 45 calendar days after contract award. The requiring activity Anti- Terrorism Officer will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request. The Contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity Anti-Terrorism Officer).

1.12.1.2. EMERGENCIES AND FORCE PROTECTION CONDITIONS. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, Contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor’s Site Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

1.12.1.3. OPERATIONS SECURITY (OPSEC). The Contractor shall comply with DoD Directive 5205.02, Army Regulation 530-1, and the requiring activity OPSEC program.

Failure to comply with the OPSEC directives shall be deemed adequate cause for the removal of a Contractor employee from performance on this contract and could be considered for appropriate legal action. The Contractor shall ensure all employees, including sub-contractors performing work under this contract, complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

1.13. ACCOUNTING FOR CONTRACTOR SUPPORT. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection where the Contractor shall report all Contractor manpower (including sub-contractor manpower) required for performance of this task order. The Contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil. The required information includes: (1) Contracting Office, Contracting Officer, (2) Contract number, including task or delivery order number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, email address, identity of Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractors; (6) Estimated direct labor dollars paid this reporting period (including sub-Contractors); (7) Total payments (including sub-Contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor, if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (11) Locations where the Contractor and sub-contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a Contractor's systems to the secure web site without the need for separate data entries for each required data element at the web site. The specific formats for the XML direct transfer may be downloaded from the web site. The Contractor shall report all contractor labor hours (including sub-contractor labor hours) required for performance of services provided under this contract for the Army via the eCMRA secure data collection site.

The Contractor is required to completely fill-in all required data fields within the eCMRA.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2016. Contractors may direct questions to the Help Desk at:

http://www.ecmra.mil/.

1.14. CONTRACTOR IDENTIFICATION REQUIREMENTS. In accordance with FAR 37.114(c), all Contractor personnel attending meetings, answering Government telephones are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee’s name, the contractor’s name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees to wear the ID badges visibly when performing work at Government workplaces. Contractor personnel shall also ensure that all emails, documents, or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on emails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

1.15. COMMON ACCESS CARD (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent

(TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://www.dmdc.osd.mil/tass/index.jsp. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the task order.

The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

1.16. PERSONNEL. All employees must be US citizens and be able to read, speak, and write in English. The Contractor shall identify the staffing plan and organization required to meet the objectives and requirements identified in this PWS. The following must be included in the staffing plan:

1.16.1. SITE MANAGER. The Contractor shall have an On-Site Manager who shall be responsible for the performance of all work identified in this PWS. The Contractor shall designate the Site Manager and an alternate Site Manager (who has the same authority as the primary Site Manager) in writing to the KO and the COR prior to the completion of the Phase In period. The Contractor shall ensure that the COR can contact the Site Manager to meet within 30 minutes during normal duty hours at a specific location. After normal duty hours, the Site Manager or designated representative shall be available to meet with Government representatives at the work site (location) specified within two hours of notification. A Site Manager shall immediately report any imminent system failure to the COR or a NEC Manager and provide a recommended operational or repair solution. The Contractor shall follow up the action with a written report (email or memorandum). If, in the Contractor’s judgment substandard conditions exist, the Site Manager shall document the conditions to the COR in writing for review and final disposition. In the event of a safety hazard, the Contractor may request and obtain verbal approval for corrective action from the COR and follow-up with a written report.

1.16.2. QUALITY CONTROL MANAGER (QCM). The Contractor shall designate a full-time QCM. The QCM shall be responsible for the overall management and implementation of the Contractor’s Quality Control Plan and the Customer Satisfaction Surveys. The Contractor shall make full use of the Interactive Customer Evaluation (ICE) Survey System to manage NEC-RIA customer comments, interact with customers, resolve complaints, update comments, and provide reports/metrics.

1.17. IN-PROGRESS REVIEW AND PROGRAM REVIEWS.

1.17.1. MEETINGS. The Contractor shall be required to meet periodically with the COR and KO. Meetings will be scheduled as needed.

1.17.2. IN-PROCESS REVIEWS (IPR). The Contractor shall plan and conduct IPRs every two weeks in collaboration with the COR. The purpose of the IPRs is to present, discuss, and analyze trends in system performance, support center performance, and to conduct forecasting with respect to system upgrades, deployments, projects, and other potential, or planned surge situations. On a quarterly basis, the Contractor shall present a new technology, concept, or change to existing technology in an effort to enhance NEC capabilities or efficiencies. After collaboration with the Government COR, the Contractor shall prepare, distribute and use an agenda for the meeting to ensure that all participants are prepared to address pertinent issues and to serve as a mechanism for ensuring that all issues are addressed by the leadership.

1.18. QUALITY CONTROL. The Contractor shall develop, implement, and maintain an effective Quality Control System which includes a written Quality Control Plan (QCP). The QCP shall implement standardized procedure/methodology for monitoring and documenting contract performance to ensure all contract requirements are met. The Contractors’ QCP must contain a systematic approach to monitor operations to ensure acceptable services/products are provided to the Government. The QCP, as a minimum, shall address continuous process improvement; procedures for scheduling, conducting, and documentation of inspection;

discrepancy identification and correction; corrective action procedures to include procedures for addressing non-conformances; procedures for root cause analysis to prevent re-occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints. One copy of the Contractor’s QCP shall be provided to the Contracting Officer at the time the contract proposal is submitted. After Government acceptance of the QCP, any changes to the plan shall be submitted to the KO for written approval/acceptance.

1.19. CONTRACTOR RESPONSIBILITIES TO COMPLY WITH LAWS AND REGULATIONS:

Contract functions shall be performed in accordance with the most recent versions of applicable regulations, directives, and headquarters guidance. Primary governing regulations are located in Section C-6, Publication and Forms. All services and supplies provided under this requirement must comply with the Clinger-Cohen Act, Section 508 of the Rehabilitation Act of 1973, as amended (29 USC 794d) and must meet the applicable accessibility standards at 36 CFR Part 1194.

1.20. TECHNICAL ASSISTANCE. The Contractor shall provide technical assistance to the Government in support of the Government’s inspection and acceptance of third-party Contractor installation projects that, upon completion of the projects, will become part of the Contractor’s operation and maintenance (O&M) responsibility through incorporation into the contract. This assistance may also include support to technical evaluations, Inspector General (IG) inspections and ISEC-CONUS engineering projects. In all cases, the Contractor shall only provide input and shall not make final decisions on acceptability, compliance, or other decisions that require an exercise of Government discretion. Appropriate Contractor support includes providing familiarization with plant drawings and physical location of equipment, among other things.

1.21. TRANSPORT OF EQUIPMENT. The Contractor shall be responsible for packing/unpacking and moving NEC infrastructure equipment; e.g., UPS, servers, racks, switches, etc. The Contractor shall not be responsible for transporting end-user devices; e.g., laptop, desktop, printers. The Contractor shall use Contractor furnished vehicle in Section C4 to move this equipment.

1.22. REPORTING REQUIREMENTS. See attached CDRL (TE-4). The Contractor shall not be relieved from meeting CDRL requirements if all data required is not available in the Government-furnished service order/trouble ticket system identified in Government Furnished Software (TE-7).

1.23. ORGANIZATIONAL CONFLICT OF INTEREST: Contractor and sub-contractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information; e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc., or perform evaluation services which may create a current or subsequent Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever the Contractor becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor's mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirement which may be affected by the OCI.

1.24. TRAVEL/TRAINING COSTS. The Contractor shall submit all requests for reimbursable travel/training prior to commencing travel or training, to the Government for approval. Travel is not authorized until written Government approval is received. Training is limited to that which is required to facilitate transition to new missions or technologies during contract execution. It does not include training required to support systems and technologies in place at the beginning of the contract, training required due to personnel turnover on this contract, nor does it include personal improvement or skill level improvement training. Travel requests shall include the destination, purpose, duration, number of personnel with rationale for each, and estimated cost. Reimbursements for Government approved travel shall be in accordance with the Joint Travel Regulations (JTR).

1.25. TRAINING. The Contractor shall ensure contractor personnel are properly trained and that they maintain technical proficiency for the Operation and Maintenance (O&M) of the systems and equipment listed in the technical exhibits of this Performance Work Statement.

The Government will not provide or fund training to obtain certification for Contractor employees unless the training is a result of a new requirement. Contractor personnel shall have training and required certifications prior to the start of this contract.

1.24.1. TRAINING FOR NEW REQUIREMENT: If during the term of this contract, the Government has new requirements that require training, the Government will provide one-time training to no more than two (2) personnel during initial fielding. The Contracting Officer’s Representative/Contracting Officer (COR/KO) will approve this training in advance. If an employee who has received Government-provided training as described above should vacate his/her position for any reason, the Contractor shall be responsible for providing personnel to complete the requirements of this contract at no additional cost to the Government.

1.24.2. REMOTE SITE TRAVEL. The Contractor shall travel to support remote/off-site locations when all troubleshooting options have been exhausted; e.g., the designated personnel at site are unable to correct and all remote capabilities have been utilized. Reimbursements for Government approved travel shall be in accordance with the Joint Travel Regulations (JTR).

Travel must be authorized by the Government after verifying all troubleshooting techniques have been applied and travel funds are available. The Contractor shall provide an after action report to the Government upon return from travel.

1.25. CONTRACTOR RESPONSIBILITY TO OBTAIN MATERIALS AND SUPPLIES IN A

TIMELY MANNER. It is the Contractor’s responsibility to procure supplies, materials, and parts so that they are available to meet performance requirements. The Contractor shall not be relieved of performance requirement due to lack of supplies, materials, or parts. In the event of delays beyond the Contractor’s control, a written request must be submitted to the Government for review and approval. The Contractor shall submit all requests for supplies, tools, and material purchases to the Government for approval prior to purchase. Approved supplies, tools, and materials shall be reimbursed at cost plus the handling fee established by the contract. No payment is guaranteed without the Government’s prior approval.

1.26. RECORDS MANAGEMENT PLAN. The Contractor shall provide a record management plan to the COR within 60 days of the award of the contract. This record management plan should address how all records generated in support of this contract will be created and maintained for the life of the contract. All Contractor records pertaining to this contract shall be turned over to the Government at the end of the contract.

1.27. DATA RIGHTS. The Government owns all documents/material produced under this contract and the Contractor shall provide access to these materials upon request. All documents and materials, to include the source codes of any software produced and data structures under this contract, shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

SECTION C2

DEFINITIONS & ACRONYMS

2.1. DEFINITIONS:

2.1.1. ABOVE BASELINE AND/OR MISSION SERVICES: Services provided by the NEC at a higher standard. The customer funds above baseline and/or mission services.

2.1.2. BASELINE SERVICES. Services provided by the NEC at no cost to the customer and are defined in Section C5.2 through C5.4 in this PWS.

2.1.3. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.4. CONTRACTING OFFICER. A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the Government.

Note: The only individual who can legally bind the Government.

2.1.5. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the US Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.6. CRITICAL PATH ANALYSIS: Refers to the way a project must be analyzed by defining those activities that must be completed, and completed in a specific order, so that the project can be completed successfully and on time.

2.1.7. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.8. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.9. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.10. PROJECT MANAGEMENT. The application of knowledge, skills, tools, and techniques to project activities to meet the project requirements.

2.1.11. QUALITY ASSURANCE. The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.12. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.13. QUALITY CONTROL. All necessary measures taken by the Contractor to assure the quality of an end product or service shall meet contract requirements.

2.1.14. SUB-CONTRACTOR. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the sub-contractor.

2.1.15. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.16. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

2RCC Second Regional Cyber Center ACC-RI Army Contract Command-Rock Island ACL Access Control Lists AD Active Directory ADP Automatic Data Processing ADPE Automatic Data Processing Equipment AESD Army Enterprise Service Desk AIES Army Investigative Enterprise Solution AGM Army Gold Master AKO Army Knowledge On-Line ALARACT All Army Activities ALMS Army Learning Management System AOR Area of Responsibility AP Army Pamphlet AQL Acceptable Quality Level AR Army Regulation ARCYBER US Army Cyber Command ARNET Army Reserve Network ASC Army Sustainment Command AT Antiterrorism ATCTS Army Training Certification Tracking System ATO Anti-Terrorism Officer ATS Administrative Telephone Services AV Anti-Virus BBPs Best Business Practices BDC Backup Domain Controllers C4IM Command, Control, Communications, Computers and Information Management

C&A Certification and Approval CAC Common Access Card

CAN Campus Area Network CCB Configuration Control Board CCIR Commander Critical Information Requirements CCL Cryptographic Logon CD Compact Discs CDRL Contract Data Requirements List CE Computing Environment CERT Computer Emergency Response Team CFR Code of Federal Regulations CIO Chief Information Officer COMSEC Communications Security CoN Certification of Networthiness COOP Continuity of Operations Plan COR Contracting Officer’s Representative COTS Commercial Off-The-Shelf CR Change Request CUI Controlled Unclassified Information DA Department of the Army DAR Data-At-Rest DD Department of Defense DD Form 254 Department of Defense Contract Security Classification Specification DFARS Defense Federal Acquisition Regulation Supplement DHCP Dynamic Host Configurations Protocol DIACAP DoD Information Assurance Certification and Accreditation Process DISA Defense Information Systems Agency DMZ Demilitarized Zone DNS Domain Name Server DoD Department of Defense DODI Department of Defense Instruction DRP Disaster Recovery Plan DSN Defense Switched Network DVD Digital Video Discs eCMRA Electronic Contracting Manpower Reporting Application ESA Enterprise Service Agreement FAR Federal Acquisition Regulations FOUO For Official Use Only FPCON Force Protection Conditions FSC Federal Service Code FSO Facility Security Officer FY Fiscal Year GFE Government Furnished Equipment GFS Government Furnished Software GOTS Government Off-The-Shelf GUARDNET Army National Guard Network

HBSS Host Based Security Systems HIPS High Integrity Protection System HQ Headquarters IA Information Assurance IAAAP Iowa Army Ammunition Plant IAM Information Assurance Manager IAT Information Assurance Technical IAVA Information Assurance Vulnerability Alert IAVM Information Assurance Vulnerability Management IAW In accordance with ICAN Installation Campus Area Network ICE Interactive Customer Evaluation ID Identification IEEE Institute of Electrical and Electronics Engineers IG Inspector General I-SCSI Internet Small Computer System Interface INFOSEC Information Security IP Internet Protocol IPR In-Process Reviews ISEC-CONUS US Army Information Systems Command - Continental United States IT Information Technology ITSM Information Technology Service Management (Army’s Enterprise Remedy System) JMC Joint Munitions Command JPAS Joint Personnel Adjudication System JTR Joint Travel Regulations KO Contracting Officer LAN Local Area Network LCAAP Lake City Army Ammunition Plant LCR Life Cycle Replacement LWN LandWarNet MAC Mission Assurance Category MAP Mitigation Action Plan MCA Military Construction Army MCD Mobile Computing Devices MFD Multi-Function Device MP3 Moving Picture Experts Group Layer-3 Audio (audio file format/extension) NACI National Agency Check with Inquiries NACLC National Agency Check with Local Agency and Credit Check NATO North Atlantic Treaty Organization NEC Network Enterprise Center NEC-RIA Network Enterprise Center-Rock Island Arsenal NETCOM Network Enterprise Technology Command NetOps Network Operations NIPRNet Non-Secure Internet Protocol Router Network

NLT No Later Than NSA National Security Agency O&M Operation and Maintenance OCI Organizational Conflict of Interest OCPA Office of the Chief Public Affairs OPLAN Operations Planning OPSEC Operations Security OU Organizational Unit PAM Pamphlet PC Personal Computer PDA Personal Digital Assistant PDC Primary Domain Controllers PII Personably Identifiable Information PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PRS Performance Requirements Summary PSTN Public Switched Telephone Network PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan QCM Quality Control Manager RAR Rapid Action Revision RCERT Regional Computer Emergency Response Team RIA Rock Island Arsenal RMF Risk Management Framework SAEDA Subversion and Espionage Directed Against the U.S.