(Draft) PWS IT Services.pdf

PERFORMANCE WORK STATEMENT (PWS)

Information Management (IM)/Information Technology (IT) Support Services

Madigan Army Medical Center

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal service contract to provide information management (IM)/information technology (IT) support services at Madigan Army Medical Center (MAMC) at Joint Base Lewis-McChord (JBLM), Washington (WA). The government shall not exercise any supervision or control over the contract service providers (CSPs) performing the services herein. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, supervision, and non-personal services necessary to perform information management (IM)/information technology (IT) support services as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2. Background: MAMC is a 196-bed Health Readiness Platform (HRP) and the central facility of a comprehensive health care network, with satellite HRPs throughout JBLM, including Okubo Clinic, McChord Field Clinic, Winder Clinic, and Madigan Annex, 4 Soldier Centered Medical Homes, and 3 Embedded Behavioral Health Clinics. Additional HRPs are 2 Community Based Medical Homes located in Puyallup, WA, Olympia, WA, and any future HRPs that open up in the local Puget Sound area. Additional locations may be added without modification to this contract upon expansion or change of MAMC facilities.

1.3 Objectives: To provide day-to-day support in the following technical areas:

a. Project Management Support

b. Help Desk Support

c. Information Assurance Support

d. Network Administration and Operations Support

e. Systems Administration Support

f. Voice Communications Support

1.4. Scope: The contractor shall provide IM/IT Services to MAMC and its ancillary clinics within the South Puget area. Work shall be performed at MAMC or any of its outlying clinics. Services include, help desk operations, information assurance support, network administration, web development, Tier I and Tier II customer service support, network monitoring tasks and voice/video and data networks. Services also include, technical installations, operations, troubleshooting, and maintenance of hardware and software components supporting and defending the MAMC Local Area Network (LAN), and by extension, the Department of Defense (DoD) Non-secure Internet Protocol Network (NIPRNET) from unauthorized or inadvertent modification, disclosure, destruction, denial of service, and use in accordance with (IAW) Department of Defense and components regulatory guidance.

1.5. GENERAL INFORMATION: The contractor shall fully comply with the most recent and current federal, state, and local laws and regulations, JBLM and MAMC directives and instructions, and other documents set forth in Section 6.

1.5.1 Quality Control: The contractor shall establish and maintain the quality of products and services with a Quality Control Plan (QCP) to ensure that the work performed under this award conforms to the PWS requirements. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP must be forwarded within 14 calendar days after award as an electronic copy to the KO and the COR. The QCP is to be delivered as electronic copy to the Contracting Officer (KO) and COR within five (5) business days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.5.1.1. At a minimum, the QCP shall address:

1.5.1.1.1. A process for preventing, identifying, and resolving conflicts of interest and appearances of impropriety in the performance of this PWS, IAW the Standards of Ethical Conduct for Employees of the Executive Branch (5 CFR Part 2635).

1.5.1.1.2. A description of the contractor’s Quality Control (QC) system. The system shall cover all services and specify work to be inspected on a scheduled or unscheduled basis, position(s) and qualifications for personnel performing the QC inspections, and the extent of their authorities.

• Provisions for recording the results of inspections and for recording corrective action taken.

1.51.1.1.3. A plan for scheduled performance evaluation meetings that include performance indicator trends.

1.5.1.1.4. Provisions to update and revise the QCP during the performance of the award.

1.5.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). The Government reserves the right to choose the inspection methods to implement the QASP and to vary the inspection methods utilized during the work, without notice to the contractor.

1.5.3. Recognized Holidays: Holidays to be observed are as follows: The contractor is not required to perform services on Federal holidays.

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

1.5.4. Hours of Operation: The contractor is responsible for conducting business, between the hours of 6 am and 6 pm Monday through Friday, excluding Federal holidays with occasional work done outside of these hours for scheduled or unscheduled maintenance and emergencies that require contractor support. No additional payment will be made by the Government for such emergency or scheduled or unscheduled maintenance work performed outside normal duty hours or by a contractor employee in excess of 40 hours per week. Examples of an emergency or scheduled or unscheduled maintenance include but are not limited to: scheduled and unscheduled information system maintenance, server failures or malfunctions, scheduled and unscheduled network maintenance, network equipment failures or malfunctions, scheduled or unscheduled application maintenance including failures or malfunctions, security patches, automated software distribution or upgrades, computer replacements and deployments or automation equipment exchanges as part of lifecycle support. Time start and end will normally be for an eight-hour day, but start and end times may be adjusted to ensure coverage is provided during clinical business hours. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.5.4.1. Performance of Services for Contingencies and Emergencies to Include National Emergencies. 24/7 operations may be required on short notice. In such cases the contractor shall revise operating hours accordingly. The Government will coordinate with the Site Manager (SM) within 48 hours on any workload adjustments when feasible. Upon notification by the KO, in cases of national emergency, the contractor shall provide additional services necessary or appropriate to the resulting increase in operating tempo, up to and including declared war. These services shall be provided 24 hours per day, 365 days a year for the duration of the emergency. The KO will modify the contract for national emergency services.

1.5.4.2. Based on the severity and nature of the emergency affecting post operations, there may be a need to curtail MAMC operations (i.e., release personnel or not allow personnel on post). The decision to curtail operations is made by the MAMC Commander or higher and will be relayed to the contractor by the Critical Event Management notification system, the COR to contractors site manager or by the KO.

1.5.5. Place of Performance: The work to be performed by onsite personnel under this contract will be performed at the following locations:

a. MAMC, JBLM, WA

b. Madigan Annex, JBLM, WA

c. Madigan Information Management Division, Warehouse, Building 9665, JBLM, WA

d. MAMC extended campuses (Okubo Clinic, McChord Field Clinic, Winder Clinic, Madigan Annex, 4 Soldier Centered Medical Homes, 3 Embedded Behavioral Health Clinics, 2 Community Based Medical Homes located in Puyallup, WA, Olympia, WA, and any future HRPs that open up in the local Puget Sound area as needed.

1.5.6 Security Requirements:

1.5.6.1. Access and general protection/security policy and procedures. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.5.6.2. The contractor is not required to handle or access classified equipment or information. The contractor personnel do not require a security clearance but will be performing privileged-level Information Assurance (IA) tasks, as defined by DoD 8570.01-M. Personnel must first pass a background investigation appropriate for Automated Data Processing Category for the task, as defined in AR 380–67, Paragraph 3-2. or controlling DoD regulation. The Government (MAMC Security Manager) will perform these background investigations and MAMC Provost Marshal Office (PMO), issue CACs, and MAMC Badge as warranted, to perform the work. All contractor employees shall sign a Computer User Agreement Acceptable Use Policy (AUP) and Non-disclosure Agreement (NDA) prior to being given access to a Government computer or the local network.

1.5.7. Common Access Card (CAC):

1.5.7.1. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

1.5.7.2. The contractor shall ensure that all users on the Local Area Network (LAN) have obtained a CAC and have the appropriate Army Knowledge Online (AKO) account required for the issuance of personal digital security certificates. The Government person whose operations are supported by the contracted services will provide sponsorship for the AKO account and provide for access to the Contractor Verification System (CVS) for the issuance of a CAC.

1.5.7.1. Contractor will return all issued U.S. Government CACs, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility.

1.5.8. Information Security: The contractor shall ensure any sensitive information including, but not limited to, Protected Health Information (PHI), Personally Identifiable Information (PII), For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on desktop computers, Mobile Computing Devices (MCD) or other external media is protected IAW current Data at Rest (DAR) guidelines and requirements using an authorized, approved and prescribed DAR solution. MCDs include, but are not limited to, laptop, Netbook, notebook, or tablet computers; and Blackberry or equivalent devices. Use of removable media will comply with current DoD and U.S. Army guidance.

1.5.8.1. Provide physical security for all material, equipment, data, and information handled during order performance, in accordance with DoD property. Reference DoD 5200.08-R (Physical Security Program), and command policies, procedures, and regulations.

1.5.8.2. Perform operations on, have access to, or handle data and information that contain unclassified, sensitive, proprietary, or Privacy Act information or data.

1.5.8.3. Access To Protected Information: The contractor shall comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS) and the published DHA implementation directions. This includes the Standards for Electronic Transactions, the Standards for Privacy of Individually Identifiable Health Information and the Security Standards. It is expected that the contractor shall comply with all HIPAA-related rules and regulations as they are published and as DHA requirements are defined (including identifiers for providers, employers, health plans, and individuals, and standards for claims attachment transactions). Contractor shall comply with the Privacy Act requirements.

1.5.8.4. Disclosure of Protected Information: If, during the performance of this PWS, contractor personnel obtain access by any means to protected information, including, but not limited to, trade secrets or proprietary information of other contractors, Government source selection information, Privacy Act, and Health Insurance Portability and Accountability Act (HIPAA) information, or any other information with distribution limited by the Government, contractor personnel shall in no way divulge any such information except as it relates to the performance of this procurement or shall not otherwise use or disclose this information for their personnel gain, the gain of their employer, or the gain of anyone else. Accordingly, all Government contractors are required to mark their proprietary information and any time the contractor is given access to such marked information it is incumbent upon the contractor to inform the KO of the access.

Contractor personnel will be required to sign a non-disclosure agreement (NDA) before starting work under the TO. Failure to comply with this paragraph shall be deemed adequate cause for the removal of a contractor employee from performance on this contract. All documents (hard copy or electronic) produced for MAMC shall be considered proprietary technical data and shall be appropriately protected. Access and use of the Agency LAN and related systems also shall be considered business sensitive and appropriately protected.

Neither the contractor nor its employees shall disclose, or cause to be disclosed, any information, the release of which could result in, or increase the likelihood of, a breach of security or adversely affect the continuity of MAMC operations. The contractor shall brief all of its employees on the handling of proprietary technical data. The contractor shall be responsible and liable for all unauthorized disclosures of, or loss of control over, sensitive unclassified and protected information, regardless of the likelihood of compromise or the degree of harm to national security. The contractor shall refer outside requests for information to the COR.

1.5.8.5. Physical Security: The contractor shall follow the Government’s key control plan that designates authorized personnel key access to buildings and facilities. The purpose of physical security is to prevent unauthorized entries, theft of Government property, or accidental exposures to toxic chemicals. Keys shall be surrendered whenever personnel leave the contractors employment or at the end of the final performance period. The contractor shall reimburse the Government’s costs incurred such as lock replacement and additional keys due to the contractor’s loss of government key(s).

1.5.9. Post Award Conference/Periodic Progress/Monthly Meetings: The contractor key personnel (site manager(s)) shall attend meetings as necessary with the COR for the first month of the performance period.

Thereafter, weekly meetings shall be held, as scheduled by the Government, and meetings will also be held whenever Contractor Discrepancy Reports (CDR) are issued. Written documentation of all performance evaluation meetings, written by the Government, shall be signed by the contractor and the Government, and will be included in the award file.

1.5.10. Contracting Officer’s Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor’s performance and notify both the Contracting Officer and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.5.11. Key Personnel: The contractor shall provide a site manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The site manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The site manager or alternate shall be available between 8:00 a.m. to 4:30 p.m. (Pacific Time), Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for key personnel are listed below:

1.5.11.1. Project Management Support – Requires person(s) with proven project management experience in a broad, multi-organizational environment. Personnel will have CompTIA Project+ or PMI’s Project Management Professional certification.

1.5.12. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The MAMC PMO will issue MAMC photo identification badges that identify their contractor employment status to contractor employees at Government expense, which shall be worn on the upper portion of the outermost garment. The contractor shall return the MAMC identification badges to the designated area at the end of employment, performance period or TO completion, whichever is sooner.

1.5.13. DATA RIGHTS: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.5.14. ORGANIZATIONAL CONFLICT OF INTEREST: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. However, a nondisclosure agreement will not overcome an OCI. Moreover, compliance with the Trade Secrets Act requires the consent of the owner of the proprietary information before another non-federal entity may be allowed access to such information. The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.15. Health and Safety:

1.5.15.1. Accident Prevention:

(a) The contractor shall provide and maintain work environments and procedures which shall—

(1) Safeguard the public and Government personnel, property, materials, supplies, and equipment exposed to contractor operations and activities;

(2) Avoid interruptions of Government operations and delays in project completion dates; and

(3) Control costs in the performance of this contract.

1.5.15.2. Accident Reporting: The contractor shall report to the COR, without delay, any accident involving work-related injury, illness, or disease; motor vehicle accidents or nonvehicle property damage accidents shall also be reported. The contractor shall utilize ACCIDENT/INCIDENT REPORT, MAMC FORM 511- SA to report accidents to the MAMC Safety Office. The contractor shall report any accident under this contract to the MAMC Safety Office within 24 hours of the accident and provide a report copy to the COR at the same time.

1.5.15.3. Control of Mishap Scene: The contractor shall establish control over the scene of an accident or mishap, both to prevent further injury to persons or damage to property, and to preserve evidence, until otherwise directed by a duly appointed investigating officer. The contractor shall cooperate fully with and assist Government personnel to conduct accident and mishap investigations arising from any work or other activity performed under or related to this contract.

1.5.15.4. Medical Services:

1.5.15.4.1. Non-Emergent Services: The contractor shall have competent personnel trained and capable of dealing with minor personnel injuries or arrange for care at a civilian medical facility. The contractor shall have its employees immediately notify their contractor supervisor of any accident requiring medical treatment. The contractor supervisor will, in turn, notify the KO or COR within 30 minutes of the incident.

1.5.15.4.2. Emergent Services: Medical services for contractor personnel are the responsibility of the contractor. However, the Government will provide emergent medical services for job related injuries and life-threatening illnesses on an emergent basis only while an employee is performing under the contract.

Such emergent medical service will be limited to those services necessary to prevent undue suffering or loss of life and will be provided only during the period of the emergency. In such circumstances, action shall be taken to transfer contractor employees to a civilian health care provider as soon as medically feasible. The contractor shall reimburse the Government for emergent medical services provided upon receipt of an invoice(s) from MAMC or other Government agency. The Government MTF’s are located at MAMC.

1.5. 16. CONTRACTOR MANPOWER REPORTING (CMR): The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor is required to completely fill in all the information in the format using the following web address https://www.ecmra.mil

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1 DEFINITIONS:

2.1.1. Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. Contracting Officer: A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. Contracting Officer’s Representative (COR): An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. Defective Service: A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. Deliverable: Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. Key Personnel: Identifies contractor filled positions that are considered essential to the work being performed hereunder. Key personnel clause may be enforced to ensure contract’s success.

2.1.7. Physical Security: Actions that prevent the loss or damage of Government property.

2.1.8. Quality Assurance: The government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

2.1.9. Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. Quality Control: All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. Work Day: The number of hours per day the contractor provides services in accordance with the contract.

2.1.13. Work Week: Monday through Friday, unless specified otherwise.

2.2. Acronyms:

ADP Automated Data Processing Category (for background investigations requirements) AKO Army Knowledge Online AR Army Regulation ASA Adaptive Security Appliances AT Antiterrorism Training ATCTS Army Training Certification Tracking System ATO Antiterrorism Officer AUP Acceptable Use Policy MAMC Form 1785-A BAA Business Associate Agreement CAC Common Access Card CANs Campus Area Networks CCNA Cisco Certified Network Associate CCNP Cisco Certified Network Professional CDR Contractor Discrepancy Report CE Computing Environment CFR Code of Federal Regulations CMR Contractor Manpower Reporting CoN Certificate of Networthiness COR Contracting Officer’s Representative CVS Contractor Verification System DA Department of the Army DAR Data at Rest DAT Data file extension DEERS Defense Eligibility Enrollment System DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DHCP Dynamic Host Configuration Protocol DIACAP DOD Information Assurance Certification and Accreditation Process (replaced by RMF) DoD Department of Defense FAR Federal Acquisition Regulation FOUO For Official Use Only HIPAA Health Insurance Portability and Accountability Act of 1996 HRP Health Readiness Platform (formerly MTF) IA Information Assurance (replaced by cybersecurity) IAT Information Assurance Technical level IM Information Management IMD Information Management Division IP Internet Protocol IS Information Systems IT Information Technology JBLM Joint Base Lewis-McChord KO Contracting Officer LAN Local Area Network MAC Media Access Control MAMC Madigan Army Medical Center MCD Mobile Computing Device MED-COI Medical Community of Interest network MEDCOM US Army Medical Command MTF Medical Treatment Facility (replaced by HRP)

N/A Not Applicable NDA Non-disclosure Agreement NIPRNET Non-secure Internet Protocol Router Network NLT Not Later Than OCI Organizational Conflict of Interest OPSEC Operations Security OS Operating System PBX Private Branch Exchange PHI Protected Health Information PII Personally Identifiable Information POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RMF Risk Management Framework (Replaces DIACAP) SAN Storage Area Network TARP Threat Awareness Reporting Program TE Technical Exhibit TO Task Order VOIP Voice Over Internet Protocol WA Washington WAN Wide Area Network WIFI Wireless Fidelity network XML Extensible Markup Language

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Facilities: The Government shall provide all facilities and will provide or arrange for office space necessary to carry out the requirements listed in the PWS. This includes desk, computers, network access, telephone, and office supplies necessary to maintain an office environment.

3.2. Utilities: The Government will provide all utilities within federal facilities. These utilities will be available for the Contractor’s use in performance of tasks outlined in this PWS. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after use.

3.3. Equipment:

3.3.1. For contractors located at government sites, the government will provide access to scanners, fax machines, and printers.

3.3.2. For contractors located at government sites, the government will hand receipt Government Furnished Equipment to contractors used to perform their job tasks. Items that must be signed for by the contractor include equipment control numbered (ECN) but not all inclusive; such as computers, cellphones, job specific devices and tools.

3.4. Materials: The Government shall provide all furniture, forms, and regulatory materials to support training and set-up required for commencement of operations. The Government shall provide all official forms and envelopes. All other expendable supplies will be provided by the contractor. All official mail sent from transition sites will be processed for postage metering and certified/registered mail at Government expense. The Government shall provide all required office machines other than fax and photocopy machines.

The Government shall provide Information Management Office support. The Government shall not be responsible for contractor owned property.

3.5 MAMC Security Badge: The MAMC PMO will issue MAMC photo identification badges that identify their contractor employment status at the Government expense, which shall be worn on the upper portion of the outermost garment at all times while within the MAMC facility. The contractor shall return the MAMC identification badges to the designated area at the end of employment, performance period or TO completion, whichever is sooner.

3.5.1. MAMC Security Badge: Upon award, the contractor shall complete MAMC security badge requirements for all employees who will perform work under this PWS. Contractor employees are required to wear these badges at all times while in MAMC or satellite facility. MAMC security badge shall be prominently displayed on the upper portion of the outermost garment.

3.6. Government Training

3.6.1. Local Mandatory Training:

3.6.1.1 iWATCH Training: The requiring activity Antiterrorism Officer (ATO) will provide iWATCH training for contractor employees with an area of performance within an Army controlled installation, facility or area. MAMC shall brief all employees on the local iWATCH program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the ATO. This training shall be completed within 30 calendar days of start date and within 30 calendar days of new employees commencing performance with the results reported to the COR not later than (NLT) 35 calendar days after contract start.

3.6.1.2. Antiterrorism (AT) Awareness Training (Annually). The Government will provide AT level I awareness training is available at the following website: http://jko.jten.mil. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR within 30 calendar days after completion of training by all employees and subcontractor personnel.

All contractor employees must complete AT awareness training annually.

3.6.1.2.1. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated sub-contractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

3.6.1.3. MAMC IMD Operations Security (OPSEC) (Annually). The Government will provide OPSEC training. In accordance with AR 530-1, OPSEC, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete OPSEC awareness training annually.

3.6.1.4. Cyber Awareness Training (Annually). The Government will provide online Cyber Awareness Training. All users (military, civilian, and contractor personnel) who use government computers shall accomplish this training prior to commencement of services and then annually thereafter in accordance with DoD 8570.01-M.

3.6.1.5. Threat Awareness Reporting Program (TARP). The Government will provide TARP training. All contractor employees must complete TARP training annually in accordance with AR 381-12 Threat Awareness and Reporting Program.

3.6.1.6. Army Training Certification Tracking System (ATCTS). Contractor employees are required to establish and maintain an ATCTS account while employed by this contract."

3.6.1.7. Other General User or General Employee Training. The Government will provide other local MAMC mandated training.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS ANDRESPONSIBILITIES:

4.1. General: The contractor shall furnish all services, equipment and materials required to perform work under this contract that are not directly and expressly provided by the government under Section 3 of this

PWS.

4.2. Security Clearances/Facility Access Requirements: The contractor shall possess and maintain all necessary clearances background investigation and access requirements as outlined in Section 1.5.6 of this

PWS.

4.3. Materials: The contractor shall furnish all materials required to perform work under this contract that are not directly and expressly provided by the government under Section 3 of this PWS.

4.4. Equipment: The contractor shall furnish all equipment required to perform work under this contract that are not directly and expressly provided by the government under Section 3 of this PWS.

4.5. Site Visit: Site Manager shall provide COR not less than 14 days notification and purpose of contractor personnel visiting the MAMC Campus and remote sites.

4.6. Meetings: Contractor management personnel shall inform the COR of scheduled meetings with MAMC personnel.

4.7. Personnel Qualifications

4.7.1.1. Project Management Support – Proven project management experience in abroad, multi-organizational environment. Personnel will have CompTIA Project+ or PMI’s Project Management Professional certification. Project Manager Level-III: Minimum of 5 years’ experience in IM/IT clinical environment with impact to clinical systems.

4.7.1.2. Project Management Support – Proven project management experience in abroad, multi-organizational environment. Personnel will have CompTIA Project+ or PMI’s Project Management Professional certification. Project Manager Level-II: Minimum of 3 years’ experience in IM/IT clinical environment with impact to clinical systems.

4.7.2. Customer Service/Help Desk Support - Helpdesk Technician (Tier 2) – Provide required personnel to image, support, maintain, configure and sustain the desktop computing environment at MAMC. Required minimum certifications include A+ or a Microsoft Operating System certification and Security+ to meet Information Assurance Technician (IAT-I) requirements. These positions are designated by AR 380–67, Paragraph 3-2., as Automated Data Processing Category II (ADP-II).

4.7.3. Network Administration and Operations Support - Provide personnel to support, maintain, configure and sustain the WAN, LAN and WIFI environment at MAMC. Personnel must meet DoD 85700.01-M Information Assurance Technical Level II (IAT-II) requirements. However, preferred certifications are Security+ CE, and computing environment: CCNA Security or equivalent vendor certification. Positions are designated by AR 380–67, Paragraph 3-2., as Automated Data Processing Category I (ADP-I). Contractor personnel shall have an understanding of advanced routing and switching concepts, wireless capabilities, experience with Cisco and Brocade routers and switches in a virtualized environment and remote locations. Experience managing switch technology as it related to storage area network (SAN) devices. Experience managing and troubleshooting advanced wireless access points (AP) and wireless LAN controllers (WLANS).

4.7.4. Systems Administration Support - Provide personnel to support, maintain, configure and sustain the server and storage environment at MAMC. Personnel must meet DoD 85700.01-M Information Assurance Technical Level II (IAT-II) requirements. However, preferred certifications are Security+ CE, and computing environment: Microsoft Server Administration certifications. These positions are designated by AR 380–67, Paragraph 3-2., as Automated Data Processing Category II (ADP-II). Systems Administrators shall have experience with storage area network (SAN) and VMware environments. Operational experience with maintaining a Windows Server 2008R2 and 2012R2 or later environment.

4.7.5. Information Assurance Support – Provide required personnel to support migration to Risk Management Framework (RMF). Incumbents are required to maintain IAM-II 85700.01-M Information Assurance Management II (IAM-II) requirements.

4.7.6. Voice Communications Support – Provide personnel to provide moves, add & changes to the MAMC telephony systems. In depth knowledge of Private Branch Exchange (PBX) systems, ACD, VOIP, and physical cable plants. The contractor employee will be proficient installing systems components such as, data network cables and jacks, backboards, wiring, fiber optic patch cables and copper cabling, switches, connectors, terminals, protectors, buzzers and bells, install connectors, polishes, checks for loss and tests fiber optic circuits and utilizing standard test equipment to troubleshoot connectivity problems. This position is designated by AR 380–67, Paragraph 3-2., as Automated Data Processing Category II (ADP-II).

4.8. Required Certifications: All contractor employees supporting IA/IT functions shall be certified upon contract award IAW DoD 8570.01-M, Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001 and AR 25-2. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award. Additionally, requiring activity (RA) requires contractor employees have “Computer Environment” certification(s) to be engaged under this PWS. Also, completion of the Cyber Security Fundamentals (formerly known as Information Assurance Fundamentals) hosted at the Fort Gordon website is required for elevated privileges and job retention.

4.9. New Certifications: The contractor shall obtain commercial and organizational specific certifications and authorizations for new or modified systems, applications, designs, equipment or installations in accordance with applicable organization standards.

PART 5.

SPECIFICTASKS

5. SPECIFIC TASKS:

5.1.. The contractor shall provide IM/IT Services consisting of Project Management Support, Help Desk Support, Network Administration and Operations Support, Systems Administration Support, Information Assurance Support, and Voice Communications Support.

5.1.1.1. Project Management Support. Project Manager Level-III and Project Manager Level-II shall assist in all areas of IM/IT Program and Project Management. This includes all related projects and associated work efforts – individual project schedules, milestones, deliverables and related requirements. The contractor shall be required to provide Deputy Chief Information officer, MAMC weekly updates on each of the assigned activities, build project plans utilizing the Program Management Book of Knowledge (PMBOK) and Information Technology Infrastructure Library (ITIL) methodologies, report on milestones as appropriate, report whether resources are being allocated correctly, complete risk assessments and work forecasts, and ensure all tasks and deliverables are being met. The contractor shall be required to manage, coordinate, facilitate, oversee, and track initiatives and projects with varying timelines and scopes using PM techniques for risk assessment and abatement and Program Knowledge Management (PKM). The contractor shall provide recommendations for software and/or hardware based on technical requirements. The contractor will provide updated documentation through Standard Operating Procedures which will be approved by the designated government representative.

5.1.2 Help Desk Support

The contractor shall provide Tier I and Tier II helpdesk services. Contractor will be required to provide helpdesk support both locally and remotely. The contractor shall provide updated documentation through a system of record and review documentation as required to maintain accuracy. Contractor shall image, support, maintain, troubleshoot and manage Microsoft desktop environments in a complex MAMC infrastructure. All work shall be fully documented in incidents to included, root cause analysis and resolution implemented. The contractor shall provide installation technical support in troubleshooting and correcting problems associated with unclassified networks and computers. The contractor shall provide installation and technical support to peripherals connected to the MAMC network, to include, mobile devices and printers. This task shall be performed as a group effort allowing the contractor to ensure the overall Government objectives are met each reporting period. The contractor shall resolve helpdesk incidents and tasks within 7 calendar days. Each contractor shall resolve no less than 50 helpdesk incidents and tasks per month. New contractors shall have 90 days to meet standards. No less than 300 resolved incidents and tasks per month for group.

5.1.3. Network Administration and Operations Support

5.1.3.1 The contractor shall maintain, troubleshoot and analyze Cisco and Brocade equipment at MAMC to include analyze, design, support and implement, virtualization architecture as it applies to the MAMC infrastructure and computing environment. The contractor shall analyze network architecture for feasibility, scalability, thoroughness, security, reliability and maintainability; and provide results of analysis to MAMC Chief Networking Branch or designated representative. The contractor shall develop and execute strategies for fielding, implementation, integration and migration. This includes: creating cost estimates or equipment build of materials, documenting maintenance plans and inventories, performing cable infrastructure inspection, cleaning and maintenance, install, and ground equipment in the communications room, coordinating equipment lifecycle and disposal, test fiber optical and category cabling for acceptable levels IAW ANSI/TIA-568 and best business practices (BPP), technical & schedule risks and analysis of alternatives.

5.1.3.2. The contractor shall attend weekly Peer Reviews and technical meetings to provide status updates for projects and customer’s work order requests to Chief, Networking and Communications, MAMC.

5.1.3.3 The contractor shall provide equipment and architecture expertise to assist MAMC in answering functional and technical questions related to requirements, design and maintenance of network architecture both physical and logical and how it functions and relates to a virtualized environment.

5.1.3.4. The contractor must ensure the Campus Area Network is available 99%

5.1.4. Systems Administration Support

5.1.4.1. The contractor shall provide personnel with server and storage area networks (SANS) proficiency to MAMC to analyze, design, support and implement, virtualization architecture as it applies to the MAMC infrastructure and computing environment.

5.1.4.2. The contractor shall analyze virtualization architecture for feasibility, thoroughness, security, reliability and maintainability; and provide results of analysis to Chief, Systems, MAMC.

5.1.4.3. The contractor shall develop and execute strategies for fielding, implementation, integration and migration efforts supporting the MAMC enclave, to include: cost estimates, technical and schedule risks, and analysis of alternatives.

5.1.4.4. The contractor shall attend weekly Peer Reviews and status update meetings. The contractor shall provide equipment and architecture expertise to assist MAMC in answering specific functional and technical questions related to requirements, design and maintenance of physical and virtualized environment.

5.1.4.5. No more than 2 open incidents per contractor with no status update within the last 7 calendar days and no less than 80 incidents per month per contractor.

5.1.5. Information Assurance Support

5.1.5.1. The contractor shall provide personnel with capability to MAMC to support the installation of new or modified hardware, operating systems, and software applications ensuring integration with cybersecurity (formerly IA security) requirements for the enclave.

5.1.5.2. Direct and/or implement operational structures and processes to ensure an effective enclave cybersecurity (formerly IA security) program including boundary defense, incident detection and response, and key management.

5.1.5.3. Provide direction and/or support to system developers/administrators regarding correction of security problems identified during testing.

5.1.5.4 Evaluate functional operation and performance in light of test results and make recommendations regarding Certification and Accreditation (C&A).

5.1.5.5. The contractor shall attend weekly Peer Reviews and status update meetings.

5.1.5.6. Examine enclave vulnerabilities and determine actions to mitigate them. Implement vulnerability countermeasures for the enclave.

5.1.5.7. Provide support for the development of IA related customer support policies, procedures, and standards. The resource supplied by the contractor shall maintain IA controls in the Risk Management Framework (RMF).

5.1.6. Voice Communications Support

5.1.6.1. The contractor shall provide personnel to install, modify, troubleshoot, maintain, repair or replace key telephones, analog, digital and VOIP telephones, and VOIP gateways, private automatic/electronic and digital branch exchanges, electronic public address systems, electronic automatic dialers, electronic conferencing systems, radio monitoring and control circuits, fire and…