A01_PWS__1_AUG_2017.pdf

Performance Work Statement

(PWS) Title: Two-Factor Authorization - OCONUS, Follow-On

Requiring Activity Name: Walter Reed Army Institute of Research (WRAIR)/Information Management Division (IMD)

1. BACKGROUND

The WRAIR is the largest biomedical research facility administered by the U.S. Department of Defense (DoD). The WRAIR aims to conduct biomedical research that is responsive to Department of Defense and US Army requirements and delivers life-saving products including knowledge, technology and medical material that sustain the combat effectiveness of the Warfighter.

WRAIR has developed two modern Centers of Excellence-Infectious Disease Research and Military Psychiatry and Neuroscience Research. World-renowned scientists with expertise in comprehensive Soldier fitness, brain injury, and sleep management make up the Center for Military Psychiatry and Neuroscience Research. The Center for Military Infectious Disease Research combines expertise in the development of vaccines and drugs for prevention and treatment of such diseases as malaria, HIV/AIDS, dengue fever, wound infections, leishmaniasis, enteric diseases and others.

Walter Reed Army Institute of Research strives to be the premier DoD biomedical research organization. With headquarters in Silver Spring, Maryland, our laboratories are also hosted in our subordinate command locations in Thailand, Georgia, and Kenya.

IMD provides secure, reliable, and integrated technology solutions, in a cost-effective manner, to facilitate the WRAIR mission. To meet this mission IMD:

• Promotes and facilitates the effective integration of technology into the basic mission of WRAIR through planning, programming, training, consulting, and other support activities

• Develops, enhances, and manage WRAIR's networks to provide high speed, transparent, and highly functional connectivity among all information resources

• Develops and maintains highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions

• Facilitates the collection, storage, security and integrity of electronic data while ensuring appropriate access

• Promotes new uses of information technology through the support for exploratory and innovative applications

• Provides leadership for effective strategic and tactical planning in the use of technology

• Provide fast & reliable access to all information systems

2. SCOPE

This Performance Work Statement (PWS) describes the performance requirements for contractor services in support of WRAIR/OCONUS.

WRAIR/OCONUS requires support services for CAC systems.

3. OBJECTIVES

WRAIR/OCONUS requires support services for the Common Access Card (CAC) systems which will continue to be an integral part of the security infrastructure.

4. PERIOD OF PERFORMANCE

Base Period - 14SEP17 through 13SEP18 Option Period 1 - 14SEP18 through 13SEP19 Option Period 2 - 14SEP19 through 13SEP20

5. REQUIRED TASKS

5.1 Support Services/Maintenance

The contractor shall provide maintenance for the installed hardware and software during the s e r v i c e agreement period. The contractor shall provide support telephonically, email and remote configuration support to the IT staff of the different OCONUS labs as required during the maintenance period.

• End users shall be able to logon to domain workstations and laptops running

Windows 7 and 8.x using a Smart Card and a PIN

• System Administrators shall be able to access remotely domain servers running

Windows 2008, and 2012 using a Smart Card and PIN

• Remote users shall be able to authenticate to the Virtual Private Network gateway using a Smart Card and PIN and securely gain access to the organization internal resources

• End users shall be able to unlock their PIN, update and renew their Smart Cards using a Self-Service Web Portal

• The end users shall be able to use their Smart Card for Physical Access

• Operators shall be able to centrally manage the solution and the Smart Card lifecycle using Web Interface

• The solution shall include one Hardware Security Modules. HSMs are high security electronic safes for cryptographic keys that shall protect these using Hardware protection certified FIPS 140-2 Level 2 or 3

• Employees shall be able to digitally sign emails and documents

• Operators shall be able to print and encode the smart cards in one step

• Domain workstations and laptops shall authenticate to Wireless networks using a digital

Certificate

• The contractor shall support THALES Hardware Security Module (HSM) based on past performance and provide evidence of the ability to support the HSM module referenced in section 5.1

• The contractor shall support integration of Certificate Authority (CA) to Microsoft Active directory (MSAD) and THALES Key safe Credential Management System (CMS). The Personal Identification Verification (PIV) system uses several server systems to operate effectively

• Contractor shall support the integration of the CMS using the key management procedures

• The contractor shall support the following server system configuration for the PIV;

Microsoft SQL, IIS, AD

• The contractor shall support OCONUS Email servers and VPN devices

• The contractor shall support THALES Key safe CMS. This CMS software system controls the functionality of the PIV issuance, revocation, expiration and suspension.

The contractor shall support this system in terms of upgrading the software and recovery of the security world created by this system

• The contractor shall also support Oberthur 8.0 PIV card configuration and network access using the PIV for authentication, authorization, encryption/decryption, accountability, and non-repudiation

5.2 Comply with all required Army directives and standards

The contractor shall comply with all Army regulations. The contractor shall assist in the provision of security and patch update to the system as required by the Army Computer Emergency Response Team (ACERT), the Army, or DOD cyber command that are concerned with information technology, security during and after implementation within the service layer agreement period.

5.3 Comply with all required Army directives and standards

The contractor shall comply with all Army regulations. The contractor shall assist in the provision of security and patch update to the system as required by the Army Computer Emergency Response Team (ACERT), the Army, or DOD cyber command that are concerned with information technology, security during and after implementation within the service layer agreement period

6. Deliverables Deliverable Item PWS Task Duration Method of

Verification 1 Support

Services

5.1 The contractor shall

provide maintenance for the installed hardware and software during the service agreement period.

The contractor shall provide support Telephonically, email and remote configuration support to the IT staff of the different OCONUS labs as required during the maintenance period

24hrs per day, 7 days a week, 365 days per year

Documentation and Presentation

7.0 Work Location

Work will take place at the OCONUS facilities at the Armed Forces Research Institute of Medical Sciences (Bangkok, Thailand), United States Army Research Directorate-Georgia (Tbilisi, Georgia), and United States Army Research Directorate-Kenya (Nairobi Kenya).

8.0 Work Schedule

Services must be available 24 per day, 7 days per week.

9. COMPLIANCE DOCUMENTS

9.1.1 Information Technology Compliance

9.1.1.1 Army Regulation 25-1, Information Technology

Compliance information regarding Army Information Technology may be found at:

http://armyhpubs.army.miVepubs /25_Series_Collection_ I .html

9.1.1.2 Army Regulation 25-2, Information Assurance

Compliance information regarding Army Information Assurance may be found at:

https://ia.signal.army.mil/ docs/AR25-2.pdf

9.1.1.3 Cyber-security

Department of Defense (DOD) Instruction 8500.01 Cyber security

9.1.1.4. Risk Management Framework

Department of Defense (DOD) Instruction 8510.01 Risk Management Framework (RMF) For DOD Information Technology (IT Department of Defense (DoD) Instructions 5400.11-R, Privacy Program http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

10. OTHER TERMS, CONDITIONS, AND PROVISIONS

10.1 Organizational Conflict of Interest

Walter Reed Army Institute of Research (WRAIR) has categorized its requirements into two broad categories, as defined below, for purposes of identifying; avoiding or militating against OC is in accordance with FAR Subpart 9.5. These categories apply to all enterprise laboratories (Armed Forces Research Institute of Medical Sciences (AFRIMS), United States Medical Research Directorate - Kenya (USAMRD-K), and United States Medical Research Directorate - Georgia (USAMRD-G). These categories are defined as follows:

Global Support: Where services which, by their very nature, give the Contractor access to non-public procurement sensitive data about the contract requirements, other contractors' proprietary information, or put the contractor in a position to influence the award decision on a contract in which they are participating. These services are identified as those having a direct impact to the operations of the greater WRAIR enterprise.

Services would be characterized as having access to Command Wide procurement sensitive information, or work that could likely have an influence over follow-on awards or contracts within subordinate directorates/Commands.

Mitigation strategies may include: avoidance (non-participation), firewalls between existing personnel and new requirement.

Isolated Support: Services which have focused impact on a specific Branch/ Department/ Program of WRAIR rather than the WRAIR enterprise.

Services can be characterized as having little or no access to procurement sensitive information other than the immediate requirement and little chances of follow-on work that can be influenced by the immediate requirement.

Mitigation Strategies: Contractor can provide a mitigation plan or acceptable self-certification that no OCI exists.

Contractor participation in more than one of these areas may give rise to an unfair competitive advantage resulting from access to advance acquisition planning, source selection sensitive or proprietary information. Furthermore, Contractor participation in more than one area may give rise to a real or apparent loss of Contractor impartiality and objectivity where its advisory or planning assistance in one area potentially affects its present or future participation in another area.

The purpose of this categorization is to accomplish the following three objectives: (1) to inform prospective Offerors that WRAIR presumes that award of a contract or order in the subject category will give rise to real or apparent OCI's with respect to requirements in the other category and or may give rise to a Contractors Conflict of interest (CCI) in the same category; (2) to assist current Contractors and prospective Offerors in developing their own business strategies regarding participation in WRAIR requirements and in identifying and, where possible, avoiding or mitigating against OC is; and (3) to ensure that all current Contractors and prospective Offerors are afforded the maximum practicable opportunity to compete for all WRAIR requirements consistent with the restrictions required under FAR Subpart 9.5 and sound business practices.

For purposes of identifying and/or mitigating against OC is, WRAIR will examine all its services requirements and acquisitions regardless of the cognizant contracting activity'(e.g., USAMRAA, GSA, other agency Multiple Award Schedules, etc.) or the type of contract vehicle used (e.g., FSS order, Fair Opportunity competitive order under Multiple Award ID/IQ Contracts, competitively negotiated awards under FAR Part 15, etc.).

Each WRAIR services solicitation will therefore be designated as falling within one of the above defined categories. The applicable OCI category will be set forth in each award.

This requirement is categorized as GLOBAL SUPPORT.

Organizational and consulting conflicts of interest may arise by performing advisory or consulting support services. Organizational conflicts of interest include providing services or performing advisory or consulting work for private companies that participate or will participate in future services or contract activities (solicitations and award). See FAR subpart 9.5.

10.2 Section 508 Requirement

The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

Specifically, the procurement, development, maintenance, or integration of electronic and information technology (EIT) under this contract must comply with the applicable accessibility standards issued by the Architectural and Transportation Barriers Compliance Board at CFR part 1194.

10.3 Contractor Manpower Reporting

The contractor shall report ALL contractor labor hours (including subcontractor labor Hours) required for performance of services provided under this contract for WRAIR support via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY); this runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2016. Contractors may direct questions to the help desk at help desk at:

http://www.ecmra.mill .

Register under the "All Other Defense Components" module. The Walter Reed Institute of Research (WRAIR) Unit Identification Code (UIC) is W03KAA. The Federal Supply Code (FSC) is R499.

10.4 . Anti-Terrorism and Operational Security

10.4.1 Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to Government information systems.

All contractor employees with access to a Government info system must be registered in the ATCTS at commencement of services and must successfully complete the DoD Information Assurance Awareness prior to access to the information system and annually thereafter.

10.4.2 For IA/IT training.

All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of appointment to IA/IT functions.

10.5 Compliance

The Contractor shall make its internal practices, books, and records available to the HHS Secretary for purposes of determining compliance with the HIPAA Rules.

10.5.1 Termination

a) Effect of Noncompliance: Noncompliance by the Contractor (or any of its staff, agents, or subcontractors) with any requirement in these HIPAA Business Associate Provisions (paragraph 8) may subject the Contractor to termination under any applicable default or other termination provision of this Contract.

b) Effect of Termination:

i. If this Contract has records management requirements, the Contractor shall handle such records in accordance with the records management requirements. If this Contract does not have records management requirements, the Contractor shall handle such records in accordance with paragraphs 9.8.8.16.2.2 and 9.8.8.16.2.3 below. If this Contract has provisions for transfer of records and PII/PHI to a successor contractor, or if DHA gives directions for such transfer, the Contractor shall handle such records and information in accordance with such Contract provisions or DHA direction.

ii. If this Contract does not have records management requirements, except as provided in paragraph 9.8.8.6.12.3 below, upon termination of the Contract, for any reason, the Contractor shall return or destroy all PHI received from the Government, or created or received by the Contractor on behalf of the Government that the Contractor still maintains in any form. This provision shall apply to PHI that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the PHI.

iii. If this Contract does not have records management provisions and the Contractor determines that returning or destroying the PHI is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of PHI is infeasible, the Contractor shall extend the protections of the Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

10.6 Public Key Infrastructure Authentication and Encryption

Contractors shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication including authentication to DoD private web servers or applications. Where interoperable PKI is required for the exchange of unclassified information, including the encryption of e-mail containing sensitive information, between DoD and its Contractors, industry partners shall obtain all necessary certificates if they are not eligible for a DoD Common Access Card. (refer to: http://iase.disa.mil/pki/eca/ and http://www.cac.mil /)