W911S7-23-R-0012.pdf

SEE ADDENDUM

(No Collect Calls)

W911S723R0012 05-Apr-2023

b. TELEPHONE NUMBER

5735960266

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 05 May 2023

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W911S79. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

THOMAS F. CAVALIER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011883024

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - FORT LEONARD WOOD

8112 NEBRASKA AVENUE

FORT LEONARD WOOD MO 65473

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W588N0 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FORT LEONARD WOOD

CDTF, FORT LEONARD WOOD

FORT LEONARD WOOD

FORT LEONARD WOOD MO 65473

TEL: FAX:

5735960267FAX:

TEL: 5735960266 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$32,500,000

NAICS:

541513

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF75

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W911S723R0012

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months

RMF ACCREDITATION

FFP

Risk Managament Framework (RMF) ACCREDITATION FOB: Destination

PURCHASE REQUEST NUMBER: 0011883024

PSC CD: DJ01

NET AMT

0002 1 Each

CMRA

FFP

CMRA

FOB: Destination

0003 12 Months

RMF ACCREDITATION - OPT 1

FFP

Risk Managament Framework (RMF) ACCREDITATION - OPT 1 FOB: Destination

0004 1 Each

CMRA

FFP

CMRA

FOB: Destination

0005 12 Months

RMF ACCREDITATION - OPT 2

FFP

Risk Managament Framework (RMF) ACCREDITATION - OPT 2 FOB: Destination

0006 1 Each

CMRA

FFP

CMRA

FOB: Destination

0007 12 Months

RMF ACCREDITATION - OPT 3

FFP

Risk Managament Framework (RMF) ACCREDITATION - OPT 3 FOB: Destination

0008 1 Each

CMRA

FFP

CMRA

FOB: Destination

0009 12 Months

RMF ACCREDITATION - OPT 4

FFP

Risk Managament Framework (RMF) ACCREDITATION - OPT 4 FOB: Destination

0010 1 Each

CMRA

FFP

CMRA

FOB: Destination

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 0005 Destination Government Destination Government 0006 Destination Government Destination Government 0007 Destination Government Destination Government 0008 Destination Government Destination Government

0009 Destination Government Destination Government 0010 Destination Government Destination Government

Section F - Deliveries or Performance

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 28-SEP-2023 TO

27-SEP-2024

N/A FORT LEONARD WOOD

CDTF, FORT LEONARD WOOD

FORT LEONARD WOOD

FORT LEONARD WOOD MO 65473

FOB: Destination

W588N0

0002 POP 28-SEP-2023 TO

27-SEP-2024

N/A (SAME AS PREVIOUS LOCATION)

0003 POP 28-SEP-2024 TO

27-SEP-2025

N/A (SAME AS PREVIOUS LOCATION)

0004 POP 28-SEP-2024 TO

27-SEP-2025

N/A (SAME AS PREVIOUS LOCATION)

0005 POP 28-SEP-2025 TO

27-SEP-2026

N/A (SAME AS PREVIOUS LOCATION)

0006 POP 28-SEP-2025 TO

27-SEP-2026

N/A (SAME AS PREVIOUS LOCATION)

0007 POP 28-SEP-2026 TO

27-SEP-2027

N/A (SAME AS PREVIOUS LOCATION)

0008 POP 28-SEP-2026 TO

27-SEP-2027

N/A (SAME AS PREVIOUS LOCATION)

0009 POP 28-SEP-2027 TO

27-SEP-2028

N/A (SAME AS PREVIOUS LOCATION)

0010 POP 28-SEP-2027 TO

27-SEP-2028

N/A (SAME AS PREVIOUS LOCATION)

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Cybersecurity Engineering Assistance Embedded Support

The U.S. Army CBRN Chemical Defense Training Facility

Part 1 GENERAL INFORMATION

1. General: CDTF is located at Fort Leonard Wood (FLW), Missouri, and conducts live chemical, biological, radiological, and nuclear defense (CBRN) training in a toxic Chemical agent environment for Army, Joint, and allied service members to enhance individual and collective proficiency and confidence in themselves and their equipment.

All the existing and planned systems are small and are not connected to any DoD network. Each consists of less than a half dozen computers used to monitor and/or control air monitoring sensors, alarms, closed-circuit TV (CCTV), or facility-control units (HVAC, chiller/boiler plant, filter blower systems, and lighting control). None of the systems contain classified information; all process nothing but publicly releasable information.

Written descriptions and diagrams of the four enclaves, currently consisting of 30 computers, are in the two attached documents.

Contracted support required consists of evaluating RMF security controls for the systems, scanning the systems using the Assured Compliance Assessment Solution and Security Content Automation Protocol (SCAP) tools, creating required documentation, informing the system owners of changes they need to make to obtain a favorable accreditation recommendation, and making recommendations to the Authorizing Official once the risk has been mitigated to an acceptable level. The contractor(s) will be required to test and apply all appropriate System Technical Implementation Guides (STIGs), both automated and manual, and all applicable security updates to software running on the computers. Any STIG settings or software patches that render a system inoperable will be annotated on a Plan of Action & Milestones and explained to the System Owner. If a STIG setting or software patch renders the system(s) inoperable, then a risk assessment must be documented in the form of a memorandum for record requesting Authorizing Official’s approval for accepting the risk of the findings.

The existing systems are accredited as four enclaves: security, air monitoring, environmental control, and audio/video. The enclaves have been registered in the Army Portfolio Management Solution (APMS), and Enterprise Mission Assurance Support Service (eMASS) and received an ATO from the Authorizing Official.

1.1. Background: This is a non-personal services contract to provide cybersecurity engineering assistance embedded support at the Chemical Defense Training Facility (CDTF). The Department of Defense (DoD) has transitioned to the RMF process for accreditation of information systems. DoD’s RMF policy, DoD Instruction (DoDI)

8510.01 (http://www.esd.whs.mil), requires that standalone information systems be accredited.

1.2. Hours of Operation: The CDTF normal operating hours are 0600-1500 Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.3. Place of Performance: Place of performance is the Chemical Defense Training Facility 8102 FLW HWY 5, Fort Leonard Wood, MO 65473.

PART 2 ACRONYMS AND REVELANT PUBLICATIONS

2. Acronyms and Publications:

2.1. Acronyms

ACAS Assured Compliance Assessment Solution AFARS Army Federal Acquisition Regulation Supplement AOR Area of Responsibility AR Army Regulation AT Anti-Terrorism ATCTS Army Training Certification Tracking System CAC Common Access Card CBRN Chemical, Biological, Radiological and Nuclear CCTV Closed Circuit Television CDTF Chemical Defense Training Facility CFR Code of Federal Regulations CLIN Cost Contract Line-Item Number CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense DODI Department of Defense Instruction eMASS Enterprise Mission Assurance Support Service FAR Federal Acquisition Regulation FLW Fort Leonard Wood FTR Federal Travel Regulation GFI Government Furnished Information GFP Government Furnished Property HQDA Headquarters Department of the Army HVAC Heating, Ventilation, and Air Conditioning IA Information Assurance IAW In Accordance With IT Information Technology IPR In Progress Review iRAPT Invoicing Receipt, Acceptance and Property Transfer KO Contracting Officer LAN Local Area Network MICC Mission Installation Contracting Command MSCOE Maneuver Support Center of Excellence NEC Network Enterprise Center NIPRNet DoD Non-classified Internet Protocol (IP) Router Network NLT No Later Than OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) OPSEC Operations Security

PIPO Phase In/Phase Out POC Point of Contact POP Period of Performance PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RMF Risk Management Framework SCAP Security Content Automation Protocol SCC SCAP Compliance Checker SME Subject Matter Expert STIG System Technical Implementation Guide TE Technical Exhibit TCO Telephone Control Officer TRADOC U.S. Army Training and Doctrine Command

2.2. Applicable Publications (Current Editions)

2.2.1. Policy documents listed in this section are referenced throughout the PWS specifications.

No. Title DATE DoDI 8500.01

Cybersecurity, found at http://www.esd.whs.mil

14 Mar 2014

DoDI 8510.01

Risk Management Framework (RMF) for DoD Information Technology (IT), found at http://www.esd.whs.mil

12 Mar 2014, Incorporating Change 2, 28 Jul

DoD 8570.01-M

Information Assurance Workforce Improvement Program, found at http://www.esd.whs.mil

December 19, 2005, Incorporating Change 4, 10 Nov

AR 25-2 Information Assurance, found at https://armypubs.army.mil

24 October 2007, Incorporating Rapid Action Revision (RAR) Issued 23 Mar 2009

2.2.2. Supplements, amendments, and new additions to publications may be issued during the term of resultant contract. New publications issued during the term of the contract which contain requirements that result in increased costs to the government shall not be implemented without prior approval of the Contracting Officer through the

COR. The contractor shall post and keep up to date all publications.

2.2.3. Contractor shall comply with all the applicable regulations, publications, manuals, local policies, and procedures listed in the table above.

PART 3 DELIVERABLES/TASKS

3. Specific Deliverables: Contractor shall provide the following support for CDTF:

3.1. Contractor shall provide Security Engineering assistance with configuring IT Systems to achieve compliance with all applicable Cybersecurity requirements:

3.1.1. Serve as the System Administrator for the base operating systems. The SA will be responsible to setup, upgrade (version changes or patches), and configure Microsoft and Linux commercial of the shelf (COTS) workstation and server operating systems, as well as commercial application software (e.g., Microsoft Office, JAVA, Mozilla Firefox, etc.…) and any Army developed computer software that the CDTF requires to help facilitate training. The SA will also identify any IT deficiencies within the CDTF and recommend changes to the SO. Develop and implement all appropriate controls.

3.1.2. Serve as the site administrator for the Army Portfolio Management Solution (APMS). Responsibilities include attending weekly meetings with TRADOC, maintaining registered systems for data accuracy, registering any new systems, and responding to all taskers assigned.

3.1.3. Analyze the existing systems and provide the System Owner a report of the work that is needed to bring them into and maintain compliance with applicable Cybersecurity requirements. Analysis will consist of automated scans using approved DoD tools such as Assured Compliance Assessment Solution (ACAS) and Security Content Automation Protocol (SCAP) Compliance Checker (SCC) as well as manual reviews of STIG checklists to identify deviations. Report shall be prepared in a generally accepted business format, Microsoft Word® or Microsoft PowerPoint®, and submitted electronically to the System Owner and COR.

3.1.4. Apply required system updates and configuration changes after approval by/in conjunction with the System Owner. Ensure that any remaining deviations are properly documented and explained to the System Owner.

3.1.5. Assist the System Owner with RMF Self-Assessments of the identified accreditation enclaves.

3.1.6. Update or develop Cybersecurity documentation and artifacts for the identified enclaves. Any existing Cybersecurity documentation and artifacts will be in eMASS.

3.1.7. Update implementation plan within eMASS for each control assigned to the systems.

3.1.8. Create or update the risk assessment within eMASS for each non-compliant finding.

3.1.9. Upload ACAS scans with both ASR/ARF files extensions into eMASS under the asset tab.

3.1.10. Create or update the System Owner’s RMF Plan of Actions & Milestones within eMASS.

3.2. Kick Off Meeting: Contractor shall attend via teleconference a kick-off meeting with Government to discuss the scope of work and receive GFI. The meeting date shall occur not later than 15 days after Contract award and shall be scheduled by the COR.

Contractor shall provide minutes of this meeting within 5 (five) calendar days of the date of the meeting. Minutes shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR.

3.3. Monthly Status Reports: Contractor shall provide a status report no later than 3 (three) calendar days following the final day of the month. This status report shall capture workload completed, workload in progress and any outstanding issues that need to be resolved. Reports shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR. In-Progress Review

(IPR).

3.4. Quarterly IPRs: Contractor shall attend via teleconference IPRs with the COR. The meeting dates shall be scheduled to occur within the first 5 (five) calendar days of each quarter. Contractor shall provide minutes of each meeting within 5 (five) calendar days of the date of the meeting. Minutes shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR.

3.5. Final Report Summary: Contractor shall submit a final report summary of activities performed by Contractor in support of this Contract to the COR. It shall include a summary of all deliverables completed. The Final Report Summary shall be due on the last day of period of performance. Report shall be completed in MS Word® using a generally accepted business format.

3.6. General acceptance criteria and quality measures: Contractor shall submit deliverables as set forth below to each deliverable and other work products received from Contractor under this PWS.

3.6.1. Accuracy – All deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

3.6.2. Clarity – All deliverables shall be concise and clear at every level of distribution.

All diagrams shall be easy to understand and be relevant to the supporting narrative.

3.6.3. File Editing – All text and diagrammatic files shall be editable by Government.

3.6.4. Format – Deliverables shall be submitted as specified in the PWS.

3.6.5. Timeliness – Deliverables shall be submitted on or before the due date specified in this PWS.

TECHNICAL EXHIBIT 1 DELIVERABLES SCHEDULE

DELIVERABLE

DATE DUE OR

FREQUENCY

SECTION

KICK OFF MEETING NLT 15 DAYS AFTER

CONTRACT AWARD

3.2

MONTHLY STATUS REPORTS NLT 3 CALENDAR DAYS

AFTER FINAL DAY OF

MONTH

3.3

QUARTERLY IPRS NLT 5 CALENDAR DAYS

AFTER START OF

QUARTER

3.4

TASK 1 NLT 30 DAYS AFTER

CONTRACT AWARD 3.1

FINAL REPORT SUMMARY NLT LAST DAY OF

PERIOD OF

PERFORMANCE

3.5

3.7. Travel: N/A

PART 4 ADMINSTRATIVE TASKS

4. Administrative Tasks: The below tasks will outline the administrative functions the Contractor will need to follow.

4.1. Qualifications/Licenses: Contractor personnel with administrator rights / elevated privileges to systems shall be Information Assurance (IA) Technical level 2 or IA Management level 1 certified, as a minimum, in accordance with DOD 8570.01-M.

Server administrators must complete Windows Server 2016 certification or the equivalent software commercial certification for the operating system for the system they are administering.

4.2. Kick-Off /Periodic Progress Meetings: Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with Contractor to review

Contractor's performance. At these meetings the KO will apprise Contractor of how Government views Contractor's performance and Contractor shall apprise Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to Government.

4.3. Medical Surveillance Program:

4.3.1. The Contractor shall ensure that all contractor employees performing work at CDTF and under this contract are enrolled in the Government Medical Surveillance Program IAW prior to performing duty in the CDTF compound.

4.3.2. In accordance with DA PAM 40-8 (https://armypubs.army.mil) and Dept. of the Army (ASA-IE) Interim Guidance on Occupational Health Practices for the Evaluation and Control of Occupational Exposures to Nerve Agents GB, GA, GD, GF, and VX; and Mustard Agents H, HD, and HT, 23 Jan 2013, the Contractor shall enroll all on-site (at CDTF) employees, regardless of duty position or function, into the Government Medical Surveillance Program. All occupational health services related to contract duty requirements shall be obtained from the General Leonard Wood Army Community Hospital (GLWACH) on a cost reimbursable basis.

4.3.3. Occupational Health records General Leonard Wood Army Community Hospital (GLWACH) for the Contractor under this program are Government records and will be maintained as such.

4.4. Contractor Management Reporting (CMRA): Contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) via a secure data collection site. Contractor is required to completely fill in all required data fields using the following web address:

http://www.ecmra.mil/, and then click on “Department of the Army CMRA” or the icon of the DoD organization that is receiving or benefitting from the contracted services.

Reporting inputs will be for the labor executed during the POP for each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported NLT October 31 of each calendar year. Contractors may direct questions to the help desk by clicking on “send an email” which is located under the Help Resources ribbon on the right side of the login page of the applicable Service/Component’s CMRA website.

4.5. Phase In/ Phase Out Period: N/A

4.6. Quality Control (QC): N/A

PART 5 SECURITY/ACCESS

5. Security / Access:

5.1. Required Security Clearance Requirements: Contractor personnel performing work under this contract must have a background investigation sufficient to qualify for an account on the DoD Non-classified Internet Protocol (IP) Router Network (NIPRNet) and must maintain the level of security required for the life of the contract. The security requirements are IAW the attached DD254 (The RA is responsible for coordinating with the unit security manager for this form).

5.2. Physical Security: Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

5.3. Key Control: N/A. Contractor shall not be provided government keys.

5.3.1. In the event keys, other than master keys, are lost or duplicated, Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, Government, at its option, may replace the affected lock or locks or perform re-keying.

When the replacement of locks or re-keying is performed by Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by Government and the total cost deducted from the monthly payment due Contractor.

5.3.2. Contractor shall prohibit the use of Government issued keys/key cards by any persons other than Contractor’s employees. Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

5.3.3. Lock Combinations: N/A

5.4. Antiterrorism (AT) Level I Training:

Antiterrorism (AT) Level I Training.

1. Antiterrorism (AT) Level I Training. All contractor and sub-contractor employees requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training. IAW AR 525-13, 3 DEC 19, AT Level I Awareness training will be conducted by a certified Level II trained ATO. For contracts that cross fiscal years, or for contracts with option years, all contractor personnel shall complete annual AT Level I awareness training. The Installation AT Office or a certified Level II trained ATO on the installation will provide the training. Contact information for this Government employee will be provided at the kick-off meeting.

The Installation AT Office or a certified Level II trained ATO will provide a one-hour training session conducted on FLW for Contractor personnel working on this installation. The COR will coordinate this training at the time of task order modification or award. Contractor personnel working at installations other than FLW shall coordinate with the COR and local AT Offices to obtain training applicable to that installation.

Contractor shall provide a list of personnel trained to the COR within five (5) business days of completion of training.

2. Access and General Protection/Security Policy Procedures. FLW Automated Installation Entry (AIE) Pass Transition. The included instructions/form for requesting a Ft. Leonard Wood AIE pass supersede those previously communicated.

The AIE pass form (see attached) has been revised for applicants to provide citizenship status, Foreign Nationals Alien Registration/Passport number and Country of Birth information. An electronic copy of the spreadsheet will be sent via email for your use. As with the previous version, all information must be typed; handwritten and incomplete requests will not be processed. Once completed, submit the form to your sponsor via email or US mail.

Your sponsor will add the FPCON level, days, and times for entry and will forward it to the Visitor Control Center (VCC) for background screening and pass processing. The sponsor will send it via encrypted email to this address: usarmy.leonardwood.usag.list.des-physec-vcc@mail.milemail. VCC personnel will notify sponsors when background screenings are completed, and passes are ready for pickup. Sponsors will then notify you that your pass is ready for pick up at the VCC.

You will need bring a valid picture ID and turn in Mobilisa passes, as they will no longer be authorized.

As a reminder, the Mobilisa pass application portal is no longer used. Regardless of the expiration date of an existing Mobilisa pass, ALL pass holders are required to get the new AIE pass. Person(s) that do not submit for the new AIE pass may experience delays entering FLW.

If a retiree, or DOD ID card holder, wishes to gain employment on the installation as a contractor, then that person’s “status” will change to a contract employee, which triggers the requirement for an employment background check and an NCIC-III check for access to the installation.

3. iWatch Training. Within 10 calendar days of contract award and within 10 calendar days of new Contractor employees commencing work on this contract, all Contractor and sub-contractor employees shall review the FLW Directorate of Emergency Services (DES) web link for iWatch training located at http://www.wood.army.mil/LEC/iWatch/iWatch.htm. This locally developed training will inform employees of the types of behavior to watch for and how to report suspicious activity. Suspicious activity shall be reported to the COR or KO.

5.6. Information Assurance (IA) Awareness Training for Contractors Requiring Access to Information Systems: All Contractor and sub-contractor personnel requiring network access to Government information systems shall successfully complete DoD Cyber Awareness Challenge training available at https://ia.signal.army.mil/ or other designated location prior to accessing systems and annually thereafter. Training certificates shall be provided to the COR immediately upon completion. Contractor employees shall register in the Army Training Certification Tracking System (ATCTS) prior to commencement of work and shall sign the acceptable use policy IAW AR 25-2, Para. 3-3. The COR or KO will coordinate with the requiring activity Information Assurance Support Officer to input the DoD Cyber Awareness Challenge Training certificate and training information into the ATCTS and verify compliance.

5.7. Information Assurance/Information Technology (IT) Support Functions Certification:

(If applicable) Contractor and subcontractor personnel performing IT functions shall successfully complete IA training and certification for their assigned IA Technical or IA Management level IAW AR 25-2, Para 4-3, DoD 8570.01-M and DoDD 8570.01. DFAR Clause 252.239-7001 Information Assurance Contractor Training and Certification: (JAN 2008) (a) Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01–M, Information Assurance Workforce Improvement Program. Contractor shall meet the applicable information assurance certification requirements, including— (1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and (2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01– M. (b) Upon request by Government, Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. (c) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

5.7.1. All contractor employees and associated subcontractor employees must complete the DoD IA Awareness training (available at https://ia.signal.army.mil or other designated location) before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2. Certificates of completion for each affected contractor employee shall be submitted to the COR (or KO if no COR is appointed) within 30 calendar days after completion of training.

5.8. OPSEC (Operations Security) Plan and User Agreement: The OPSEC Plan and User Agreement will be available for Contractors to review at the Contracting Office located in Building 11400, FLW, MO, from the hours of 0730 to 1600. The COR will ensure Contractor is aware of the Installation’s OPSEC Plan and is compliant with the Installation’s OPSEC Plan during contract performance.

5.9. OPSEC Training: Pursuant to AR 530-1, all Contractor personnel must complete initial Level I OPSEC training within 30 calendar days beginning performance on this contract. For contracts that cross fiscal years, or for contracts with option years, all contractor personnel shall complete annual OPSEC awareness training. The MSCoE OPSEC Officer will provide training. Contact information for this Government employee will be provided at the kick-off meeting.

5.9.1. The MSCoE OPSEC Officer will provide a one-hour training session conducted on FLW for Contractor personnel working on this installation. The COR will coordinate this training at the time of award.

5.9.2. Contractor shall provide a list of personnel trained to the COR within five (5) calendar days of completion of training.

5.9.3. Contractor personnel working at installations other than FLW shall coordinate with the COR and local OPSEC Offices to obtain training applicable to that installation.

5.10. Accompany Forces: N/A

5.11. Performance or delivery in a foreign country: N/A

5.12. Contractor access to the FLW Local Area Network (LAN): Contractor personnel shall obtain Common Access Cards (CAC), be registered in the Army Training Certification Tracking System (ATCTS) by a Government representative, and complete Information Assurance (IA) Training before being permitted to access the FLW LAN. For contracts crossing fiscal years, or those awarded with option periods, IA training shall be accomplished annually for all Contractor personnel. Access to the LAN is required to review key instruction materials necessary for performance of work. Contractor personnel shall not connect personal devices or Contractor / commercially provided equipment to the FLW network without first receiving written permission from the FLW Network Enterprise Center (NEC). Devices, such as desktop or laptop computers which are Contractor furnished, must be loaded with operating system and application software to standards defined by the FLW NEC prior to connection. The NEC must install and configure such devices prior to being operated on the network. All devices connected to the network will be managed under strict Information Assurance standards as prescribed by Army Regulation (AR) 25-2. The NEC retains sole administrator authority over devices connected to the network. Access to network resources is granted on a least-needed basis, therefore only minimal services will be provided to Contractor personnel unless explicitly granted through this PWS. Common services include physical connectivity, user-id and use of shared services related to work (printers, shared files, and public folders). Limited Internet access may be provided based on specific tasks identified in this PWS which indicates communication with Internet based hosts is a requirement to successfully execute the Contract. Contractor is subject to all access policies, particularly the Acceptable Use Agreement and AR 25-

2. Contractor shall not load any software or make any changes to computer configurations. All requests for changes or problem reports must be submitted to the NEC through the work order process. Department of Defense (DoD) computer systems, including Contractor furnished devices connected to the FLW LAN, may be monitored for all lawful purposes. Contractor’s use of the DoD computer systems, authorized or unauthorized, constitutes consent to monitoring.

5.13. Contractor Access and Use of FLW Telephones and Telephone Services:

Telephones and telephone basic service, including local and long distance, shall only be used for official Government purposes. Contractor is subject to AR 25-2 which established policies on telephone and Automated Information System use. Contractor shall not move, unplug, or alter any telephone or voice device. Unique devices, such as speaker phones, cordless or conference phones, shall be requested through a Government Telephone Control Officer (TCO) work order at the expense of Contractor.

All requests for changes or problem reports must be submitted to the NEC through the unit TCO who will be identified at the kick-off meeting. DoD telephones may be monitored for all lawful purposes. Contractor’s use of the DoD telephones, authorized or unauthorized, constitutes consent to monitoring.

5.14. For contractors requiring CAC. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-

05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

5.15. Trusted Associate Sponsorship System (TASS): Contractor User Guide and other information see http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/

5.15.1. Contractor must obtain a CAC for those Contractor employees whose functions require access to systems or facilities controlled by the CAC.

5.15.2. Contractor Representative shall notify TASS Trusted Agent (TA) (the TA is the COR) of new employee CAC requirements. Company Representative shall provide all personnel data required to process TASS application with the TA, including security investigation requirements.

5.15.3. Contractor employee(s) shall obtain their CAC at defense enrollment eligibility reporting system (DEERS) / real-time automated personnel identification system (RAPIDS) terminals when application is approved.

5.15.4. Contractor employee(s) shall inform Corporate Facility Security Officer (FSO)/Security Manager of approval/denial of CAC application and shall return CAC to Corporate FSO upon departure or dismissal. Contractor shall be responsible for implementation and follow-up of this requirement.

5.15.5. Failure, inability, or delay in obtaining the CAC does not relieve Contractor from performing under the terms of this Contract.

5.15.6. Contractor shall ensure all CACs issues to Contractor personnel are returned to the COR upon termination or completion of this Contract.

5.16. Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander, installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Directorate of Emergency Services or Security Office. The requesting contractor shall submit their request for an installation pass to their sponsor using the following link:

https://vcc1.icmvcc.com/im3500/. A valid sponsor may be either the COR, COTR, or KO if neither is appointed. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6. Stand Alone Documents (not to be included in PWS):

6.1. Government Furnished Property:

6.1.1. Facilities and Equipment: Government will provide office workspace (cubicle) with computer workstation (NIPRNet accessible) and access to printers, copiers, fax machine, and telephone. All Government equipment shall be inspected by Contractor prior to signing for, and again before being returned to Government. Contractor shall inform Government of any deficiencies in the equipment upon its return.

6.1.2. IAW AR 25-2, only GFP will be used on installation networks, unless expressly approved by NEC.

6.1.3. Contractor shall operate and utilize all GFP in strict compliance with the GFP equipment technical manuals and manufacturer’s instructions that are available for Contractor use. All GFP shall be used only in the performance of these PWS requirements. Liability for GFP while in the control of Contractor shall be IAW FAR Clause 52.245-1.

6.1.4. Materials (If applicable): Contractor is provided access to CDTF controlled documents on either a common shared drive or stored within the cloud. These controlled documents provide insight on how CRN systems and associated procedures are integrated into CDTF operations.

Section G - Contract Administration Data

Section I - Contract Clauses

CLAUSES INCORPORATED BY REFERENCE

52.202-1 Definitions JUN 2020 52.203-5 Covenant Against Contingent Fees MAY 2014 52.203-6 Restrictions On Subcontractor Sales To The Government JUN 2020 52.203-6 Alt I Restrictions On Subcontractor Sales To The Government

(JUN 2020) -- Alternate I

NOV 2021

52.203-7 Anti-Kickback Procedures JUN 2020 52.203-15 Whistleblower Protections Under the American Recovery and

Reinvestment Act of 2009

JUN 2010

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights

JUN 2020

52.204-7 Alt I System for Award Management-- Alternate I OCT 2018 52.204-9 Personal Identity Verification of Contractor Personnel JAN 2011 52.204-19 Incorporation by Reference of Representations and

Certifications.

DEC 2014

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities

NOV 2021

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.209-6 Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, or Proposed for Debarment

NOV 2021

52.212-4 Contract Terms and Conditions--Commercial Products and Commercial Services

DEC 2022

52.216-4 Economic Price Adjustment-Labor and Material JAN 2017 52.219-14 (Dev) Limitations on Subcontracting (DEVIATION 2021-O0008) OCT 2022 52.225-13 Restrictions on Certain Foreign Purchases FEB 2021 52.225-25 Prohibition on Contracting with Entities Engaging in Certain

Activities or Transactions Relating to Iran-- Representation and Certifications.

JUN 2020

52.227-19 Commercial Computer Software License DEC 2007 52.232-1 Payments APR 1984 52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

NOV 2021

52.233-3 Protest After Award AUG 1996 52.233-3 Alt I Protest After Award (Aug 1996) - Alternate I JUN 1985 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 52.244-6 Subcontracts for Commercial Products and Commercial

Services

DEC 2022

52.249-4 Termination For Convenience Of The Government (Services) (Short Form)

APR 1984

252.201-7000 Contracting Officer's Representative DEC 1991 252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

DEC 2018

CLAUSES INCORPORATED BY FULL TEXT

52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or Services-- Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representations and Certifications- Commercial Products and Commercial Services. The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services."

(d) Representations. The Offeror represents that--

(1) It [ ___ ] will, [ ___ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that--

It [ ___ ] does, [ ___ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures.

(1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(End of provision)

52.204-26 COVERED TELECOMMUNICATIONS EQUIPMENT OR SERVICES--REPRESENTATION (OCT

2020)

(a) Definitions. As used in this provision, “covered telecommunications equipment or services” and "reasonable inquiry" have the meaning provided in the…