W911S7-23-R-0012 Amendment 0002 28JUL23.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provi ded herei n, all t erms and condit ions of t he document refere nced in Item 9A or 10A, as heretofore change d, remai ns unchanged and in ful l force and effect .

15A. NAME AND TIT LE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

ST ANDARD FORM 30 (Rev. 10-83) Prescr ibed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to update Section L and M, revise PWS, Paragraph 4.5, and add Attachment 1, Past Performance Questionnaire (PPQ) Form and Attachment 2, CLIN Structure.

1. CO NTRACT ID CODE P AGE OF P AGES

J 1 27

16A. NAME AND T ITLE OF CONTRACTING OFFICER (Type or print)

16C. DAT E SIGNED

BY 28-Jul-2023

16B. UNITED ST AT ES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contract ing Officer )(Signature of person authorized t o sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, Count y, Stat e and Zip Code) X W911S723R0012

X 9B. DAT ED (SEE IT EM 11)

13-Jul-2023

10B. DAT ED (SEE IT EM 13)

9A. AMENDMENT OF SOLICITAT ION NO.

11. THIS IT EM ONLY APPLIES T O AMENDMENT S OF SOLICITATIONS

X The above numbered soli cit ati on i s amended as set forth in It em 14. The hour and date specified for rece ipt of Offer is ext ended, X is not extended.

Offer must acknowl edge rece ipt of t his amendment pri or to the hour and date specified in the sol ici tat ion or as amended by one of t he fol lowing methods:

(a) By compl eti ng Items 8 and 15, and returning copi es of the amendment ; (b) By acknowledgi ng recei pt of thi s a mendment on each copy of t he offer submit ted;

or (c) By s epara te let ter or t elegram whi ch i ncludes a refe rence t o t he s olic ita tion and amendment numbers . FA ILURE OF YOU R A CKNOWLEDGMENT TO BE RECEIVED AT TH E P LACE D ESIGNATED FOR TH E RECEIPT OF OFFERS P RIO R TO THE HOUR AN D DATE SP ECIFIED MA Y RESULT IN

REJECTIO N OF YOUR OFFER. If by vir tue of thi s amendment you desire t o change an offer already submit ted, s uch c hange ma y be made by t ele gram or let ter, provided each t elegram or l ett er makes reference to the sol ici tat ion and this amendment , and is re ceived prior to the openi ng hour and dat e speci fi ed.

12. ACCOUNTING AND APPROPRIATION DAT A (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORT H IN ITEM 14 ARE MADE IN THE

CONT RACT ORDER NO. IN ITEM 10A.

B. T HE ABOVE NUMBERED CONT RACT /ORDER IS MODIFIED T O REFLECT THE ADMINIST RATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORT H IN ITEM 14, PURSUANT TO T HE AUTHORITY OF FAR 43.103(B).

C. T HIS SUPPLEMENT AL AGREEMENT IS ENT ERED INTO PURSUANT TO AUTHORITY OF:

D. OT HER (Specify type of modification and authorit y)

E. IMPORTANT: Contract or is not, is required to sign this document and return copies t o the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/cont ract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/ MODIFICATION NO. 5. P ROJECT NO .(If appli cable)

6. ISSUED BY

3. EFFECTIVE DATE

28-Jul-2023

CODE

MICC - FORT LEONARD WOOD

8112 NEBRASKA AVENUE

FORT LEONARD WOOD MO 65473

W911S7 7. AD MINISTERED BY (If other t han item 6)

4. REQUISITION/PU RCHASE REQ. NO.

CODE

See I tem 6

FACILITY CODECODE

EMAIL:TEL:

W911S723R0012

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The solicitation issue date has changed from 07-Jul-2023 to 13-Jul-2023.

SECTION B - SUPPLIES OR SERVICES AND PRICES

CLIN 0009 is added as follows:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0009 1 Months Phase-In Period

FFP

Phase-In, 30-Day Transition Period, PWS Paragraph 4.5 FOB: Destination

PSC CD: DJ01

NET AMT

SECTION E - INSPECTION AND ACCEPTANCE

The following Acceptance/Inspection Schedule was added for CLIN 0009:

INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

Destination Government Destination Government

SECTION F - DELIVERIES OR PERFORMANCE

The following have been modified:

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Cybersecurity Engineering Assistance Embedded Support

The U.S. Army CBRN Chemical Defense Training Facility

Part 1 GENERAL INFORMATION

1. General: CDTF is located at Fort Leonard Wood (FLW), Missouri, and conducts live chemical, biological, radiological, and nuclear defense (CBRN) training in a toxic Chemical agent environment for Army, Joint, and allied service members to enhance individual and collective proficiency and confidence in themselves and their equipment.

All the existing and planned systems are small and are not connected to any DoD network. Each consists of less than a half dozen computers used to monitor and/or control air monitoring sensors, alarms, closed-circuit TV (CCTV), or facility-control units (HVAC, chiller/boiler plant, filter blower systems, and lighting control). None of the systems contain classified information; all process nothing but publicly releasable information.

Contracted support required consists of evaluating RMF security controls for the systems, scanning the systems using the Assured Compliance Assessment Solution and Security Content Automation Protocol (SCAP) tools, creating required documentation, informing the system owners of changes they need to make to obtain a favorable accreditation recommendation, and making recommendations to the Authorizing Official once the risk has been mitigated to an acceptable level. The contractor(s) will be required to test and apply all appropriate System Technical Implementation Guides (STIGs), both automated and manual, and all applicable security updates to software running on the computers. Any STIG settings or software patches that render a system inoperable will be annotated on a Plan of Action & Milestones and explained to the System Owner. If a STIG setting or software patch renders the system(s) inoperable, then a risk assessment must be documented in the form of a memorandum for record requesting Authorizing Official’s approval for accepting the risk of the findings.

The existing systems are accredited as four enclaves: security, air monitoring, environmental control, and audio/video. The enclaves have been registered in the Army Portfolio Management Solution (APMS), and Enterprise Mission Assurance Support Service (eMASS) and received an ATO from the Authorizing Official.

1.1. Background: This is a non-personal services contract to provide cybersecurity engineering assistance embedded support at the Chemical Defense Training Facility (CDTF). The Department of Defense (DoD) has transitioned to the RMF process for accreditation of information systems. DoD’s RMF policy, DoD Instruction (DoDI) 8510.01 (http://www.esd.whs.mil), requires that standalone information systems be accredited.

1.2. Hours of Operation: The CDTF normal operating hours are 0600-1500 Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.3. Place of Performance: Place of performance is the Chemical Defense Training Facility 8102 FLW HWY 5, Fort Leonard Wood, MO 65473.

PART 2 ACRONYMS AND REVELANT PUBLICATIONS

2. Acronyms and Publications:

2.1. Acronyms

ACAS Assured Compliance Assessment Solution AFARS Army Federal Acquisition Regulation Supplement AOR Area of Responsibility AR Army Regulation AT Anti-Terrorism ATCTS Army Training Certification Tracking System CAC Common Access Card CBRN Chemical, Biological, Radiological and Nuclear CCTV Closed Circuit Television CDTF Chemical Defense Training Facility CFR Code of Federal Regulations CLIN Cost Contract Line-Item Number CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense DODI Department of Defense Instruction eMASS Enterprise Mission Assurance Support Service FAR Federal Acquisition Regulation FLW Fort Leonard Wood FTR Federal Travel Regulation GFI Government Furnished Information GFP Government Furnished Property HQDA Headquarters Department of the Army HVAC Heating, Ventilation, and Air Conditioning IA Information Assurance IAW In Accordance With IT Information Technology IPR In Progress Review iRAPT Invoicing Receipt, Acceptance and Property Transfer KO Contracting Officer LAN Local Area Network MICC Mission Installation Contracting Command MSCOE Maneuver Support Center of Excellence NEC Network Enterprise Center NIPRNet DoD Non-classified Internet Protocol (IP) Router Network NLT No Later Than OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) OPSEC Operations Security PIPO Phase In/Phase Out POC Point of Contact POP Period of Performance PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RMF Risk Management Framework SCAP Security Content Automation Protocol SCC SCAP Compliance Checker SME Subject Matter Expert STIG System Technical Implementation Guide TE Technical Exhibit TCO Telephone Control Officer TRADOC U.S. Army Training and Doctrine Command

2.2. Applicable Publications (Current Editions)

2.2.1. Policy documents listed in this section are referenced throughout the PWS specifications.

No. Title DATE

DoDI 8500.01 Cybersecurity, found at http://www.esd.whs.mil

14 Mar 2014

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), found at http://www.esd.whs.mil

12 Mar 2014, Incorporating Change 2, 28 Jul 2017

DoD 8570.01-M Information Assurance Workforce Improvement Program, found at http://www.esd.whs.mil

December 19, 2005, Incorporating Change 4, 10 Nov 2015

AR 25-2 Information Assurance, found at https://armypubs.army.mil

24 October 2007, Incorporating Rapid Action Revision (RAR) Issued 23 Mar 2009

2.2.2. Supplements, amendments, and new additions to publications may be issued during the term of resultant contract. New publications issued during the term of the contract which contain requirements that result in increased costs to the government shall not be implemented without prior approval of the Contracting Officer through the COR. The contractor shall post and keep up to date all publications.

2.2.3. Contractor shall comply with all the applicable regulations, publications, manuals, local policies, and procedures listed in the table above.

PART 3 DELIVERABLES/TASKS

3. Specific Deliverables: Contractor shall provide the following support for CDTF:

3.1. Contractor shall provide Security Engineering assistance with configuring IT Systems to achieve compliance with all applicable Cybersecurity requirements:

3.1.1. Serve as the System Administrator for the base operating systems. The SA will be responsible to setup, upgrade (version changes or patches), and configure Microsoft and Linux commercial of the shelf (COTS) workstation and server operating systems, as well as commercial application software (e.g., Microsoft Office, JAVA, Mozilla Firefox, etc.…) and any Army developed computer software that the CDTF requires to help facilitate training. The SA will also identify any IT deficiencies within the CDTF and recommend changes to the SO. Develop and implement all appropriate controls.

3.1.2. Serve as the site administrator for the Army Portfolio Management Solution (APMS). Responsibilities include attending weekly meetings with TRADOC, maintaining registered systems for data accuracy, registering any new systems, and responding to all taskers assigned.

3.1.3. Analyze the existing systems and provide the System Owner a report of the work that is needed to bring them into and maintain compliance with applicable Cybersecurity requirements. Analysis will consist of automated scans using approved DoD tools such as Assured Compliance Assessment Solution (ACAS) and Security Content Automation Protocol (SCAP) Compliance Checker (SCC) as well as manual reviews of STIG checklists to identify deviations. Report shall be prepared in a generally accepted business format, Microsoft Word® or Microsoft PowerPoint®, and submitted electronically to the System Owner and COR.

3.1.4. Apply required system updates and configuration changes after approval by/in conjunction with the System Owner. Ensure that any remaining deviations are properly documented and explained to the System Owner.

3.1.5. Assist the System Owner with RMF Self-Assessments of the identified accreditation enclaves.

3.1.6. Update or develop Cybersecurity documentation and artifacts for the identified enclaves. Any existing Cybersecurity documentation and artifacts will be in eMASS.

3.1.7. Update implementation plan within eMASS for each control assigned to the systems.

3.1.8. Create or update the risk assessment within eMASS for each non-compliant finding.

3.1.9. Upload ACAS scans with both ASR/ARF files extensions into eMASS under the asset tab.

3.1.10. Create or update the System Owner’s RMF Plan of Actions & Milestones within eMASS.

3.2. Kick Off Meeting: Contractor shall attend via teleconference a kick-off meeting with Government to discuss the scope of work and receive GFI. The meeting date shall occur not later than 15 days after Contract award and shall be scheduled by the COR. Contractor shall provide minutes of this meeting within 5 (five) calendar days of the date of the meeting. Minutes shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR.

3.3. Monthly Status Reports: Contractor shall provide a status report no later than 3 (three) calendar days following the final day of the month. This status report shall capture workload completed, workload in progress and any outstanding issues that need to be resolved. Reports shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR. In-Progress Review (IPR).

3.4. Quarterly IPRs: Contractor shall attend via teleconference IPRs with the COR. The meeting dates shall be scheduled to occur within the first 5 (five) calendar days of each quarter. Contractor shall provide minutes of each meeting within 5 (five) calendar days of the date of the meeting. Minutes shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR.

3.5. Final Report Summary: Contractor shall submit a final report summary of activities performed by Contractor in support of this Contract to the COR. It shall include a summary of all deliverables completed. The Final Report Summary shall be due on the last day of period of performance. Report shall be completed in MS Word® using a generally accepted business format.

3.6. General acceptance criteria and quality measures: Contractor shall submit deliverables as set forth below to each deliverable and other work products received from Contractor under this PWS.

3.6.1. Accuracy – All deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

3.6.2. Clarity – All deliverables shall be concise and clear at every level of distribution. All diagrams shall be easy to understand and be relevant to the supporting narrative.

3.6.3. File Editing – All text and diagrammatic files shall be editable by Government.

3.6.4. Format – Deliverables shall be submitted as specified in the PWS.

3.6.5. Timeliness – Deliverables shall be submitted on or before the due date specified in this PWS.

TECHNICAL EXHIBIT 1 DELIVERABLES SCHEDULE

DELIVERABLE

DATE DUE OR

FREQUENCY

SECTION

KICK OFF MEETING NLT 15 DAYS AFTER

CONTRACT AWARD

3.2

MONTHLY STATUS REPORTS NLT 3 CALENDAR DAYS

AFTER FINAL DAY OF MONTH

3.3

QUARTERLY IPRS NLT 5 CALENDAR DAYS

AFTER START OF QUARTER

3.4

DELIVERABLE

DATE DUE OR

FREQUENCY

SECTION

TASK 1 NLT 30 DAYS AFTER

CONTRACT AWARD 3.1

FINAL REPORT SUMMARY NLT LAST DAY OF PERIOD OF

PERFORMANCE 3.5

3.7. Travel: N/A

PART 4 ADMINSTRATIVE TASKS

4. Administrative Tasks: The below tasks will outline the administrative functions the Contractor will need to follow.

4.1. Qualifications/Licenses: Contractor personnel with administrator rights / elevated privileges to systems shall be Information Assurance (IA) Technical level 2 or IA Management level 1 certified, as a minimum, in accordance with DOD 8570.01-M. Server administrators must complete Windows Server 2016 certification or the equivalent software commercial certification for the operating system for the system they are administering.

4.2. Kick-Off /Periodic Progress Meetings: Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart

42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with Contractor to review Contractor's performance. At these meetings the KO will apprise Contractor of how Government views Contractor's performance and Contractor shall apprise Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to Government.

4.3. Medical Surveillance Program:

4.3.1. The Contractor shall ensure that all contractor employees performing work at CDTF and under this contract are enrolled in the Government Medical Surveillance Program IAW prior to performing duty in the CDTF compound.

4.3.2. In accordance with DA PAM 40-8 (https://armypubs.army.mil) and Dept. of the Army (ASA-IE) Interim Guidance on Occupational Health Practices for the Evaluation and Control of Occupational Exposures to Nerve Agents GB, GA, GD, GF, and VX; and Mustard Agents H, HD, and HT, 23 Jan 2013, the Contractor shall enroll all on-site (at CDTF) employees, regardless of duty position or function, into the Government Medical Surveillance Program. All occupational health services related to contract duty requirements shall be obtained from the General Leonard Wood Army Community Hospital (GLWACH) on a cost reimbursable basis.

4.3.3. Occupational Health records General Leonard Wood Army Community Hospital (GLWACH) for the Contractor under this program are Government records and will be maintained as such.

4.4. Contractor Management Reporting (CMRA): Contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) via a secure data collection site. Contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/, and then click on “Department of the Army CMRA” or the icon of the DoD organization that is receiving or benefitting from the contracted services. Reporting inputs will be for the labor executed during the POP for each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the

FY, all data shall be reported NLT October 31 of each calendar year. Contractors may direct questions to the help desk by clicking on “send an email” which is located under the Help Resources ribbon on the right side of the login page of the applicable Service/Component’s CMRA website.

4.5. Phase In/ Phase Out Period: If other than the incumbent is awarded this contract, the current incumbent will be extended for 30 days to conduct the Phase In/Phase Out Period.

4.6. Quality Control (QC): N/A

PART 5 SECURITY/ACCESS

5. Security / Access:

5.1. Required Security Clearance Requirements: Contractor personnel performing work under this contract must have a background investigation sufficient to qualify for an account on the DoD Non-classified Internet Protocol (IP) Router Network (NIPRNet) and must maintain the level of security required for the life of the contract. The security requirements are IAW the attached DD254.

5.2. Physical Security: Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

5.3. Key Control: N/A. Contractor shall not be provided government keys.

5.3.1. In the event keys, other than master keys, are lost or duplicated, Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by Government and the total cost deducted from the monthly payment due Contractor.

5.3.2. Contractor shall prohibit the use of Government issued keys/key cards by any persons other than Contractor’s employees. Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

5.3.3. Lock Combinations: N/A

5.4. Antiterrorism (AT) Level I Training:

Antiterrorism (AT) Level I Training.

1. Antiterrorism (AT) Level I Training. All contractor and sub-contractor employees requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training. IAW AR 525-13, 3 DEC 19, AT Level I Awareness training will be conducted by a certified Level II trained ATO. For contracts that cross fiscal years, or for contracts with option years, all contractor personnel shall complete annual AT Level I awareness training. The Installation AT Office or a certified Level II trained ATO on the installation will provide the training. Contact information for this Government employee will be provided at the kick-off meeting.

The Installation AT Office or a certified Level II trained ATO will provide a one-hour training session conducted on FLW for Contractor personnel working on this installation. The COR will coordinate this training at the time of task order modification or award. Contractor personnel working at installations other than FLW shall coordinate with the COR and local AT Offices to obtain training applicable to that installation.

Contractor shall provide a list of personnel trained to the COR within five (5) business days of completion of training.

2. Access and General Protection/Security Policy Procedures. FLW Automated Installation Entry (AIE) Pass Transition. The included instructions/form for requesting a Ft. Leonard Wood AIE pass supersede those previously communicated. The AIE pass form (see attached) has been revised for applicants to provide citizenship status, Foreign Nationals Alien Registration/Passport number and Country of Birth information. An electronic copy of the spreadsheet will be sent via email for your use. As with the previous version, all information must be typed;

handwritten and incomplete requests will not be processed. Once completed, submit the form to your sponsor via email or US mail.

Your sponsor will add the FPCON level, days, and times for entry and will forward it to the Visitor Control Center (VCC) for background screening and pass processing. The sponsor will send it via encrypted email to this address: usarmy.leonardwood.usag.list.des-physec-vcc@mail.milemail. VCC personnel will notify sponsors when background screenings are completed, and passes are ready for pickup. Sponsors will then notify you that your pass is ready for pick up at the VCC. You will need bring a valid picture ID and turn in Mobilisa passes, as they will no longer be authorized.

As a reminder, the Mobilisa pass application portal is no longer used. Regardless of the expiration date of an existing Mobilisa pass, ALL pass holders are required to get the new AIE pass. Person(s) that do not submit for the new AIE pass may experience delays entering FLW.

If a retiree, or DOD ID card holder, wishes to gain employment on the installation as a contractor, then that person’s “status” will change to a contract employee, which triggers the requirement for an employment background check and an NCIC-III check for access to the installation.

3. iWatch Training. Within 10 calendar days of contract award and within 10 calendar days of new Contractor employees commencing work on this contract, all Contractor and sub-contractor employees shall review the FLW Directorate of Emergency Services (DES) web link for iWatch training located at http://www.wood.army.mil/LEC/iWatch/iWatch.htm. This locally developed training will inform employees of the types of behavior to watch for and how to report suspicious activity. Suspicious activity shall be reported to the COR or KO.

5.6. Information Assurance (IA) Awareness Training for Contractors Requiring Access to Information Systems: All Contractor and sub-contractor personnel requiring network access to Government information systems shall successfully complete DoD Cyber Awareness Challenge training available at https://ia.signal.army.mil/ or other designated location prior to accessing systems and annually thereafter. Training certificates shall be provided to the COR immediately upon completion. Contractor employees shall register in the Army Training Certification Tracking System (ATCTS) prior to commencement of work and shall sign the acceptable use policy IAW AR 25-2, Para. 3-3. The COR or KO will coordinate with the requiring activity Information Assurance Support Officer to input the DoD Cyber Awareness Challenge Training certificate and training information into the ATCTS and verify compliance.

5.7. Information Assurance/Information Technology (IT) Support Functions Certification: (If applicable) Contractor and subcontractor personnel performing IT functions shall successfully complete IA training and certification for their assigned IA Technical or IA Management level IAW AR 25-2, Para 4-3, DoD 8570.01-M and DoDD 8570.01.

DFAR Clause 252.239-7001 Information Assurance Contractor Training and Certification: (JAN 2008) (a) Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01–M, Information Assurance Workforce Improvement Program. Contractor shall meet the applicable information assurance certification requirements, including— (1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and (2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01–M. (b) Upon request by Government, Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. (c) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

5.7.1. All contractor employees and associated subcontractor employees must complete the DoD IA Awareness training (available at https://ia.signal.army.mil or other designated location) before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2. Certificates of completion for each affected contractor employee shall be submitted to the COR (or KO if no COR is appointed) within 30 calendar days after completion of training.

5.8. OPSEC (Operations Security) Plan and User Agreement: The OPSEC Plan and User Agreement will be available for Contractors to review at the Contracting Office located in Building 11400, FLW, MO, from the hours of 0730 to 1600. The COR will ensure Contractor is aware of the Installation’s OPSEC Plan and is compliant with the Installation’s OPSEC Plan during contract performance.

5.9. OPSEC Training: Pursuant to AR 530-1, all Contractor personnel must complete initial Level I OPSEC training within 30 calendar days beginning performance on this contract. For contracts that cross fiscal years, or for contracts with option years, all contractor personnel shall complete annual OPSEC awareness training. The MSCoE OPSEC Officer will provide training. Contact information for this Government employee will be provided at the kick-off meeting.

5.9.1. The MSCoE OPSEC Officer will provide a one-hour training session conducted on FLW for Contractor personnel working on this installation. The COR will coordinate this training at the time of award.

5.9.2. Contractor shall provide a list of personnel trained to the COR within five (5) calendar days of completion of training.

5.9.3. Contractor personnel working at installations other than FLW shall coordinate with the COR and local OPSEC Offices to obtain training applicable to that installation.

5.10. Accompany Forces: N/A

5.11. Performance or delivery in a foreign country: N/A

5.12. Contractor access to the FLW Local Area Network (LAN): Contractor personnel shall obtain Common Access Cards (CAC), be registered in the Army Training Certification Tracking System (ATCTS) by a Government representative, and complete Information Assurance (IA) Training before being permitted to access the FLW LAN.

For contracts crossing fiscal years, or those awarded with option periods, IA training shall be accomplished annually for all Contractor personnel. Access to the LAN is required to review key instruction materials necessary for performance of work. Contractor personnel shall not connect personal devices or Contractor / commercially provided equipment to the FLW network without first receiving written permission from the FLW Network Enterprise Center (NEC). Devices, such as desktop or laptop computers which are Contractor furnished, must be loaded with operating system and application software to standards defined by the FLW NEC prior to connection.

The NEC must install and configure such devices prior to being operated on the network. All devices connected to the network will be managed under strict Information Assurance standards as prescribed by Army Regulation (AR) 25-2. The NEC retains sole administrator authority over devices connected to the network. Access to network resources is granted on a least-needed basis, therefore only minimal services will be provided to Contractor personnel unless explicitly granted through this PWS. Common services include physical connectivity, user-id and use of shared services related to work (printers, shared files, and public folders). Limited Internet access may be provided based on specific tasks identified in this PWS which indicates communication with Internet based hosts is a requirement to successfully execute the Contract. Contractor is subject to all access policies, particularly the Acceptable Use Agreement and AR 25-2. Contractor shall not load any software or make any changes to computer configurations. All requests for changes or problem reports must be submitted to the NEC through the work order process. Department of Defense (DoD) computer systems, including Contractor furnished devices connected to the

FLW LAN, may be monitored for all lawful purposes. Contractor’s use of the DoD computer systems, authorized or unauthorized, constitutes consent to monitoring.

5.13. Contractor Access and Use of FLW Telephones and Telephone Services: Telephones and telephone basic service, including local and long distance, shall only be used for official Government purposes. Contractor is subject to AR 25-2 which established policies on telephone and Automated Information System use. Contractor shall not move, unplug, or alter any telephone or voice device. Unique devices, such as speaker phones, cordless or conference phones, shall be requested through a Government Telephone Control Officer (TCO) work order at the expense of Contractor. All requests for changes or problem reports must be submitted to the NEC through the unit TCO who will be identified at the kick-off meeting. DoD telephones may be monitored for all lawful purposes.

Contractor’s use of the DoD telephones, authorized or unauthorized, constitutes consent to monitoring.

5.14. For contractors requiring CAC. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

5.15. Trusted Associate Sponsorship System (TASS): Contractor User Guide and other information see http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/

5.15.1. Contractor must obtain a CAC for those Contractor employees whose functions require access to systems or facilities controlled by the CAC.

5.15.2. Contractor Representative shall notify TASS Trusted Agent (TA) (the TA is the COR) of new employee CAC requirements. Company Representative shall provide all personnel data required to process TASS application with the TA, including security investigation requirements.

5.15.3. Contractor employee(s) shall obtain their CAC at defense enrollment eligibility reporting system (DEERS) / real-time automated personnel identification system (RAPIDS) terminals when application is approved.

5.15.4. Contractor employee(s) shall inform Corporate Facility Security Officer (FSO)/Security Manager of approval/denial of CAC application and shall return CAC to Corporate FSO upon departure or dismissal. Contractor shall be responsible for implementation and follow-up of this requirement.

5.15.5. Failure, inability, or delay in obtaining the CAC does not relieve Contractor from performing under the terms of this Contract.

5.15.6. Contractor shall ensure all CACs issues to Contractor personnel are returned to the COR upon termination or completion of this Contract.

5.16. Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander, installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Directorate of Emergency Services or Security Office. The requesting contractor shall submit their request for an installation pass to their sponsor using the following link:

https://vcc1.icmvcc.com/im3500/. A valid sponsor may be either the COR, COTR, or KO if neither is appointed.

Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the

Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

SECTION G - CONTRACT ADMINISTRATION DATA

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232- 7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

N/A

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

INVOICE 2IN1

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF “combo” document type to create some combinations of invoice and receiving report in one step.]

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC HQ0490

Issue By DoDAAC W911S7

Admin DoDAAC** W911S7

Inspect By DoDAAC ____

Ship To Code ____

Ship From Code ____

Mark For Code ____

Service Approver (DoDAAC) W588N0

Service Acceptor (DoDAAC) W588N0

Accept at Other DoDAAC ____

LPO DoDAAC ____

DCAA Auditor DoDAAC ____

Other DoDAAC(s) ____

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

GOVERNMENT REPRESENTATIVE: thomas.f.cavalier.civ@army.mil and alfreda.m.dupont.civ@army.mil

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

INSTRUCTIONS FOR OFFERORS

SECTION L ADDENDUM

1. INSTRUCTIONS FOR OFFERORS:

1.1 Questions regarding this Request For Proposal (RFP) shall be submitted in writing via the Contracting Officer (KO) or the Contracting Specialist on or before 20 July 2023 at 12:00pm CT.

1.2 Offerors are notified that the Government will not reimburse costs incurred for proposal preparation, to include pre-award site visits.

1.3 The evaluation and discussion procedures for this procurement is being conducted under Federal Acquisition Regulation (FAR) Part 12, “Acquisition of Commercial Items” which takes precedence over FAR Part 15 “Contracting by Negotiation” procedures as delineated in FAR 15.3, Source Selection. The Government will conduct evaluations using the lowest price technically acceptable approach and will follow the evaluation criteria set forth in Section 5, Evaluation Criteria, considering solely the Offeror’s response to this RFP. Noncompliance with the RFP requirements may hamper the Government’s ability to properly evaluate the proposal and may result in elimination of the proposal from further consideration for contract award.

1.4 Although the Government does not intend to hold discussions/communications, the Government does reserve the right to hold discussions/communications, and negotiate with one or more but not necessarily all Offerors, for any reason. Any proposal revisions will be limited to the items negotiated.

1.5 The Offeror shall submit an unclassified proposal that demonstrates its ability to perform and meet the requirements in the Performance Work Statement (PWS).

1.6 Proposals shall conform to all the requirements of this RFP. Failure to conform may result in your proposal being rejected and no longer considered for award.

1.7 As the value of this contract is expected to exceed $250,000.00, your firm shall be in compliance with the Equal Employment Opportunity (EEO) regulations before award of the resultant contract. Ensure your firm is on the Department of Labor (DOL) EEO National Pre- Award Registry or that you can provide verification of EEO compliance if requested by the Government. See https://www.dol.gov/agencies/ofccp/pre-award/registry for more information.

This registry is updated every two years and it does not provide information on the Parent Organization or other facility locations that have not been reviewed.

1.8 For labor categories that are non-exempt under this contract, calculate price using the wage determination for the specific location the individual will be assigned. Go to https://www.sam.gov/ to locate the applicable wage determination. All proposals submitted in response to this solicitation shall reflect the use of current, updated fringe benefit rates. The Contractor’s wage rate shall comply with the DOL wage rate minimum requirements for the area in which the work is to be done. The Contractor shall specify the city, state, and country in which the work will take place. This is necessary so that the appropriate DOL rates can be provided.

1.9 Offerors are not authorized to include citations for, or linkages to, websites in the proposal. The length of your response to this RFP is limited, as identified below. Take extreme care and attention to ensure that all required documents are included in the PROPOSAL.

Information submitted beyond the page limitations, identified below, will not be evaluated and may be considered cause for rejection of your PROPOSAL. The PROPOSAL shall be organized as stated in the Table below.

Table 1: IT Contract Proposal Format

Volume Tab Section Page Limit Title File

Format Volume I. General Information

A *NTE 8 Word or

PDF

A1 Company’s Cover Page Word or

PDF

A2 Exceptions/Assumptions Word or

PDF

A3 Offeror’s General Information Word or

PDF

A4 Unlimited Fill-in Clauses Word or

PDF

Volume II Factor 1:

Management Approach

B *NTE 30 Word or

PDF

Element 1 B1 *NTE 10 Management Approach Narrative

Word or

Element 2 B2 *NTE 20 Staffing Plan Word or

Volume III Factor 2:

Technical Approach

C *NTE 60 Word or

PDF

Element 1 C1 *NTE 30 Technical Approach Narrative Word or

PDF

C2 *NTE 10 Technical Executive Summary Word or

PDF

Word of

1.10 By responding to this RFP, the Offeror agrees to meet all the requirements incorporated herein, including those listed in Section J of this solicitation, PWS and agrees to all terms, conditions, and provisions.

2. PROPOSAL CONTENT:

2.1 Volume I, General Information. The General Information Volume shall contain the identified information detailed below and shall not exceed eight (8) pages.

TAB A1: Company’s Cover Page. The Offeror shall provide a company’s cover page.

Company cover page shall include Solicitation number, Company name, Company address, Point of Contact information, Cage Code and System of Awards (SAM) Unique

Element 2 C3 *NTE 20 Transition Plan Word or

PDF

Element 3 REMOVED

Volume IV Factor 3:

Past Performance

D *NTE 10

CPARS/PPQ’s submission up to 3 with unlimited page count.

Past Performance Questionnaire Attachment 1

Word or

Volume V.

Factor 4: Price

E1 Fill in Excel document provided

CLIN Structure Attachment 2 Excel

E2 Fill in Excel document provided

Pricing Notes Excel

E3 Fill in Excel document provided

Service Contract Labor Standards (SCLS) Labor Rates

Excel

E4 Fill in Excel document provided

Labor Categories, Hours and Rates Excel

*NTE- Not to Exceed

Entity Identification (UEI) number.

TAB A2: Exceptions/Assumptions (if required). The Offeror shall identify and provide an explanation of any exceptions or deviations. Additionally, any assumptions used in the proposal preparation must be identified.

TAB A3: Offeror’s General Information. The Offeror shall provide the name, title and telephone number of the company/division point of contact regarding decisions made with respect to Offeror’s proposal and who can obligate your company contractually.

Also, identify those individuals authorized to negotiate with the Government. The Offeror shall provide acknowledgement of all amendments (if applicable.)

TAB A4: Clauses. The Offeror shall include fill-in clauses identified in section I of this solicitation.

2.2 Volume II: Management Approach (Factor 1) TAB B: The Management Approach shall describe and demonstrate the Offeror’s complete understanding of the personnel requirements of the PWS, as well as the ability to provide the personnel in order to fulfill experience and qualification requirements necessary to perform and manage all tasks as described in the PWS. The Offeror’s Management Approach shall include the following and shall not exceed 30 pages,:

TAB B1: Management Approach Narrative (Element 1): The Management Approach Narrative shall address the Offeror’s approach to plan, execute, and manage the PWS requirements. The Offeror’s Management Approach Narrative shall not exceed 10 pages.

TAB B2: Staffing Plan (Element 2): Staffing plan shall address the Offeror’s approach to recruiting, hiring, management of personnel and retaining personnel in order to perform in accordance with the PWS requirements. The Offeror’s Staffing Plan shall include the following and shall not exceed 20 Pages.

a. Staffing: The staffing plan methodology shall demonstrate the Offeror’s ability to hire, train, and retain a highly qualified stable workforce capable of performing all tasks stated in the PWS. The staffing plan methodology shall describe the procedures to, reduce personnel turn-over, and retain qualified personnel.

b. Certifications: The staffing plan shall outline the Offeror’s plan to accomplish all tasks and deliverables in the PWS identifying properly certified personnel including the required certifications that are necessary to accomplish the requirements of the PWS.

2.3 Volume III, Technical Approach. The Technical Volume shall include Factor 2, Technical Approach and include the Technical Approach Narrative, Technical Executive Summary, Transition-in plan and Quality Control Plan as described below.

2.3.1 Technical Approach (Factor 2). The Offeror shall submit their

Technical Approach with respect to the following and shall not exceed 80 pages:

2.3.1.1 The Technical Approach shall be clear, concise, and include sufficient detail for a thorough review and for substantiating the validity of stated claims. Legibility, clarity and coherence are very important. The proposal should not simply rephrase or restate the Government's requirements, but rather shall provide convincing rationale to address how the Offeror intends to meet these requirements. Statements that the Offeror understands, can, or will comply with the PWS

(including referenced publications, technical data, etc.); statements paraphrasing the PWS or parts thereof (including applicable publications, technical data, etc.); and phrases such as “standard procedures will be employed” or “well known techniques will be used,” etc. will be considered unacceptable. Offerors shall assume that the Government has no prior knowledge of their facilities and experience and will base its evaluation on the information presented in the Offeror’s proposal. Elaborate brochures or documentation, binding, detailed art work, or other embellishments are unnecessary and are not desired. The Technical Approach shall, at a minimum, be prepared in a form consistent with the PWS and Section 4, Evaluation Criteria.

2.3.1.2 The…