W911S7-23-R-0012.pdf

PDF 7 MB Posted Jul 7, 2023

Attached to: CDTF RMF Accreditation Base Plus Four (4) Option Years Federal contract opportunity
Solicitation number: W911S723R0012
Issued by: Department of the Army Materiel Command Mission and Installation Contracting Command Fort Eustis

About this file

Written by GovTribe AI · Dec 28, 2023

This solicitation seeks proposals for cybersecurity engineering assistance and embedded support services for the Chemical Defense Training Facility located at Fort Leonard Wood, Missouri. The base period of performance is one year with four one-year option periods.

Required services include evaluating Risk Management Framework security controls, scanning systems using Assured Compliance Assessment Solution and Security Content Automation Protocol tools, creating required documentation, informing system owners of required changes, and making accreditation recommendations to the Authorizing Official. The contractor must apply System Technical Implementation Guides, security updates, and maintain compliance with standards including NIST SP 800-171 and the Cybersecurity Maturity Model Certification Level. Deliverables include monthly status reports, documentation uploads to the Enterprise Mission Assurance Support Service, and Plan of Action and Milestones updates.

View the file

Other files for this federal contract opportunity

Other files attached to CDTF RMF Accreditation Base Plus Four (4) Option Years, newest first.
File	Type	Posted
W911S7-23-R-0012 Amendment 0002 28JUL23.pdf	PDF	Jul 28, 2023
W911S7-23-R-0012 Question and Responses 28JUL23.pdf	PDF	Jul 28, 2023
Attachment 2- CLIN Structure RMF Accreditation.xlsx	XLSX spreadsheet	Jul 28, 2023
Attachment 1 Performance Assessment Questionnaire W911S723R0012.pdf	PDF	Jul 28, 2023
W911S7-23-R-0012_Amendment_01 (12JUL23).pdf	PDF	Jul 12, 2023
W911S7-23-R-0012.pdf	PDF	Apr 6, 2023

On GovTribe

Work with this file on GovTribe

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

SEE ADDENDUM

(No Collect Calls)

W911S723R0012 07-Jul-2023

b. TELEPHONE NUMBER

5735960266

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 07 Aug 2023

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W911S79. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

THOMAS F. CAVALIER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - FORT LEONARD WOOD

8112 NEBRASKA AVENUE

FORT LEONARD WOOD MO 65473

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W588N0 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FORT LEONARD WOOD

W4K9 ARMY CHEM SCHOOL CBRN

292 ORDINANCE DR

FORT LEONARD WOOD MO 65473

TEL: 573-596-0682 FAX:

5735960267FAX:

TEL: 5735960266 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$37,000,000

NAICS:

541513

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF88

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W911S723R0012

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months RMF ACCREDITATION Base Year

FFP

RMF ACCREDITATION SUPPORT - Base Year Support - PWS: 3, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.2, 3.3, 3.4, 3.5. 3.6, 3.6.1, 3.6.2, 3.6.3, 3.6.4, and 3.6.5.

FOB: Destination

PSC CD: DJ01

NET AMT

0002 12 Months eMASS Registration

FFP

3.1.1 Complete eMASS registration for all systems; eMASS verification

0003 12 Months Cybersecurity

FFP

3.1.1 Report of all requirements by-system, completed Report; Award +30 Days

0004 12 Months Report of Work to Achieve Compliance

FFP

3.1.1 By-system based upon approved automated scans using approved DoD tools (ACAS, SCAP, SCC) as well as manual reviews of STIG checklists; Report;

Award +30 Days

0005 12 Months System Update/Configuration Changes

FFP

3.1.4 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

0006 12 Months RMF Self-Assessment – All Enclaves

FFP

3.1.5 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

0007 12 Months Documentation and Artifact development

FFP

3.1.6 Documented and uploaded to eMASS; eMASS verification

0008 12 Months Create POA&M – All Enclaves

FFP

3.1.10 Documented in eMASS; eMASS verification

1001 12 Months

OPTION RMF ACCREDITATION OY1

FFP

RMF ACCREDITATION SUPPORT - Option Year 1 Support - PWS: 3, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.2, 3.3, 3.4, 3.5. 3.6, 3.6.1, 3.6.2, 3.6.3, 3.6.4, and 3.6.5.

1002 12 Months OPTION eMASS Registration

FFP

3.1.1 Complete eMASS registration for all systems; eMASS verification

1003 12 Months OPTION Cybersecurity

FFP

3.1.1 Report of all requirements by-system, completed Report; Award +30 Days

1004 12 Months OPTION Report of Work to Achieve Compliance

FFP

3.1.1 By-system based upon approved automated scans using approved DoD tools (ACAS, SCAP, SCC) as well as manual reviews of STIG checklists; Report;

Award +30 Days

1005 12 Months OPTION System Update/Configuration Changes

FFP

3.1.4 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

1006 12 Months OPTION RMF Self-Assessment – All Enclaves

FFP

3.1.5 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

1007 12 Months OPTION Documentation and Artifact development

FFP

3.1.6 Documented and uploaded to eMASS; eMASS verification

1008 12 Months OPTION Create POA&M – All Enclaves

FFP

3.1.10 Documented in eMASS; eMASS verification

2001 12 Months

OPTION RMF ACCREDITATION OY2

FFP

RMF ACCREDITATION SUPPORT - Option Year 2 Support - PWS: 3, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.2, 3.3, 3.4, 3.5. 3.6, 3.6.1, 3.6.2, 3.6.3, 3.6.4, and 3.6.5.

2002 12 Months OPTION eMASS Registration

FFP

3.1.1 Complete eMASS registration for all systems; eMASS verification

2003 12 Months OPTION Cybersecurity

FFP

Report of all requirements by-system, completed Report; Award +30 Days

2004 12 Months OPTION Report of Work to Achieve Compliance

FFP

3.1.1 By-system based upon approved automated scans using approved DoD tools (ACAS, SCAP, SCC) as well as manual reviews of STIG checklists; Report;

Award +30 Days

2005 12 Months OPTION System Update/Configuration Changes

FFP

3.1.4 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

2006 12 Months OPTION RMF Self-Assessment – All Enclaves

FFP

3.1.5 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

2007 12 Months OPTION Documentation and Artifact development

FFP

Documented and uploaded to eMASS; eMASS verification

2008 12 Months OPTION Create POA&M – All Enclaves

FFP

3.1.10 Documented in eMASS; eMASS verification

3001 12 Months

OPTION RMF ACCREDITATION OY3

FFP

RMF ACCREDITATION SUPPORT - Option Year 3 Support - PWS: 3, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.2, 3.3, 3.4, 3.5. 3.6, 3.6.1, 3.6.2, 3.6.3, 3.6.4, and 3.6.5.

3002 12 Months OPTION eMASS Registration

FFP

3.1.1 Complete eMASS registration for all systems; eMASS verification

3003 12 Months OPTION Identify Cybersecurity

FFP

3.1.1 Report of all requirements by-system, completed Report; Award +30 Days

3004 12 Months OPTION Report of Work to Achieve Compliance

FFP

3.1.1 By-system based upon approved automated scans using approved DoD tools (ACAS, SCAP, SCC) as well as manual reviews of STIG checklists; Report;

Award +30 Days

3005 12 Months OPTION System Update/Configuration Changes

FFP

3.1.4 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

3006 12 Months OPTION RMF Self-Assessment – All Enclaves

FFP

3.1.5 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

3007 12 Months OPTION Documentation and Artifact development

FFP

3.1.6 Documented and uploaded to eMASS; eMASS verification

3008 12 Months OPTION Create POA&M – All Enclaves

FFP

3.1.10 Documented in eMASS; eMASS verification

4001 12 Months

OPTION RMF ACCREDITATION OY4

FFP

RMF ACCREDITATION SUPPORT - Option Year 4 Support - PWS: 3, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.2, 3.3, 3.4, 3.5. 3.6, 3.6.1, 3.6.2, 3.6.3, 3.6.4, and 3.6.5.

4002 12 Months OPTION eMASS Registration

FFP

3.1.1 Complete eMASS registration for all systems; eMASS verification

4003 12 Months OPTION Identify Cybersecurity

FFP

3.1.1 Report of all requirements by-system, completed Report; Award +30 Days

4004 12 Months OPTION Report of Work to Achieve Compliance

FFP

3.1.1 By-system based upon approved automated scans using approved DoD tools (ACAS, SCAP, SCC) as well as manual reviews of STIG checklists; Report;

Award +30 Days

4005 12 Months OPTION System Update/Configuration Changes

FFP

3.1.4 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

4006 12 Months OPTION RMF Self-Assessment – All Enclaves

FFP

3.1.5 DoDI 8500.01; 8510.01, DoD 8570.01M, AR 25-2; eMASS User Guide Sep 17; eMASS verification

4007 12 Months OPTION Documentation and Artifact development

FFP

3.1.6 Documented and uploaded to eMASS; eMASS verification

4008 12 Months OPTION Create POA&M – All Enclaves

FFP

3.1.6 Documented in eMASS; eMASS verification

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 0005 Destination Government Destination Government 0006 Destination Government Destination Government 0007 Destination Government Destination Government 0008 Destination Government Destination Government 1001 Destination Government Destination Government 1002 Destination Government Destination Government 1003 Destination Government Destination Government 1004 Destination Government Destination Government 1005 Destination Government Destination Government 1006 Destination Government Destination Government 1007 Destination Government Destination Government 1008 Destination Government Destination Government 2001 Destination Government Destination Government 2002 Destination Government Destination Government 2003 Destination Government Destination Government 2004 Destination Government Destination Government 2005 Destination Government Destination Government 2006 Destination Government Destination Government 2007 Destination Government Destination Government 2008 Destination Government Destination Government 3001 Destination Government Destination Government 3002 Destination Government Destination Government 3003 Destination Government Destination Government 3004 Destination Government Destination Government 3005 Destination Government Destination Government 3006 Destination Government Destination Government 3007 Destination Government Destination Government 3008 Destination Government Destination Government 4001 Destination Government Destination Government 4002 Destination Government Destination Government 4003 Destination Government Destination Government 4004 Destination Government Destination Government 4005 Destination Government Destination Government 4006 Destination Government Destination Government 4007 Destination Government Destination Government 4008 Destination Government Destination Government

CLAUSES INCORPORATED BY REFERENCE

52.246-4 Inspection Of Services--Fixed Price AUG 1996

Section F - Deliveries or Performance

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Cybersecurity Engineering Assistance Embedded Support

The U.S. Army CBRN Chemical Defense Training Facility

Part 1 GENERAL INFORMATION

1. General: CDTF is located at Fort Leonard Wood (FLW), Missouri, and conducts live chemical, biological, radiological, and nuclear defense (CBRN) training in a toxic Chemical agent environment for Army, Joint, and allied service members to enhance individual and collective proficiency and confidence in themselves and their equipment.

All the existing and planned systems are small and are not connected to any DoD network. Each consists of less than a half dozen computers used to monitor and/or control air monitoring sensors, alarms, closed-circuit TV (CCTV), or facility-control units (HVAC, chiller/boiler plant, filter blower systems, and lighting control). None of the systems contain classified information; all process nothing but publicly releasable information.

Contracted support required consists of evaluating RMF security controls for the systems, scanning the systems using the Assured Compliance Assessment Solution and Security Content Automation Protocol (SCAP) tools, creating required documentation, informing the system owners of changes they need to make to obtain a favorable accreditation recommendation, and making recommendations to the Authorizing Official once the risk has been mitigated to an acceptable level. The contractor(s) will be required to test and apply all appropriate System Technical Implementation Guides (STIGs), both automated and manual, and all applicable security updates to software running on the computers. Any STIG settings or software patches that render a system inoperable will be annotated on a Plan of Action & Milestones and explained to the System Owner. If a STIG setting or software patch renders the system(s) inoperable, then a risk assessment must be documented in the form of a memorandum for record requesting Authorizing Official’s approval for accepting the risk of the findings.

The existing systems are accredited as four enclaves: security, air monitoring, environmental control, and audio/video. The enclaves have been registered in the Army Portfolio Management Solution (APMS), and Enterprise Mission Assurance Support Service (eMASS) and received an ATO from the Authorizing Official.

1.1. Background: This is a non-personal services contract to provide cybersecurity engineering assistance embedded support at the Chemical Defense Training Facility (CDTF). The Department of Defense (DoD) has transitioned to the RMF process for accreditation of information systems. DoD’s RMF policy, DoD Instruction (DoDI) 8510.01 (http://www.esd.whs.mil), requires that standalone information systems be accredited.

1.2. Hours of Operation: The CDTF normal operating hours are 0600-1500 Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.3. Place of Performance: Place of performance is the Chemical Defense Training Facility 8102 FLW HWY 5, Fort Leonard Wood, MO 65473.

PART 2 ACRONYMS AND REVELANT PUBLICATIONS

2. Acronyms and Publications:

2.1. Acronyms

ACAS Assured Compliance Assessment Solution

AFARS Army Federal Acquisition Regulation Supplement AOR Area of Responsibility AR Army Regulation AT Anti-Terrorism ATCTS Army Training Certification Tracking System CAC Common Access Card CBRN Chemical, Biological, Radiological and Nuclear CCTV Closed Circuit Television CDTF Chemical Defense Training Facility CFR Code of Federal Regulations CLIN Cost Contract Line-Item Number CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense DODI Department of Defense Instruction eMASS Enterprise Mission Assurance Support Service FAR Federal Acquisition Regulation FLW Fort Leonard Wood FTR Federal Travel Regulation GFI Government Furnished Information GFP Government Furnished Property HQDA Headquarters Department of the Army HVAC Heating, Ventilation, and Air Conditioning IA Information Assurance IAW In Accordance With IT Information Technology IPR In Progress Review iRAPT Invoicing Receipt, Acceptance and Property Transfer KO Contracting Officer LAN Local Area Network MICC Mission Installation Contracting Command MSCOE Maneuver Support Center of Excellence NEC Network Enterprise Center NIPRNet DoD Non-classified Internet Protocol (IP) Router Network NLT No Later Than OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) OPSEC Operations Security PIPO Phase In/Phase Out POC Point of Contact POP Period of Performance PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RMF Risk Management Framework SCAP Security Content Automation Protocol SCC SCAP Compliance Checker

SME Subject Matter Expert STIG System Technical Implementation Guide TE Technical Exhibit TCO Telephone Control Officer TRADOC U.S. Army Training and Doctrine Command

2.2. Applicable Publications (Current Editions)

2.2.1. Policy documents listed in this section are referenced throughout the PWS specifications.

No. Title DATE

DoDI 8500.01 Cybersecurity, found at http://www.esd.whs.mil

14 Mar 2014

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), found at http://www.esd.whs.mil

12 Mar 2014, Incorporating Change 2, 28 Jul 2017

DoD 8570.01-M Information Assurance Workforce Improvement Program, found at http://www.esd.whs.mil

December 19, 2005, Incorporating Change 4, 10 Nov 2015

AR 25-2 Information Assurance, found at https://armypubs.army.mil

24 October 2007, Incorporating Rapid Action Revision (RAR) Issued 23 Mar 2009

2.2.2. Supplements, amendments, and new additions to publications may be issued during the term of resultant contract. New publications issued during the term of the contract which contain requirements that result in increased costs to the government shall not be implemented without prior approval of the Contracting Officer through the COR. The contractor shall post and keep up to date all publications.

2.2.3. Contractor shall comply with all the applicable regulations, publications, manuals, local policies, and procedures listed in the table above.

PART 3 DELIVERABLES/TASKS

3. Specific Deliverables: Contractor shall provide the following support for CDTF:

3.1. Contractor shall provide Security Engineering assistance with configuring IT Systems to achieve compliance with all applicable Cybersecurity requirements:

3.1.1. Serve as the System Administrator for the base operating systems. The SA will be responsible to setup, upgrade (version changes or patches), and configure Microsoft and Linux commercial of the shelf (COTS) workstation and server operating systems, as well as commercial application software (e.g., Microsoft Office, JAVA, Mozilla Firefox, etc.…) and any Army developed computer software that the CDTF requires to help facilitate training. The SA will also identify any IT deficiencies within the CDTF and recommend changes to the SO. Develop and implement all appropriate controls.

3.1.2. Serve as the site administrator for the Army Portfolio Management Solution (APMS). Responsibilities include attending weekly meetings with TRADOC, maintaining registered systems for data accuracy, registering any new systems, and responding to all taskers assigned.

3.1.3. Analyze the existing systems and provide the System Owner a report of the work that is needed to bring them into and maintain compliance with applicable Cybersecurity requirements. Analysis will consist of automated scans using approved DoD tools such as Assured Compliance Assessment Solution (ACAS) and Security Content Automation Protocol (SCAP) Compliance Checker (SCC) as well as manual reviews of STIG checklists to identify deviations. Report shall be prepared in a generally accepted business format, Microsoft Word® or Microsoft PowerPoint®, and submitted electronically to the System Owner and COR.

3.1.4. Apply required system updates and configuration changes after approval by/in conjunction with the System Owner. Ensure that any remaining deviations are properly documented and explained to the System Owner.

3.1.5. Assist the System Owner with RMF Self-Assessments of the identified accreditation enclaves.

3.1.6. Update or develop Cybersecurity documentation and artifacts for the identified enclaves. Any existing Cybersecurity documentation and artifacts will be in eMASS.

3.1.7. Update implementation plan within eMASS for each control assigned to the systems.

3.1.8. Create or update the risk assessment within eMASS for each non-compliant finding.

3.1.9. Upload ACAS scans with both ASR/ARF files extensions into eMASS under the asset tab.

3.1.10. Create or update the System Owner’s RMF Plan of Actions & Milestones within eMASS.

3.2. Kick Off Meeting: Contractor shall attend via teleconference a kick-off meeting with Government to discuss the scope of work and receive GFI. The meeting date shall occur not later than 15 days after Contract award and shall be scheduled by the COR. Contractor shall provide minutes of this meeting within 5 (five) calendar days of the date of the meeting. Minutes shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR.

3.3. Monthly Status Reports: Contractor shall provide a status report no later than 3 (three) calendar days following the final day of the month. This status report shall capture workload completed, workload in progress and any outstanding issues that need to be resolved. Reports shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR. In-Progress Review (IPR).

3.4. Quarterly IPRs: Contractor shall attend via teleconference IPRs with the COR. The meeting dates shall be scheduled to occur within the first 5 (five) calendar days of each quarter. Contractor shall provide minutes of each meeting within 5 (five) calendar days of the date of the meeting. Minutes shall be prepared in a generally accepted business format, Microsoft Word®, and submitted electronically to the COR.

3.5. Final Report Summary: Contractor shall submit a final report summary of activities performed by Contractor in support of this Contract to the COR. It shall include a summary of all deliverables completed. The Final Report Summary shall be due on the last day of period of performance. Report shall be completed in MS Word® using a generally accepted business format.

3.6. General acceptance criteria and quality measures: Contractor shall submit deliverables as set forth below to each deliverable and other work products received from Contractor under this PWS.

3.6.1. Accuracy – All deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

3.6.2. Clarity – All deliverables shall be concise and clear at every level of distribution. All diagrams shall be easy to understand and be relevant to the supporting narrative.

3.6.3. File Editing – All text and diagrammatic files shall be editable by Government.

3.6.4. Format – Deliverables shall be submitted as specified in the PWS.

3.6.5. Timeliness – Deliverables shall be submitted on or before the due date specified in this PWS.

TECHNICAL EXHIBIT 1 DELIVERABLES SCHEDULE

DELIVERABLE DATE DUE OR

FREQUENCY

SECTION

KICK OFF MEETING NLT 15 DAYS AFTER

CONTRACT AWARD

3.2

MONTHLY STATUS REPORTS NLT 3 CALENDAR DAYS

AFTER FINAL DAY OF MONTH

3.3

QUARTERLY IPRS NLT 5 CALENDAR DAYS

AFTER START OF QUARTER

3.4

TASK 1 NLT 30 DAYS AFTER

CONTRACT AWARD 3.1

FINAL REPORT SUMMARY NLT LAST DAY OF PERIOD OF

PERFORMANCE 3.5

3.7. Travel: N/A

PART 4 ADMINSTRATIVE TASKS

4. Administrative Tasks: The below tasks will outline the administrative functions the Contractor will need to follow.

4.1. Qualifications/Licenses: Contractor personnel with administrator rights / elevated privileges to systems shall be Information Assurance (IA) Technical level 2 or IA Management level 1 certified, as a minimum, in accordance with DOD 8570.01-M. Server administrators must complete Windows Server 2016 certification or the equivalent software commercial certification for the operating system for the system they are administering.

4.2. Kick-Off /Periodic Progress Meetings: Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart

42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with Contractor to review Contractor's performance. At these meetings the KO will apprise Contractor of how Government views Contractor's performance and Contractor shall apprise Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to Government.

4.3. Medical Surveillance Program:

4.3.1. The Contractor shall ensure that all contractor employees performing work at CDTF and under this contract are enrolled in the Government Medical Surveillance Program IAW prior to performing duty in the CDTF compound.

4.3.2. In accordance with DA PAM 40-8 (https://armypubs.army.mil) and Dept. of the Army (ASA-IE) Interim Guidance on Occupational Health Practices for the Evaluation and Control of Occupational Exposures to Nerve Agents GB, GA, GD, GF, and VX; and Mustard Agents H, HD, and HT, 23 Jan 2013, the Contractor shall enroll all on-site (at CDTF) employees, regardless of duty position or function, into the Government Medical Surveillance Program. All occupational health services related to contract duty requirements shall be obtained from the General Leonard Wood Army Community Hospital (GLWACH) on a cost reimbursable basis.

4.3.3. Occupational Health records General Leonard Wood Army Community Hospital (GLWACH) for the Contractor under this program are Government records and will be maintained as such.

4.4. Contractor Management Reporting (CMRA): Contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) via a secure data collection site. Contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/, and then click on “Department of the Army CMRA” or the icon of the DoD organization that is receiving or benefitting from the contracted services. Reporting inputs will be for the labor executed during the POP for each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported NLT October 31 of each calendar year. Contractors may direct questions to the help desk by clicking on “send an email” which is located under the Help Resources ribbon on the right side of the login page of the applicable Service/Component’s CMRA website.

4.5. Phase In/ Phase Out Period: N/A

4.6. Quality Control (QC): N/A

PART 5 SECURITY/ACCESS

5. Security / Access:

5.1. Required Security Clearance Requirements: Contractor personnel performing work under this contract must have a background investigation sufficient to qualify for an account on the DoD Non-classified Internet Protocol (IP) Router Network (NIPRNet) and must maintain the level of security required for the life of the contract. The security requirements are IAW the attached DD254.

5.2. Physical Security: Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

5.3. Key Control: N/A. Contractor shall not be provided government keys.

5.3.1. In the event keys, other than master keys, are lost or duplicated, Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by Government and the total cost deducted from the monthly payment due Contractor.

5.3.2. Contractor shall prohibit the use of Government issued keys/key cards by any persons other than Contractor’s employees. Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

5.3.3. Lock Combinations: N/A

5.4. Antiterrorism (AT) Level I Training:

Antiterrorism (AT) Level I Training.

1. Antiterrorism (AT) Level I Training. All contractor and sub-contractor employees requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training. IAW AR 525-13, 3 DEC 19, AT Level I Awareness training will be conducted by a certified Level II trained ATO. For contracts that cross fiscal years, or for contracts with option years, all contractor personnel shall complete annual AT Level I awareness training. The Installation AT Office or a certified Level II trained ATO on the installation will provide the training. Contact information for this Government employee will be provided at the kick-off meeting.

The Installation AT Office or a certified Level II trained ATO will provide a one-hour training session conducted on FLW for Contractor personnel working on this installation. The COR will coordinate this training at the time of task order modification or award. Contractor personnel working at installations other than FLW shall coordinate with the COR and local AT Offices to obtain training applicable to that installation.

Contractor shall provide a list of personnel trained to the COR within five (5) business days of completion of training.

2. Access and General Protection/Security Policy Procedures. FLW Automated Installation Entry (AIE) Pass Transition. The included instructions/form for requesting a Ft. Leonard Wood AIE pass supersede those previously communicated. The AIE pass form (see attached) has been revised for applicants to provide citizenship status, Foreign Nationals Alien Registration/Passport number and Country of Birth information. An electronic copy of the spreadsheet will be sent via email for your use. As with the previous version, all information must be typed;

handwritten and incomplete requests will not be processed. Once completed, submit the form to your sponsor via email or US mail.

Your sponsor will add the FPCON level, days, and times for entry and will forward it to the Visitor Control Center (VCC) for background screening and pass processing. The sponsor will send it via encrypted email to this address: usarmy.leonardwood.usag.list.des-physec-vcc@mail.milemail. VCC personnel will notify sponsors when background screenings are completed, and passes are ready for pickup. Sponsors will then notify you that your pass is ready for pick up at the VCC. You will need bring a valid picture ID and turn in Mobilisa passes, as they will no longer be authorized.

As a reminder, the Mobilisa pass application portal is no longer used. Regardless of the expiration date of an existing Mobilisa pass, ALL pass holders are required to get the new AIE pass. Person(s) that do not submit for the new AIE pass may experience delays entering FLW.

If a retiree, or DOD ID card holder, wishes to gain employment on the installation as a contractor, then that person’s “status” will change to a contract employee, which triggers the requirement for an employment background check and an NCIC-III check for access to the installation.

3. iWatch Training. Within 10 calendar days of contract award and within 10 calendar days of new Contractor employees commencing work on this contract, all Contractor and sub-contractor employees shall review the FLW Directorate of Emergency Services (DES) web link for iWatch training located at http://www.wood.army.mil/LEC/iWatch/iWatch.htm. This locally developed training will inform employees of the types of behavior to watch for and how to report suspicious activity. Suspicious activity shall be reported to the COR or KO.

5.6. Information Assurance (IA) Awareness Training for Contractors Requiring Access to Information Systems: All Contractor and sub-contractor personnel requiring network access to Government information systems shall successfully complete DoD Cyber Awareness Challenge training available at https://ia.signal.army.mil/ or other designated location prior to accessing systems and annually thereafter. Training certificates shall be provided to the COR immediately upon completion. Contractor employees shall register in the Army Training Certification Tracking System (ATCTS) prior to commencement of work and shall sign the acceptable use policy IAW AR 25-2, Para. 3-3. The COR or KO will coordinate with the requiring activity Information Assurance Support Officer to input the DoD Cyber Awareness Challenge Training certificate and training information into the ATCTS and verify compliance.

5.7. Information Assurance/Information Technology (IT) Support Functions Certification: (If applicable) Contractor and subcontractor personnel performing IT functions shall successfully complete IA training and certification for their assigned IA Technical or IA Management level IAW AR 25-2, Para 4-3, DoD 8570.01-M and DoDD 8570.01.

DFAR Clause 252.239-7001 Information Assurance Contractor Training and Certification: (JAN 2008) (a) Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01–M, Information Assurance Workforce Improvement Program. Contractor shall meet the applicable information assurance certification requirements, including— (1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and (2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01–M. (b) Upon request by Government, Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. (c) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

5.7.1. All contractor employees and associated subcontractor employees must complete the DoD IA Awareness training (available at https://ia.signal.army.mil or other designated location) before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2. Certificates of completion for each affected contractor employee shall be submitted to the COR (or KO if no COR is appointed) within 30 calendar days after completion of training.

5.8. OPSEC (Operations Security) Plan and User Agreement: The OPSEC Plan and User Agreement will be available for Contractors to review at the Contracting Office located in Building 11400, FLW, MO, from the hours of 0730 to 1600. The COR will ensure Contractor is aware of the Installation’s OPSEC Plan and is compliant with the Installation’s OPSEC Plan during contract performance.

5.9. OPSEC Training: Pursuant to AR 530-1, all Contractor personnel must complete initial Level I OPSEC training within 30 calendar days beginning performance on this contract. For contracts that cross fiscal years, or for contracts with option years, all contractor personnel shall complete annual OPSEC awareness training. The MSCoE OPSEC Officer will provide training. Contact information for this Government employee will be provided at the kick-off meeting.

5.9.1. The MSCoE OPSEC Officer will provide a one-hour training session conducted on FLW for Contractor personnel working on this installation. The COR will coordinate this training at the time of award.

5.9.2. Contractor shall provide a list of personnel trained to the COR within five (5) calendar days of completion of training.

5.9.3. Contractor personnel working at installations other than FLW shall coordinate with the COR and local OPSEC Offices to obtain training applicable to that installation.

5.10. Accompany Forces: N/A

5.11. Performance or delivery in a foreign country: N/A

5.12. Contractor access to the FLW Local Area Network (LAN): Contractor personnel shall obtain Common Access Cards (CAC), be registered in the Army Training Certification Tracking System (ATCTS) by a Government representative, and complete Information Assurance (IA) Training before being permitted to access the FLW LAN.

For contracts crossing fiscal years, or those awarded with option periods, IA training shall be accomplished annually for all Contractor personnel. Access to the LAN is required to review key instruction materials necessary for performance of work. Contractor personnel shall not connect personal devices or Contractor / commercially provided equipment to the FLW network without first receiving written permission from the FLW Network Enterprise Center (NEC). Devices, such as desktop or laptop computers which are Contractor furnished, must be loaded with operating system and application software to standards defined by the FLW NEC prior to connection.

The NEC must install and configure such devices prior to being operated on the network. All devices connected to the network will be managed under strict Information Assurance standards as prescribed by Army Regulation (AR) 25-2. The NEC retains sole administrator authority over devices connected to the network. Access to network resources is granted on a least-needed basis, therefore only minimal services will be provided to Contractor personnel unless explicitly granted through this PWS. Common services include physical connectivity, user-id and use of shared services related to work (printers, shared files, and public folders). Limited Internet access may be provided based on specific tasks identified in this PWS which indicates communication with Internet based hosts is a requirement to successfully execute the Contract. Contractor is subject to all access policies, particularly the

Acceptable Use Agreement and AR 25-2. Contractor shall not load any software or make any changes to computer configurations. All requests for changes or problem reports must be submitted to the NEC through the work order process. Department of Defense (DoD) computer systems, including Contractor furnished devices connected to the FLW LAN, may be monitored for all lawful purposes. Contractor’s use of the DoD computer systems, authorized or unauthorized, constitutes consent to monitoring.

5.13. Contractor Access and Use of FLW Telephones and Telephone Services: Telephones and telephone basic service, including local and long distance, shall only be used for official Government purposes. Contractor is subject to AR 25-2 which established policies on telephone and Automated Information System use. Contractor shall not move, unplug, or alter any telephone or voice device. Unique devices, such as speaker phones, cordless or conference phones, shall be requested through a Government Telephone Control Officer (TCO) work order at the expense of Contractor. All requests for changes or problem reports must be submitted to the NEC through the unit TCO who will be identified at the kick-off meeting. DoD telephones may be monitored for all lawful purposes.

Contractor’s use of the DoD telephones, authorized or unauthorized, constitutes consent to monitoring.

5.14. For contractors requiring CAC. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

5.15. Trusted Associate Sponsorship System (TASS): Contractor User Guide and other information see http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/

5.15.1. Contractor must obtain a CAC for those Contractor employees whose functions require access to systems or facilities controlled by the CAC.

5.15.2. Contractor Representative shall notify TASS Trusted Agent (TA) (the TA is the COR) of new employee CAC requirements. Company Representative shall provide all personnel data required to process TASS application with the TA, including security investigation requirements.

5.15.3. Contractor employee(s) shall obtain their CAC at defense enrollment eligibility reporting system (DEERS) / real-time automated personnel identification system (RAPIDS) terminals when application is approved.

5.15.4. Contractor employee(s) shall inform Corporate Facility Security Officer (FSO)/Security Manager of approval/denial of CAC application and shall return CAC to Corporate FSO upon departure or dismissal. Contractor shall be responsible for implementation and follow-up of this requirement.

5.15.5. Failure, inability, or delay in obtaining the CAC does not relieve Contractor from performing under the terms of this Contract.

5.15.6. Contractor shall ensure all CACs issues to Contractor personnel are returned to the COR upon termination or completion of this Contract.

5.16. Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander, installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Directorate of Emergency Services or Security Office. The requesting contractor shall submit their request for an installation pass to their sponsor using the following link:

https://vcc1.icmvcc.com/im3500/. A valid sponsor may be either the COR, COTR, or KO if neither is appointed.

Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 28-SEP-2023 TO

27-SEP-2024

N/A FORT LEONARD WOOD

W4K9 ARMY CHEM SCHOOL CBRN

292 ORDINANCE DR

FORT LEONARD WOOD MO 65473

573-596-0682

W588N0

0002 POP 28-SEP-2023 TO

27-SEP-2024