W9124920R0017 Solicitation Openstack.pdf

SEE ADDENDUM

(No Collect Calls)

W9124920R0017 10-Apr-2020

b. TELEPHONE NUMBER

706-791-9208

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 11 May 2020

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912499. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

SHERRILYN U. RICE

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - FORT GORDON

271 HERITAGE PARK LANE

BLDG. 35200

FT GORDON GA 30905

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W58MUV 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

U.S. ARMY CYBER SCHOOL

621 BARNES AVE

633 BARNES AVE.

BLDG. 25601

FORT GORDON GA 30905

TEL: FAX:

706-791-8651FAX:

TEL: 706-791-1800 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$30,000,000

NAICS:

541512

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W9124920R0017

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Job Labor

FFP

The Contractor shall provide all necessary management, supervision, equipment and other labor required to successfully perform non-personal services for Openstack Engineer Support in accordance with the Performance Work Statement (PWS) and other areas of the solicitation.

FOB: Destination

PSC CD: R425

NET AMT

0002 1 Job Travel

COST

Includes all Travel approved in advance by the Contracting Officer in accordance with PWS 1.6.13 – 1.6.14. Approved Travel costs shall be reimbursed in accordance with the Joint Travel Regulations, FAR 31.205-46 and shall be a Not-to-Exceed Amount of $1,000.00. Profit, G&A and handling fees are not allowable.

ESTIMATED COST

0003 1 Job Other Direct Costs

COST

ODCs IAW the PWS 1.6.14. All expenses associated with this CLIN shall be provided in writing to the Government for approval prior to execution. Costs are reimbursable up to the Not-To-Exceed (NTE) amount of $500.00 as the CLIN total amount. Profit, G&A and handling fees are not allowable.

0004 1 Each Contractor Manpower Reporting

FFP

Contractor is required to provide data on Contractor labor hours (including subcontractor labor hours) for performance of this contract IAW the PWS. The cost, if any, for providing this data shall be entered into the space provided at this CLIN. If no direct cost is associated with providing the data, enter “No Cost”.

Instructions, including the Contractor and Subcontractor User Guides, are available at http://www.ecmra.mil.

1001 1 Job OPTION Labor

FFP

The Contractor shall provide all necessary management, supervision, equipment and other labor required to successfully perform non-personal services for Openstack Engineer Support in accordance with the Performance Work Statement (PWS) and other areas of the solicitation.

1002 1 Job OPTION Travel

COST

Includes all Travel approved in advance by the Contracting Officer in accordance with PWS 1.6.13 – 1.6.14. Approved Travel costs shall be reimbursed in accordance with the Joint Travel Regulations, FAR 31.205-46 and shall be a Not-to-Exceed Amount of $1,000.00. Profit, G&A and handling fees are not allowable

1003 1 Job OPTION Other Direct Costs

COST

ODCs IAW the PWS 1.6.14. All expenses associated with this CLIN shall be provided in writing to the Government for approval prior to execution. Costs are reimbursable up to the Not-To-Exceed (NTE) amount of $500.00 as the CLIN total amount. Profit, G&A and handling fees are not allowable.

1004 1 Each OPTION Contractor Manpower Reporting

FFP

Contractor is required to provide data on Contractor labor hours (including subcontractor labor hours) for performance of this contract IAW the PWS. The cost, if any, for providing this data shall be entered into the space provided at this CLIN. If no direct cost is associated with providing the data, enter “No Cost”.

Instructions, including the Contractor and Subcontractor User Guides, are available at http://www.ecmra.mil.

2001 1 Job OPTION Labor

FFP

The Contractor shall provide all necessary management, supervision, equipment and other labor required to successfully perform non-personal services for Openstack Engineer Support in accordance with the Performance Work Statement (PWS) and other areas of the solicitation.

2002 1 Job OPTION Travel

COST

Includes all Travel approved in advance by the Contracting Officer in accordance with PWS 1.6.13 – 1.6.14. Approved Travel costs shall be reimbursed in accordance with the Joint Travel Regulations, FAR 31.205-46 and shall be a Not-to-Exceed Amount of $1,000.00. Profit, G&A and handling fees are not allowable.

2003 1 Job OPTION Other Direct Costs

COST

ODCs IAW the PWS 1.6.14. All expenses associated with this CLIN shall be provided in writing to the Government for approval prior to execution. Costs are reimbursable up to the Not-To-Exceed (NTE) amount of $500.00 as the CLIN total amount. Profit, G&A and handling fees are not allowable.

2004 1 Each OPTION Contractor Manpower Reporting

FFP

Contractor is required to provide data on Contractor labor hours (including subcontractor labor hours) for performance of this contract IAW the PWS. The cost, if any, for providing this data shall be entered into the space provided at this CLIN. If no direct cost is associated with providing the data, enter “No Cost”.

Instructions, including the Contractor and Subcontractor User Guides, are available

3001 1 Job OPTION Labor

FFP

The Contractor shall provide all necessary management, supervision, equipment and other labor required to successfully perform non-personal services for Openstack Engineer Support in accordance with the Performance Work Statement (PWS) and other areas of the solicitation.

3002 1 Job OPTION Travel

COST

Includes all Travel approved in advance by the Contracting Officer in accordance with PWS 1.6.13 – 1.6.14. Approved Travel costs shall be reimbursed in accordance with the Joint Travel Regulations, FAR 31.205-46 and shall be a Not-to-Exceed Amount of $1,000.00. Profit, G&A and handling fees are not allowable

3003 1 Job OPTION Other Direct Costs

COST

ODCs IAW the PWS 1.6.14. All expenses associated with this CLIN shall be provided in writing to the Government for approval prior to execution. Costs are reimbursable up to the Not-To-Exceed (NTE) amount of $500.00 as the CLIN total amount. Profit, G&A and handling fees are not allowable.

3004 1 Each OPTION Contractor Manpower Reporting

FFP

Contractor is required to provide data on Contractor labor hours (including subcontractor labor hours) for performance of this contract IAW the PWS. The cost, if any, for providing this data shall be entered into the space provided at this CLIN. If no direct cost is associated with providing the data, enter “No Cost”.

Instructions, including the Contractor and Subcontractor User Guides, are available

4001 1 Each OPTION Labor

FFP

The Contractor shall provide all necessary management, supervision, equipment and other labor required to successfully perform non-personal services for Openstack Engineer Support in accordance with the Performance Work Statement (PWS) and other areas of the solicitation

4002 1 Job OPTION Travel

COST

Includes all Travel approved in advance by the Contracting Officer in accordance with PWS 1.6.13 – 1.6.14. Approved Travel costs shall be reimbursed in accordance with the Joint Travel Regulations, FAR 31.205-46 and shall be a Not-to-Exceed Amount of $1,000.00. Profit, G&A and handling fees are not allowable.

4003 Job OPTION Other Direct Costs

COST

ODCs IAW the PWS 1.6.14. All expenses associated with this CLIN shall be provided in writing to the Government for approval prior to execution. Costs are reimbursable up to the Not-To-Exceed (NTE) amount of $500.00 as the CLIN total amount. Profit, G&A and handling fees are not allowable.

4004 1 Each OPTION Contractor Manpower Reporting

FFP

Contractor is required to provide data on Contractor labor hours (including subcontractor labor hours) for performance of this contract IAW the PWS. The cost, if any, for providing this data shall be entered into the space provided at this CLIN. If no direct cost is associated with providing the data, enter “No Cost”.

Instructions, including the Contractor and Subcontractor User Guides, are available

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 1001 Destination Government Destination Government 1002 Destination Government Destination Government 1003 Destination Government Destination Government

1004 Destination Government Destination Government 2001 Destination Government Destination Government 2002 Destination Government Destination Government 2003 Destination Government Destination Government 2004 Destination Government Destination Government 3001 Destination Government Destination Government 3002 Destination Government Destination Government 3003 Destination Government Destination Government 3004 Destination Government Destination Government 4001 Destination Government Destination Government 4002 Destination Government Destination Government 4003 Destination Government Destination Government 4004 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 24-MAY-2020 TO

23-MAY-2021

N/A U.S. ARMY CYBER SCHOOL

621 BARNES AVE

633 BARNES AVE.

BLDG. 25601

FORT GORDON GA 30905

W58MUV

0002 POP 24-MAY-2020 TO

23-MAY-2021

N/A (SAME AS PREVIOUS LOCATION)

0003 POP 24-MAY-2020 TO

23-MAY-2021

N/A (SAME AS PREVIOUS LOCATION)

0004 23-MAY-2021 1 (SAME AS PREVIOUS LOCATION)

1001 POP 24-MAY-2021 TO

23-MAY-2022

N/A (SAME AS PREVIOUS LOCATION)

1002 POP 24-MAY-2021 TO

N/A (SAME AS PREVIOUS LOCATION)

1003 POP 24-MAY-2021 TO

N/A (SAME AS PREVIOUS LOCATION)

1004 23-MAY-2021 1 (SAME AS PREVIOUS LOCATION)

2001 POP 24-MAY-2022 TO

23-MAY-2023

N/A (SAME AS PREVIOUS LOCATION)

2002 POP 24-MAY-2022 TO

N/A (SAME AS PREVIOUS LOCATION)

2003 POP 24-MAY-2022 TO

N/A (SAME AS PREVIOUS LOCATION)

2004 23-MAY-2023 1 (SAME AS PREVIOUS LOCATION)

3001 POP 24-MAY-2023 TO

23-MAY-2024

N/A (SAME AS PREVIOUS LOCATION)

3002 POP 24-MAY-2023 TO

N/A (SAME AS PREVIOUS LOCATION)

3003 POP 24-MAY-2023 TO

N/A (SAME AS PREVIOUS LOCATION)

3004 23-MAY-2024 1 (SAME AS PREVIOUS LOCATION)

4001 POP 24-MAY-2024 TO

23-MAY-2025

N/A (SAME AS PREVIOUS LOCATION)

4002 POP 24-MAY-2024 TO

N/A (SAME AS PREVIOUS LOCATION)

4003 POP 24-MAY-2024 TO

N/A (SAME AS PREVIOUS LOCATION)

4004 23-MAY-2025 1 (SAME AS PREVIOUS LOCATION)

PWS

PERFORMANCE WORK STATEMENT (PWS)

Cyber School OpenStack Engineer and Architect Support Contract

Part 1

General Information

1. GENERAL: This is a non-personal services contract to provide OpenStack Engineer and Architect Support for the Cyber School, Cyber Center of Excellence (CCoE), Fort Gordon, Georgia. OpenStack Engineer and Architect Support shall include support of training in classified and unclassified environments. This effort will support the Cyber School in conducting training for the Army’s new Cyber Branch. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform OpenStack Engineer and Architect Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. Contract personnel shall meet the standards outlined in established the USCYBERCOM J7/National Cryptologic Training System (NSA standards per DoDI 3305.09), and DoD Cybersecurity Workforce Framework (i.e. DoD 8570 or 8140) IAW the requirements and deliverables of this acquisition. The contractor shall perform to the standards in this contract.

1.2 Background: The Cyber School was established to provide trained 17 series personnel (17A, 17C, and 170A) that support the Army’s Cyberspace Operations across USCYBERCOM, ARCYBER, and Cyber Protection Brigade missions. Additionally, the Cyber School has the goal of providing equipment, faculty, and an environment that build Soldiers’ skills and abilities while encouraging a culture of aggressive self-development. As stated in Self Development for Cyber Warriors (Conti, Caroland, Cook, Taylor) "Aggressive self-development is a critical task for the cyber warfare professional. No matter the quality, formal training and education programs age poorly when facing the relentless advance of technology and agile adversaries. Self-development serves as a continuous complement to formal training and fosters the currency and depth of expertise a world class cyber workforce demands."

1.3 Objectives: Support the virtual training area (VTA) and secure virtual training area (SVTA) as described in technical exhibit 3 beginning in May of 2020. Support the cyberspace training operations area needs of the school by providing and maintaining a VTA production environment at both the unclassified and TS/SCI levels. Contractor personnel shall demonstrate model behavior and professionalism at all times. Support will be conducted at a clearance up to TOP SECRET//SCI.

1.4 Scope: Services include installation, configuration, maintenance, and development of the VTA/SVTA and related frameworks. The VTA/SVTA includes all on-premises VTA/SVTA equipment as well as the off-premises cloud-hosted servers involved in the support of VTA/SVTA. The contractor shall accomplish configuration, maintenance, and development tasks as the direction of the government. The Government will own all developed products (code).

1.5 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years. The Period of Performance reads as follows:

Base Year 24 May 2020 – 23 May 2021 Option Year I 24 May 2021 – 23 May 2022 Option Year II 24 May 2022 – 23 May 2023 Option Year III 24 May 2023 – 23 May 2024 Option Year IV 24 May 2024 – 23 May 2025

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The contractor shall utilize personnel who possess the knowledge, skills, abilities, and experience to support the VTA/SVTA IAW all relevant regulations, requirements, and SOPs to include USCYBERCOM J7, National Cryptologic Training System (NSA standards per DoDI 3305.09), and DoD Cybersecurity Workforce Framework (i.e. DoD 8570 or 8140) training standards as well as local Cyber School/Cyber Center of Excellence policies and procedures. The initial Quality Control Program (QCP) shall be delivered with the contractor’s proposal. After contract award, three copies of a comprehensive written QCP shall be submitted to the Contracting Officer and Contracting Officer’s Representative 30 days of start date and within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not expected to perform services on federal holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 0800 to 1700 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons.

The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. Shift work may be required. Anticipated shift schedule is as follows:

• Day Shift 0800-1700

• Swing Shift 1530-0030

• Midnight Shift 2300-0800

1.6.4.1 In the event that personnel assigned to this contract are required for early/late/weekend school retraining of students or needed for classroom observation the anticipated hours are:

• Alternate Day Shift 0630-1030 and 1500-1900

• Alternate Swing Shift 1300-1700 and 1900-2300

• Alternate Midnight Shift 2100-0100 and 0300-0700

• Weekend Shift 0600-1800 on Saturdays and Sundays

1.6.4.2 In the event personnel supporting the VTA/SVTA are required for early/late/weekend system/network maintenance the anticipated hours shall be shifted from the weekday work.

1.6.4.3 These operating hours and days may vary based on the requirements of the agency. Contractor personnel work schedules may be “flexed” to meet the training needs of the Cyber School for weekend and extended duty periods during regular training and exercises, while still adhering to the standard five-day work week. Overtime will not be authorized.

1.6.5 Place of Performance: The work to be performed under this contract will be performed at various locations within the Cyber School located on Fort Gordon, Georgia. Two (2) OpenStack Architects supporting the unclassified VTA are eligible to work remotely while still adhering to the standard forty hour work week.

Contractors may be required to travel to participate in training development conferences or attend necessary training/certification.

1.6.6 Type of Contract: The government will award a firm fixed price contract.

1.6.7 Security Requirements: Contractor personnel performing work under this contract must be U.S. citizens. Two

(2) OpenStack Engineers, one (1) Program Manager (PM) must have a final Top Secret Clearance with SCI eligibility and two (2) OpenStack Engineers must have a favorable background check (T1/NACI) at work performance start date, and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254.

1.6.7.1 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured. In some cases as determined by the contracting officer’s representative (COR) contractors shall be required to sign for government provided equipment.

1.6.7.2 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.2.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.2.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.3 Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.7.4 The contractor is responsible for acquiring the clearances. The contractor shall ensure that all assigned personnel understand applicable security policies and directives found in DOD 5220.22-M, National Industry Security Program Operating Manual (NISPOM); DODM 5200.01 (Vol 4), DOD Information Security Program – Controlled Unclassified Information; AR 380-5, Information Security Program, and all other applicable policies and regulations.

1.6.7.4.1 The contractor shall ensure that classified data is controlled, protected, and safeguarded in accordance with AR 380-5 and current Army and DOD policy. Classified information shall be accessed and stored in government spaces only. The contractor shall agree that any data furnished by the government to the contractor shall be used only for performance under this PWS, and all copies of such data shall be returned to the government upon completion of this effort.

1.6.7.4.2 The contractor Facility Security Officer (FSO) will ensure there is a procedure for all contractor employees to in-process and out-process (Cyber Center of Excellence, Nelson Hall, Rm 222). All contractors shall turn their Common Access Card (CAC) in to the COR on their last day of employment. Compliance with DD Form 254, Department of Defense Contract Security Classification Specification, is required.

1.6.7.5 Handling/Access to Classified Information: The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential," "Secret," or "Top Secret" and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M. Any adverse action preventing a contractor from retaining access to classified material must be brought to the attention of the COR, Security Division, and contractor Facility Security Officer (FSO) immediately.

1.6.7.6 SIPRNET and JWICS Access: The COR will identify contract employees that are required to have SIPRNET and/or JWICS access. Secret Internet Protocol Network (SIPRNET) and Joint Worldwide Intelligence Communications System (JWICS) access will only be as directed by the Government requirement activity and at government facilities only. Contractors requiring access to the SIPRNET must have a final Secret clearance or Interim TS clearance. Contractors requiring access to JWICS must have a final TS clearance and be indoctrinated for Sensitive Compartmented Information access. Approval by the COR is required prior to granting access.

SIPRNET/JWICS may contain NATO information and a NATO awareness brief and acknowledgement is required for all personnel prior to being granted access to the SIPRNET/JWICS. The NATO Awareness briefing is required to inform personnel how to protect NATO information in the event they come across it while accessing the SIPRNET/JWICS. A written acknowledgment shall be maintained by the COR. The contractor shall not access, download or further disseminate any classified information from SIPRNET/JWICS which is outside the execution of the defined contract requirements unless specifically authorized in writing by the Government Program Manager and the Contract Officer (KO). In the event that any special access is required, the KO must modify the requirements and DD 254.

1.6.7.7 Information Assurance (IA)/Information Technology (IT) Training: All contractor employees and associated subcontractors must complete the DoD Cyber Awareness Challenge Training (https://cs.signal.army.mil/DoDIAA) before issuance of network access and annually thereafter. Certificates of successful completion, for both initial awareness training and annual refresher training shall be provided to the COR via the Army Training and Certification Tracking System (ATCTS). All contractor employees will successfully complete all required IA training as specified in AR 25-2 and as directed by the Government. At work performance start date all contractor employees working Cyber Security functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, DoDD 8140.01, and AR 25-2.

1.6.7.7.1 Information Assurance (IA)/Information Technology (IT) Certification. Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

1.6.7.8 Information Security Program Training: All contractor employees, including subcontractors, assigned to this contract shall complete the on-line Information Security Program Training located on the Army Learning Management System (ALMS) site. Log into AKO, “Self Service”, “My Training”, “ALMS”, “Go To Mandatory Training”. Training must be completed within 30 days of reporting for duty and annually thereafter. The contractor shall submit certificate of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref ALARACT 207/2013, DTG 291848Z Aug 13, Subj: Army Wide Roll-out and Requirement for Standardized Computer Web-Based Security Training on the Army Learning Management System (ALMS)).

1.6.7.9 Anti-Terrorism (AT) Level I Training: All contractor employees, including subcontractors, assigned to this contract shall receive an initial Antiterrorism Level I Brief by a certified ATO Level II Officer within 30 days of reporting for duty (Monthly briefings will be offered by the Garrison Antiterrorism Officer). Annual refresher Antiterrorism Level I Training shall be completed on-line at https://jkodirect.jten.mil/Atlas2/faces/page/login/Login.seam or they may attend the monthly training offered by the Garrison ATO. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager (Ref Department of the Army, US Army Contracting Agency, SFCA-CO, 05 Sep 07, subject: Incorporation of Measures into the Contracting Process and AR 525-13, Antiterrorism).

1.6.7.9.1 Note: Contractor personnel shall receive an AOR briefing when traveling OCONUS on TDY. Briefing must be provided by a certified ATO Level II Officer within 7 working days prior to TDY departure outside the 50 United States, its territories, and possessions. This is separate from the normal annual AT Level I training requirement (Ref AR 525-13).

1.6.7.10 iWATCH: All contractor employees, including subcontractors, assigned to this contract shall receive a brief on the local iWATCH program (provided in conjunction with the AT Level I Training). This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 days of reporting to duty and annual refresher training with the results reported to the COR.

1.6.7.11 Operation Security (OPSEC) Training: All contractor employees, including subcontractors, assigned to this contract shall complete Level I OPSEC training within 30 days of reporting for duty and then annually thereafter.

https://cs.signal.army.mil/DoDIAA https://jkodirect.jten.mil/Atlas2/faces/page/login/Login.seam

Initial Level 1 OPSEC training will be conducted monthly by the Garrison OPSEC Officer or a Level II certified OPSEC Officer. Annual refresher training shall be completed on-line at http://cdsetrain.dtic.mil/opsec/index/htm.

The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. OPSEC training guidelines are contained in AR 530-1, Operations Security. The contractor shall adhere to local OPSEC policies and procedures of the government requiring activity. When in a TDY status in support of this work effort, the contractor shall also adhere to any OPSEC policies and procedures in effect at TDY locations.

1.6.7.12 Threat Awareness and Reporting Program (TARP) Training: All contractor employees, including subcontractors, assigned to this contract shall complete face-to-face TARP training within 30 days of reporting for duty and then annually thereafter. TARP training will be conducted monthly by the 902nd MI Group. The COR will ensure contractors are notified of available training. Completion of training shall be reported to the COR and the unit/activity security manager (Ref AR 381-12).

1.6.7.13 Installation Access: All contractor employees, including subcontractors, shall comply with applicable installation and facility access security policies and procedures at all work and TDY locations. All contractors and subcontractors will be issued a Common Access Card (CAC) or an Installation Pass issued through the Automated Installation entry (AIE) Security System to access the installation. The Fort Gordon military installation is a limited access post. Unscheduled gate closures by the military police may occur at any time. In accordance with Army Regulation 525-13, paragraph 5-19, all prospective contractors will undergo a verification process by the installation Provost Marshal Office, Director of Emergency Services to determine the trustworthiness and suitability prior to being granted access to federal property. This will be accomplished using the National Crime Information Center (NCIC) Interstate Identification Index (III). This is the minimum baseline background check for entrance onto Army Installations for non-CAC holders to include entrance of visitors (Ref AR 190-13, paragraph 8-2). All personnel entering or exiting the installation may experience a delay due to vehicle inspections, registration checks, verification of seat belt use, etc. All vehicles and personnel are subject to search and seizure. The search and seizure provisions shall apply to contractor personnel while within Fort Gordon's area of jurisdiction. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect. Security procedures may change without notice.

1.6.7.14 Common Access Card (CAC): Contractor must obtain a CAC for those employees whose functions require access to systems or facilities controlled by the Common Access Card. Contractor Representative will notify government CVS Trusted Agent (TA) of new employee CAC requirements. Company representative must provide all personnel data required to process CVS application with the TA, including security investigation requirements.

Contractor employee will obtain CAC at DEERS/RAPIDS terminal when the application is approved. Contractor employee will inform Corporate Facility Security Officer (FSO)/Security Manager of approval/denial of CAC application, and will return CAC to Corporate FSO upon departure or dismissal. Contractor is responsible for implementation and follow-up. Failure, inability, or delay in obtaining the CAC does not relieve the contractor from performing under the terms of the contract.

1.6.8 Special Qualifications: The contractor is responsible for the overall management and oversight of this contract. It is the contactor’s responsibility to staff and deploy qualified contractor personnel to meet all of the PWS requirements. The Government anticipates the requirements within this PWS will require the following labor categories: One (1) Program Manager, two (2) OpenStack Architects, (2) OpenStack Engineers (TS/SCI). The Government’s historical staffing data is provided under Technical Exhibit 3. The Contractor shall be responsible to propose and deploy the correct labor types, mix, number and hours required to satisfactorily and professionally meet all PWS requirements.

1.6.8.1. Program Manager: shall supervise, coordinate work schedules, resolve minor concerns/issues and complete the administrative tasks associated with this PWS. The PM shall be familiar with all duties and qualifications stated in the PWS.

• At contract start date possess a T5/Single Scope Background Investigation (SSBI) with SCI eligibility and maintain the required security clearance throughout the life of the contract.

• Shall have at least five (5) years management experience or equivalent on similar government contracts.

• Be proficient in conflict resolution.

http://cdsetrain.dtic.mil/opsec/index/htm

• Possess the skill sets to supervise contractor employees.

• Be capable of coordinating work schedules/assignments of contractor employees.

• Be able to communicate orally and written with COR.

1.6.8.2. OpenStack Engineer and Architect Personnel: will not be instructing but will be instrumental in enabling the instructors to facilitate learning by providing a private training environment to support training and experimentation requirements. They shall:

• Be U.S. citizens.

• Possess and maintain a valid driver’s license.

• Possess and maintain all required training as stated throughout this PWS.

• Must have at least 1 years’ experience with managing and scaling the ancillary services that are required for a successful OpenStack deployment, including but not limited to: message queues, databases, caching daemons, and key-value stores. Experience with managing and scaling the services in this context means addressing both implementing/maintaining high-availability of aforementioned ancillary service and scalability/performance of aforementioned ancillary service.

• Must have experience with deploying OpenStack services from source rather than from packages.

• Must be an active participant in the OpenStack and/or Ceph community through contributing code, filing bug reports, writing documentation, or in some other recognized capacity.

• Must have the ability to work with, train, and guide others in the installation, configuration, administration, and troubleshooting of OpenStack and Ceph.

• Must have experience in sizing, optimizing, and deploying the hardware required to run Ceph and

OpenStack.

• Must have direct experience with the neutron ml2 mechanism and have experience with deploying at least two different neutron backends (e.g. linuxbridge, ovs, midonet, networking-ovn, NSX, etc.)

• Must be willing to travel to and participate in OpenStack Summits worldwide.

• Must be familiar with DevOps business practices particularly with regards to applying the software development lifecycle to system management (github flow, CI/CD, etc.).

• Must be familiar with git as a documentation repository and saltstack, ansible, puppet, chef, or stackstorm as a system management and configuration tool. Saltstack experience is preferred, but not required.

• Must have the requisite experience in python to debug stack traces in the various OpenStack projects and assist in filing bug reports upstream if necessary.

1.6.8.2.1 OpenStack Engineer (TS/SCI) Criteria (2 ea) shall:

• At contact start date must possess a T5/Single Scope Background Investigation (SSBI) with SCI eligibility and maintain the required security clearance throughout the life of the contract.

• Must have at least 4 years’ experience with OpenStack installation, configuration, administration, and troubleshooting. Experience gained as an end-user of an OpenStack deployment (e.g. using OpenStack to accomplish things such as deploying applications, teaching classes, or performing cloud migrations) does NOT qualify as valid OpenStack experience in this context. Valid experience would include deploying OpenStack and being responsible for API functionality, scaling the deployment services themselves, troubleshooting python stack traces directly related to OpenStack core functionality that an end user would never see or interact with, and other similar tasks.

• Must have at least 2 years’ experience working large OpenStack deployments where kvm and/or qemu was used as the primary hypervisor. Large in this context is defined as a deployment that has at least 250 individual, physical compute nodes that run the nova-compute service AND a total physical core count of greater than 15,000 cores (not threads) on the aforementioned compute nodes. Core counts from other unrelated services such as storage or network devices do not qualify. In addition to physical hardware requirements, these large deployments should have consistently run more than 20,000 instances (on average) on a daily basis. Deployments that utilize OpenStack concepts such as cells, regions, and availability zones to achieve large sizes are considered valid experience as they demonstrate interaction with the best practices needed to achieve such scale. The candidate must have been directly involved in the design and implementation of these mechanisms (or their growth and modification) for the experience to qualify and cannot claim experience by mere association with the organization that used these mechanisms.

Deployments that create several small, unrelated, disconnected clouds rather than a single unified one do not qualify as valid experience for the purposes of this qualification.

• Must have at least 4 years’ experience with Ceph installation, configuration, administration, and troubleshooting. Experience gained as an end-user of a Ceph deployment (e.g. using cephfs as an end user) does not qualify as valid Ceph experience in this context. Valid experience would include deploying Ceph and being responsible for overall functionality, direct interaction with mons, and scaling mons, osds, mds’, and mgrs.

1.6.8.2.2 OpenStack Architect Criteria (2ea) shall:

• At contract start date must possess a favorable T1/National Agency Check with Inquiries (NACI) at contract start date and maintain throughout the life of the contract.

• Must have at least 6 years’ experience with OpenStack installation, configuration, administration, and troubleshooting. Experience gained as an end-user of an OpenStack deployment (e.g. using OpenStack to accomplish things such as deploying applications, teaching classes, or performing cloud migrations) does NOT qualify as valid OpenStack experience in this context. Valid experience would include deploying OpenStack and being responsible for API functionality, scaling the deployment services themselves, troubleshooting python stack traces directly related to OpenStack core functionality that an end user would never see or interact with, and other similar tasks.

• Must have at least 3 years’ experience working large OpenStack deployments where kvm and/or qemu was used as the primary hypervisor. Large in this context is defined as a deployment that has at least 250 individual, physical compute nodes that run the nova-compute service AND a total physical core count of greater than 15,000 cores (not threads) on the aforementioned compute nodes. Core counts from other unrelated services such as storage or network devices do not qualify. In addition to physical hardware requirements, these large deployments should have consistently run more than 20,000 instances (on average) on a daily basis. Deployments that utilize OpenStack concepts such as cells, regions, and availability zones to achieve large sizes are considered valid experience as they demonstrate interaction with the best practices needed to achieve such scale. The candidate must have been directly involved in the design and implementation of these mechanisms (or their growth and modification) for the experience to qualify and cannot claim experience by mere association with the organization that used these mechanisms.

Deployments that create several small, unrelated, disconnected clouds rather than a single unified one do not qualify as valid experience for the purposes of this qualification.

• Must have at least 6 years’ experience with Ceph installation, configuration, administration, and troubleshooting. Experience gained as an end-user of a Ceph deployment (e.g. using cephfs as an end user) does not qualify as valid Ceph experience in this context. Valid experience would include deploying Ceph and being responsible for overall functionality, direct interaction with mons, and scaling mons, osds, mds’, and mgrs.

1.6.8.3 The Contractor shall utilize qualified personnel to meet the requirements identified in the PWS. Contract personnel shall possess the knowledge, skills, and abilities to perform the duties listed in the PWS immediately when hired without additional train-up time.

1.6.8.4 Contractor Replacement: The contractor shall replace, within ten (10) business days, any contract personnel found to be unqualified or otherwise determined unsuitable by the government. This ten-day timeframe also includes any contract instructors who submit their resignation under the current contract.

1.6.8.5 Required certifications and/or training certificates shall be presented to the COR upon hire. Certification requirements that change during the life of the contract must be approved by the COR. Contractors will be given 60 calendar days from the start date of this contract to obtain required certificate(s) of training and certification with the exception of the clearance; only 10 business days will be allotted to rectify clearance issues. Any training provided by the Government to contractor personnel, with the exception of mandatory security training listed throughout section 1.6 of this PWS, is subject to collection of reimbursement from the contractor for the full burdened cost of training. All contract employees shall possess experience with Army-standard desktop applications and configurations, i.e., daily reporting programs, and Army Gold Master (AGM) configurations. The government will exercise the right, if deemed necessary, to select an appropriate method (pretest, hands on practical exercise, etc.) to determine if the contractor is qualified/suitable to perform the requirements stated in section 1.6.4 through 5.6.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract:

perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The following personnel are considered key personnel by the government: program manager, and openstack engineers. The contractor shall provide a program manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The program manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The program manager or alternate shall be available between 8:00 a.m. to 5:00 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

1.6.11.1. Program Manager:

• See 1.6.8.1

1.6.11.2. OpenStack Engineer (TS/SCI) Criteria (2 ea) shall:

• See 1.6.8.2.1

1.6.11.3. OpenStack Architect Criteria (2ea) shall:

• See 1.6.8.2.2

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.6.12.1 ID Badges: The contractor shall…