Attachment 1 Performance Work Statement ICIDS_UPDATED.pdf

W9124L23R0010 Attachment 1:

Performance Work Statement

Integrated Commercial Intrusion Detection Systems (ICIDS)

Performance Work Statement

(PWS)

Performance Work

TABLE OF CONTENTS

SECTION NUMBER & TITLE

1.0 Scope of Work

1.1 Key Personnel

1.2 Standard Maintenance Service Calls

1.3 Emergency Maintenance Service Calls

1.4 Adverse Conditions Noted by the Contractor

1.5 Environmental control

1.6 Records, Files, Documents, and Work Papers

1.7 Hours of Operation

1.8 Physical Requirements and Work Environment Security

1.9 Requirements

1.10 Key Control

1.11 Environmental Control

1.12 Training

1.13 Protection

1.14 Antiterrorism

2.0 Facilities/Government Furnished Items

3.0 Safety

4.0 Quality Control/Quality Assurance

5.0 Common Access Card

6.0 Applicable Documents

7.0 Performance Requirements Summary

8.0 Deliverables Schedule

9.0 Parts & Equipment (NTE) CLINs/COSTs

Performance Work

DESCRIPTION OF SERVICES

GENERAL: This is a non-personal services contract to provide Integrated Commercial Intrusion Detection System Maintenance and Installation. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. The Contractor shall provide all necessary personnel, management, equipment, tools, materials, supervision, and other items and services, not identified as Government-Furnished, necessary to perform the installation, maintenance, adjustment, surveying, removal, repair, and replacement services, and provide systems administration (SA) for the Intrusion Detections Systems (IDS) at Fort Sill, Oklahoma. Fort Sill currently has 430 zones on the installation and anticipate < 4-5 new zones possible annually. New zones above this anticipated number shall be installed as necessary. These zones include headquarters buildings, firearm warehouses, document storage buildings, Sensitive Compartmental Information Facilities (SCIF), ammunition bunkers, in addition to several other type zones. The contractor should anticipate performing maintenance and monitoring on all zones, due to projected growth over the duration of this contract. This Non-Personal Services Contract shall encompass the following security systems:

Intrusion Detection System (IDS)/Integrated Commercial Intrusion Detection System (ICIDS). The IDS is monitored 24/7 by Fort Sill Military Police. The Contractor shall ensure the IDS remain in maximum operational status.

Scope1.0 of Work: Fort Sill utilizes ICIDS-V for 430 zones. All zones are on copper lines controlled by Network Enterprise Center (NEC). The Contractor shall provide labor, management, supervision, tools, supplies, equipment, licenses, and transportation required to support the Fort Sill Department of Emergency Services (DES) in the management, operations, and maintenance of the Integrated Commercial Intrusion Detection System (ICIDS) on Fort Sill, Oklahoma as defined in this Performance Work Statement (PWS).

1.a. The Contractor shall support, repair, install and maintain all ICIDS zones and equipment on Fort Sill (see Technical Exhibit A) as required in the applicable maintenance and security publications listed in paragraph 6. These services shall include installing, configuring, troubleshooting, replacing, and repairing all ICIDS equipment, and software. Services shall also include the removal, installation, relocation, programming changes and modification to ensure overall equipment operation is within or exceeding manufacturer's operating specifications on all ICIDS throughout the installation.

1.b The Contractor and the Contracting Officer’s Representative (COR) shall jointly survey locations as necessary to identify new ICIDS requirements (Estimated to occur 2 times per year).

ICIDS requirements, parts and equipment identified in the joint survey -see Section 9 for Not to Exceed Cost and Reimbursement. The Contractor shall install Government-provided IDS equipment and required wiring to make the equipment operational. In addition, the Contractor shall perform required software/system changes necessary to ensure equipment functionality.

The Contractor shall assist as required in the preparation of work requests required to install

Performance Work power (Directorate of Public Works (DPW) installs power and conduit), communications (NEC installs comms and comms conduit), and other support necessary to bring system online.

The COR shall determine the priority for installation(s) whenever more than one is required.

The Contractor shall keep the COR informed on the status and progress of new installations.

1.c The Contactor shall schedule and perform preventive maintenance checks on ICIDS systems identified in the Deliverables Schedule on a semi-annual basis.

1.d The Contractor shall be responsible for maintenance and management of the Integrated Commercial Intrusion Detection System (ICIDS) database, including Comms hubs and server room, that allows authorized users on Remote Status Monitors (RSM) to access, monitor and manage personnel.

1.e The Contractor shall provide maintenance for ICIDS with special features such as: Advanced Encryption Standard (AES), enhanced keypads, and Intrinsically Safe (IS) sensors/features as applicable.

1.f The Contractor shall provide personnel proficient in the skills necessary to perform required software security patches, updates, and password changes as applicable.

1.g Baseline service include one quality control inspection and service appointment per year, per alarmed facility as well as any survey for proposed and/or requested installations of new alarm systems.

1.h The period of performance is for 1 base year and 4 option years consisting of:

Phase-In Period (1 JANUARY 24 -14 JANUARY 24) Base (15 JANUARY 24 – 30 SEPTEMBER 24) Option 1 (1 OCTOBER 24 – 30 SEPTEMBER 25) Option 2 (1 OCTOBER 25 – 30 SEPTEMBER 26) Option 3 (1 OCTOBER 26 – 30 SEPTEMBER 27) Option 4 (1 OCTOBER 27 – 15 SEPTEMBER 28)

1.1 Key Personnel: The Contractor shall employ personnel in performance of this contract who possess the mandatory skills, licenses and certifications as stated herein. Personnel performing work under this contract shall remain employees of the Contractor and shall not be considered employees of the Government. The Contractor shall not employ any person who is an employee of the United States Government or the Department of Defense, either military or civilian, if such employment would create a conflict of interest or be contrary to the policies contained in Department of Defense (DOD) Joint Ethics Regulation (JER), DOD 5500.7-R.

Contractor personnel shall not wear any part of a currently authorized military uniform while performing contract duties, nor clothing such as exercise suits, shorts, tank tops, or t-shirts. There shall be no objectionable messages or phrases on the clothing. Contractor personnel working under this contract shall practice high standards of personal hygiene and maintain a clean and

Performance Work neat appearance while on duty.

The Contracting Officer (KO) may require the Contractor to remove from the job site any employee working under this contract for reason of misconduct, security concerns, or otherwise objectionable behavior, further, if the KO may require the Contractor to remove from the jobsite any contractor personnel found or suspected to be under the influence of alcohol, drugs, or other incapacitating agent. The Government reserves the right to bar any contractor employee from the installation upon disclosure of information which indicates the individual’s continued entry is not in the best interest of the Government. Contractor employees shall be subject to dismissal from the premises upon determination by the KO that such action is necessary in the interests of the Government.

In accordance with Department of Defense (DOD) Joint Ethics Regulation (JER), DOD 5500.7-R and 18 U.S.C. §1382 (1972), the installation commander has the authority to bar individuals from the installation. The removal from the job site or dismissal from the premises shall not relieve the Contractor of the requirement to provide sufficient personnel to perform the services as required by this performance work statement.

The Contractor shall provide technically qualified personnel to maintain a database to track all ICIDS activity. Contractor personnel shall possess knowledge and experience in the following areas:

knowledge of ICIDS equipment capabilities and compatibility, system configurations knowledge of the StarWatch operating system, as well as vendor specific software applications, in-depth understanding of RPI Editor, Site Planner, and Callistoview

FIPS 140-2 P25 Advanced Encryption Standard (AES), broad knowledge of theory of operation of transmitters, receivers, transceivers, antennas, as applicable for point-to-point communications. (See required training at Section 1.12)

1.1.a Systems Administrator (SA)/ Site Lead shall be Site Lead, Senior Engineer/Manager requiring Minimum of 10 years’ experience with ICIDS and the ability to obtain an interim SECRET security clearance within 90 calendar days after award and a fully adjudicated SECRET security clearance within 180 calendar days after award. The Site Lead shall be responsible for the execution and the overall performance of the work physically accomplished on site. The Site Lead shall have the full authority of onsite day to day operations under this contract. The Site Lead shall serve as the primary point of contact with the Government and shall have the authority to act or make decisions under this contract. The Site Lead may also serve as the Systems Administrator, identified in 1.1.c. The Site Lead or other personnel shall be available onsite between the hours of 7:30AM – 4:00PM Monday through Friday and available via phone 24 hours a day Monday through Sunday. The Site Lead shall respond to the Contracting Officer (KO), the Contracting Officer’s Representative (COR), or the Alternate COR requests within one hour. The Site Lead shall have a minimum of three years’ experience in monitoring, maintenance, supervision, and management of systems approximately equal in size, type, and complexity to the Fort Sill system (430 zones), shall possess

Performance Work working knowledge of all security systems covered under this contract and possess DAQ StarWatch SMS Systems Administration, and DAQ ICIDS Hardware and Callistoview certifications. The Site Lead shall hold a U.S Government Secret security clearance. The Contractor shall provide a resume and certifications of the Site Lead for verification of the Government prior to working on this contract. The Contractor shall provide a replacement Site Lead within 30 days of vacancy.

Systems Administrator (SA). The Contractor shall provide services for both System and Network Administration during normal duty hours, Monday – Friday, 7:30AM to 4:00PM, to conduct administration over the entire ICIDS-V maintained under the terms of this contract. System Administrators must meet the requirements of an IAT Level I position as outlined in AR 25-1, DA PAM 25-1-1, AR 25-2, and DOD 8570.01-M. SA must be trained, experienced, Information Assurance (IA) certified, and currently certified on the Information Systems (IS) that they are required to maintain (DAQ StarWatch SMS). The SA shall be a U.S. citizen and must hold a U.S. Government Secret and local access approvals commensurate with the level of information processed on the system or network (AR 25-2 and AR 380-67 2-1(a)). SA personnel must meet IA Technical Level I requirements identified in C3.3 of DOD 8570.01-M. Personnel performing as SA shall have a minimum of one years’ experience in IA technology, monitoring, maintenance, repair, system administration and management approximately equal in size, type, and complexity to the Fort Sill systems (i.e. 430 zones, week day monitoring for purposes of maintenance and awareness, troubleshooting, repair, maintenance, installation of replacement components, system programming, application and logging of vulnerability status scans, correcting vulnerabilities). At a minimum, the following certifications are required: DAQ StarWatch SMS Systems Administration, and DAQ ICIDS Hardware and Callistoview. This position is not considered weather/emergency essential.

However, the SA shall respond regardless of conditions in the event he/she is needed to troubleshoot/repair ICIDS issues. The SA shall ensure all daily tasks are reviewed, submitted, documented, updated, or otherwise completed as required. The SA must review system log files daily, correct system errors, and report critical events to the supervisor and/or COR.

Alternate System Administrator. The Contractor shall designate an alternate as needed to cover periods when the SA is not available. The alternate System Administrator shall possess the same certifications as the Systems Administrator.

1.1.b Senior Technician shall be, on site, requiring minimum of 3 years’ experience with ICIDS and the ability to obtain an interim SECRET security clearance within 90 calendar days after award and a fully adjudicated SECRET security clearance within 180 calendar days after award. Training as described in 1.1.d of the PWS is required.

1.1.c Technician shall be, onsite, requiring a minimum of 1 year of experience with ICIDs and the ability to obtain an interim SECRET security clearance within 90 calendar days after award and a fully adjudicated SECRET security clearance within 180 calendar days after award.

Training as described in 1.1d of the PWS is required.

1.1.d. Maintenance Repair Technicians. Contractor personnel performing maintenance and repair services on the ICIDS-V system must possess ICIDS Hardware and Callistoview certification by DAQ and shall have a minimum of two years’ experience in maintenance and repair on systems approximately equal in size, type and complexity to the Fort Sill IDS (430 zones) and shall be scheduled Monday through Friday, 7:30AM to 4:00PM. Technicians shall be required to obtain an interim SECRET security clearance within 90 calendar days after award and a fully adjudicated SECRET security clearance within 180 calendar days after award and annual

Performance Work criminal records check conducted by the Government. This position is not considered weather/emergency essential. However, maintenance technicians shall respond regardless of whether/emergency condition if called in for repair/troubleshooting of ICIDS issues. Contractor shall submit certifications to the Government prior to working on this contract for verification.

1.2 Standard Maintenance Service Calls:

1.2.a The Contractor shall return calls from the KO, COR, or Alternate COR within 60 minutes after notification. If the COR is not available, the KO or the Alternate COR shall provide direction and/or guidance.

1.2.b The Contractor shall respond to standard maintenance service calls Monday through Friday, except for federal holidays, during normal duty hours 0730 to 1600 (7:30 am to 4:00 pm).

1.2.c The Contractor shall respond by telephone or in person within one (1) workday (i.e., 24 hours) to Government requests to perform standard maintenance service calls. The Contractor shall have the ability to perform incident management and troubleshooting using a Remote Status Monitor (RSM) system to track and manage ICIDS service requests until completion.

1.2.d Standard maintenance service calls include diagnostic troubleshooting, repairs, modifications, and adjustments to return the affected equipment to manufacturer's factory specified operating parameters. Repairs shall be made within 72 hours from the time the malfunction or outage is reported to the Contractor. If the repairs are not completed within 72 hours, the Contractor shall provide a reason the repair cannot be completed and provide a solution to the Government point of contract for approval once the determination is made that the repair cannot be completed as required. Standard maintenance service calls estimated to be in the range of 25 monthly. Contractor shall service standard maintenance calls that may arise in excess of this estimated number.

1.2.e Personal Identification Code (PIC) Services. The Contractor shall be able to provide PIC services Monday through Friday from 8:00AM to 4:00PM, throughout the life of the contract as an alternate to the ICIDS Administrator. The contractor’s role with PIC services is to be a back-up only in case of no other Physical Security personnel available.

1.2.f When an outage affects the operation of the Primary Monitor Cabinet (PMC), the repair, modification and adjustment applies to the ICIDS/PMC operation as a whole. The Contractor shall demonstrate to the COR that the system is operating correctly, prior to the service call being closed.

Performance Work

1.2.g The Contractor shall resolve and complete all initial troubleshooting. Contractor shall be able to assist the ICIDS Administrator and execute the program to the extent that all accounts are properly managed and necessary corrective actions taken IAW this PWS. All contract personnel performing PIC services must possess StarWatch SMS Systems Credentialing Administrator certification by DAQ, a U.S Government Secret security clearance, and shall be proficient with and knowledgeable of the following: PIN and system support functions/capabilities in the software, creating customized reports, database querying, and log review/analysis. Contractor personnel performing PIC services shall possess excellent customer service, troubleshooting (system problems) and writing and communication skills. This position is not considered a weather/emergency essential position.

1.2.h Alarm Maintenance Monitors - The contractor shall provide alarm system monitoring for maintenance purposes, to ensure proper operation of the system, only Monday – Friday during normal business hours, for the duration of this contract, with the exception of Federal holidays.

Alarm monitors for maintenance must possess StarWatch SMS Monitoring Operator certification by DAQ and a minimum of a U.S. Government Secret security clearance.

1.3 Emergency Maintenance Service Calls:

1.3.1 The Contractor shall return calls from the KO, COR, or Alternate COR within 30 minutes after notification for emergency maintenance service calls. If the COR is not available, the KO or the Alternate COR shall provide direction and/or guidance and accept calls from contractors.

1.3.2 The Contractor shall respond to emergency service maintenance calls seven (7) days a week, twenty-four (24) hours a day, including recognized federal holidays. Zones/areas requiring emergency maintenance are identified in TE A. The Contractor shall respond to all emergency service maintenance calls.

1.3.3 The Contractor shall provide the COR with contact information for notification of emergency service requirements. The Contractor shall provide this information within 10 business days of the contract award and update the information as changes occur.

1.3.4 The Contractor shall respond by telephone and/or in-person to requests for emergency service maintenance calls within 30 minutes so that repairs can be made within four (4) hours from receipt of notification from the following authorized individuals:

Contracting Officer (KO), Contracting Officer Representative (COR), Alternate COR

1.3.5 All emergency service maintenance calls shall be completed, and the equipment shall be returned to manufacturer’s factory-specified operating parameters.

1.3.6 The Contractor shall resolve and complete all emergency service maintenance repairs within twenty-four (24) hours from receipt of emergency service maintenance call requests. If the repairs are not completed within 24 hours, the Contractor shall provide a reason the repair

Performance Work cannot be completed and provide a solution to the Government point of contract for approval once the determination is made that the repair cannot be completed as required.

1.4 Adverse Conditions Noted by the Contractor:

1.4.1 In the event the Contractor finds that a condition or malfunction exists which affects the performance or reliability of the ICIDS, whether or not it affects the contractor's maintenance capability, the Contractor shall notify the COR of this condition or malfunction in writing within one (1) workday. The Contractor shall provide recommendations for correction or improvement. The Contractor shall submit a written statement of the findings and recommendations to the COR.

1.4.2 The Contractor shall notify the COR in the event any ICIDS is suspected of unauthorized modification, tampering, abuse, or misuse. The Contractor shall submit documentation to the COR in support of suspected cases of abuse or misuse to include: a description of the damages, suspected cause, and estimated cost to repair if repair is feasible. The Contractor shall not repair this ICIDS until advised to do so by the COR.

1.5 Environmental control:

1.5.1 Material Storage and Use. The Contractor shall follow manufacturer's guidelines and professional recommendations for control of humidity, temperature, cleanliness, and materials handling.

1.6 Records, Files, Documents and Work Papers:

1.6.1 All records, files, documents, and work papers provided by the Government or generated in support of this contract are Government property. At the time of disposition, the Contractor shall box, label contents and turn into the COR.

Licenses/Certifications. The Contractor shall submit copies of required licenses, certifications, and qualifications for all contract personnel, as required by the PWS, to the COR prior to performing any work on this contract. Copies of certifications and licenses for new employees, brought on after the initial submittal of this data, shall be submitted to the COR no later than 24 hours prior to that new employee performing any contract services. All new employees are required to have the certifications required for their positions prior to assuming work on this contract.

Notification of any change in status (cancellation, renewal, etc.) of any previously submitted license or certification shall be provided to the KO immediately by telephone and email. In the event of a cancellation or loss of a required certification, the Contractor shall take immediate action. The Contractor shall submit the status change notification in writing to the KO not later than 24 hours after the verbal notification.

Performance Work

Security Requirements. Contractor personnel or any representative of the Contractor entering Fort Sill, Oklahoma, shall abide by all security regulations and shall be subject to security checks. The Contractor shall maintain security vigilance and awareness over all aspects of work covered under this contract. Aspects of work include, but are not limited to, protection of material in transit or storage, during any repair or replacement or at any other time prior to being placed on the live system. Protection means, unintended/ unauthorized disclosure, or exposure of any drawing, specification, or program language associated with a component, sub-system, system, software, or hardware that would potentially pose a security threat to the system or the protected asset.

Search and Seizure. Contractor personnel and property shall be subject to search and seizure upon entering the confines of Fort Sill, while on Fort Sill, and upon leaving the confines of Fort Sill in accordance with AR 190-13.

1.7 Hours of Operation: Normal Hours. The Contractor shall provide customer service support Monday through Friday, 0730 to 1600 hours (7:30AM to 4:00PM). The Contractor shall obtain prior approval from the COR prior to working additional hours.

1.7.1 Recognized Holidays. The Contractor (other than for emergency maintenance service) shall observe the following recognized federal holidays:

-New Year’s Day

-Martin Luther King’s Birthday

-Washington’s Birthday

-Memorial Day

- Juneteenth National Independence Day

-Independence Day

-Labor Day

-Columbus Day

-Veteran’s Day

-Thanksgiving Day

-Christmas Day

1.7.2 Federal holidays that fall on a Saturday are observed on the previous Friday.

Federal holidays that fall on a Sunday are observed the following Monday.

1.8 Physical Requirements and Work Environment: The work to be performed may require prolonged standing, bending, stooping, and working in cramped spaces.

Contractor personnel may also be required to lift and carry heavy objects. Exposure to weather is common. The Contractor shall be responsible for ensuring that their employees are familiar with and follow normal safety precautions to reduce the risk of

Performance Work injuries.

1.9 SECRET Facility Clearance: The Contractor shall possess an interim security clearance at the classification level of SECRET within 90 calendar days after award and a fully adjudicated SECRET security clearance within 180 calendar days after award.

The Contractor shall follow the Facility Clearance procedures outlined in the DD Form

254. Application for facility clearance shall be made to the KO who shall process the application in accordance with the National Industrial Security Program Operating Manual (NISPOM) Chapter 2.

1.9.1 Personnel Security Clearances. All Contractor personnel performing services under this contract shall possess a minimum-security clearance of SECRET, granted in accordance with AR 380-67, paragraph 3-20. Contractor personnel shall not perform any work under this contract or be issued Contractor or Government identification media until they meet this requirement. All Contractor personnel shall comply with procedures outlined in the DD Form 254. At no time shall any employees work under this contract without a proper security clearance. All Contractor personnel are required to have an annual criminal records check conducted by the Government.

1.9.2 Security Requirements. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22- M) and any revisions to DoD 5220.22- M.

1.9.3 This requirement shall require access to classified and controlled or sensitive information and facilities. Highest level security clearance for this work effort is SECRET.

Contractor personnel shall have the required security clearance within 180 calendar days after award date and shall maintain the required security clearance over the life of the contract, in accordance with the DD Form 254, Contract Security Classification Specification. New or replacement personnel shall have the required security clearance prior to performing services on this contract.

1.9.4 TARP (Threat Awareness and Reporting Program) Training. All Contractor employees performing work on this contract shall be required to complete the TARP training annually.

The COR shall ensure Contractors are notified of available training opportunities.

Completion of training shall be submitted to the COR 30 days after start date and then annually.

1.9.5 Contractor personnel shall comply with all applicable security regulations, guidance, and procedures referenced in the PWS, the DD Form 254, and in effect at the Government work sites. This includes regulations and procedures for entry to the installation and entry to restricted/controlled areas and facilities.

1.9.6 Access and general protection/security policy and procedures. Contractor employees and associated sub-contractor employees shall comply with all personal

Performance Work identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.9.7 Identification Badges. The Contractor shall be responsible for assuring all Contractor personnel authorized to perform work under this contract obtain installation access as required by the DES, Fort Sill. Government furnished identification shall be returned to the Government when the employee no longer performs work for the Contractor under this contract. Ten (10) days prior to initial performance, the Contractor shall provide to the KO and COR copies of Fort Sill Access Pass for all employees performing at Fort Sill. Contractor personnel and Contractor representatives, while on duty, shall possess Contractor provided identification (ID) badges at all times while on the military installation.

1.9.8 Vehicle Operation. Contractor personnel operating motor vehicles on the installation shall have a valid state operator’s license for the category of vehicle being operated and shall comply with all traffic laws regarding motor vehicle use on the installation.

1.9.9 Contractor Vehicle Identification. Contractor owned vehicles used in the performance of services under this contract on this installation shall be marked appropriately as commercial Contractor vehicles.

1.9.10 Contract Work Location. Contract work shall be performed at Fort Sill, Oklahoma.

A map, if requested, shall be furnished to the Contractor after contract award.

1.10 Keys and Locks: Unauthorized Use of Keys: The contractor shall prohibit the use of Government issued keys by any persons other than the Contractor’s employees. Prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.10.1 Lock Combinations: The contractor shall establish and implement methods of ensuring all lock combinations are not revealed to unauthorized persons. Ensure lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. When combination changes are made all information shall be documented on Standard Form 700. These procedures shall be included in the Contractor’s QCP.

1.11 Environmental control:

1.11.1 Material Storage and Use. The Contractor shall follow manufacturer's guidelines and professional recommendations for control of humidity, temperature, cleanliness, and materials handling.

Performance Work

1.11.2 Records, Files, Documents and Work Papers: All records, files, documents, and work papers provided by the Government or generated in support of this contract are Government property. At the time of disposition, the Contractor shall box, and label contents, then turn into the COR.

1.11.3 Fraud, Waste, and Abuse: The Contractor shall maintain proper conduct and good discipline within its occupied work area(s). Contractor personnel shall report suspected situations of fraud, waste, and abuse, or other intentionally dishonest conduct against the Government observed during or in the performance of this contract.

1.11.4 Conservation of Utilities: Contractor personnel shall practice utility conservation and shall operate under conditions, which preclude the waste of government-furnished utilities.

1.11.5 The Contractor shall ensure employees practice utility conservation. The Contractor shall be responsible for operating under conditions that prevent the waste of utilities to include:

1.11.6 Lights shall be used only in areas where work is actually being performed.

1.11.7 Water faucets or valves shall be turned off when not in use.

1.12 Training:

1.12.1 The Contractor shall provide trained personnel who have technical proficiency in the systems and equipment listed in Technical Exhibit A. Experience and on the job training by experienced technicians, documented by MFR may be presented to document the training courses listed below. All training certificates and Training MFR’s must be submitted to COR. Employee’s required training includes the following:

-ICIDS-IV/V Operator Training Course

-ICIDS- IV/V Maintainer Training Course

-ICIDS- IV/V Administrator Training Course

-ICIDS- IV/V SCIF Administrator Training Course

The Contractor shall attend the International Security Conference (ISC West) and/or American Society of Industrial Security (ASIS) annually to continue to keep up with trends and new technology in the industry. Travel and per diem expenses shall be handled in compliance with FAR 31.205-46 Travel Costs, the DoD Joint Travel Regulation, and only as authorized by the COR prior to execution.

1.12.1 Information Assurance (IA) Training. All Contractor personnel shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as specified by the Government requiring activity. Training is available at https://cs.signal.army.mil/login.asp. The Contractor shall ensure that all contractor

Performance Work employees and subcontractor employees requiring IA awareness training complete the training prior to performance on this contract and annually thereafter for the duration of this contract. All training shall be submitted to the COR.

1.12.2 Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR annually for continuous compliance monitoring and reporting.

1.12.3 OPSEC Training: Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. OPSEC Awareness for Military Members, DoD Employees and Contractors is available at the following website: http://www.cdse.edu/catalog/operations-security.html

1.12.4 Cyber Awareness: All contractor employees and associated sub-contractor employees must complete the DoD Cyber awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIA/.

1 . 1 3 Protection:

1.13.1 Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government- owned computing systems or devices to Government networks without the COR’s written approval.

Non- Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

1.13.2 Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI) proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry

Performance Work or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems, 6 June 201207.

1.13.3 Disclosure of Information. Performance under this contract may require the Contractor to access data and information proprietary to a government agency, another government Contractor, or of such nature that its dissemination or use other than as specified in this performance work statement would be averse to the interests of the Government or others. Contractor shall not release any information (including photographs, files, public announcements, statements, denials, electronic mail, software, or confirmations) on any part of the subject matter of this contract or any phase of any program hereunder without the prior written approval of the KO and the installation OPSEC Officer. The Contractor shall not release information regarding individuals without prior authority of the KO and the installation FOIA Officer. All documentation-showing individuals’ names or other personal information shall be controlled and protected. The provisions of the Privacy Act of 1974, Public Law 93-579, 5 U.S.C., Section 552a, shall apply.

1.13.4 Disclosure of information regarding operations and services of the activity to persons not entitled to receive it, or failure to safeguard any classified information that may come to the Contractor (or any persons under the Contractor’s control) in connection with work under this contract, may subject the Contractor, Contractor's agent, or employees to criminal liability under Title 18, Sections 793 and 798 of the United States Code (U.S.C.). Neither the Contractor nor the Contractor's employees shall disclose or cause to be disseminated, any information concerning the operations of the activity, which could result in, or increase the likelihood of, the possibility of a breach of the activities’ security or interrupt the continuity of its operation. Contractor shall report all unauthorized disclosures of information related to this contract to the installation OPSEC officer.

1.13.5 Contractor shall direct to the KO all inquiries, comments, or complaints arising from matters observed, experienced, or learned as a result of, or in connection with the performance of this contract, the resolution of which may require the dissemination of official information.

1.13.6 Inquiries received by the Contractor for work performed under this contract shall be referred to the Government for evaluation under the Freedom of Information Act of 1975, Public Law 93-502, 5 U.S.C. Section 552. The determination of whether records shall be released shall remain with the Government. The Contractor shall be responsible for search and submission of records upon request by the Government.

1.13.7 Organizational Conflict of Interest. Contractor and sub-Contractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational

Performance Work

Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s mitigation plan shall be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.13.8 Information Security Plan. The Contractor shall develop and implement an Information Security Plan IAW AR 380-5 AR 380-67, shall include applicable provisions of AR 380-series regulations.

1.13.9 National Industrial Security Program (NISP). The Contractor shall implement and maintain a security program for control of personnel, property, and information, including, unclassified and classified materials, documents, and records. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires Contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the Contractor. In addition, the Contractor’s security program shall include provisions for, but not limited to:

--Initial and Annual Operations Security (OPSEC) awareness training IAW AR 530-1.

--Receiving, storing, disseminating, transmitting, transporting, and protecting items classified as CONFIDENTIAL or SECRET by the Government, including the use of courier cards.

--In-processing and out-processing Contractor personnel for security matters.

--Obtaining Contractor personnel security clearances.

--Documenting and reporting actual and potential security problems.

--Initiating proper procedures to correct documented problems and implementing corrective procedures in the Contractor's security program.

--Filing Classified Documents. All Government-furnished classified and unclassified files in existence at the contract performance start date and those generated under this contract shall be maintained in accordance with AR 25-400-2 or other applicable regulations. Files shall be transferred to the KO or designated representative upon completion of the contract period or last day of contract performance, whichever comes first. Such files are the property of the U.S.

Government. The Contractor shall provide security of classified documents in accordance with AR 380-5 and DOD 5200.1-R, NISP Operating Manual.

1 . 1 4 Physi1cal Security:

Physical Security Plan. This portion of the Contractor’s security program shall address physical security aspects associated with contract performance and describe how the Contractor shall

Performance Work prevent unauthorized access, vandalism, pilferage, larceny, sabotage, and arson directed toward Contractor-controlled facilities and Government Furnished Property (GFP). The following regulations shall apply when developing the physical security plan: ARs 190-11, 190-13, and 190-51; Department of Defense (DOD) 4500.9-R, and Department of Defense Instruction (DODI) 5100.76 and DODI 5220.22, and applicable Fort Sill regulation or policies. The Contractor shall develop and implement a physical security plan in accordance with AR 190-13.

1 . 1 5 Antiterrorism:

1.15.1 Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after completion of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil, course #JS-

US007-14.

1.15.2 iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract. The requiring activity ATO shall provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

1.15.3 Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR.

1.15.4 Operations Security (OPSEC). The Contractor shall comply with DoD Directive 5205.02, Army Regulation 530-1, and the requiring activity OPSEC program. Failure to comply with the OPSEC directives shall be deemed adequate cause for the removal of a Contractor employee from performance on this contract and could be considered for appropriate legal action. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete

2.0 Facilities/Government Furnished Items:

2.1 Two government provided offices, equipment, materials and/or service are listed below.

2.2 Primary place of performance for these tasks shall be Bldg. 2025 Adams Road, Fort Sill, OK, 73503.

Performance Work

2.3 Office space and furniture, personal computer, normal office supplies, and telephone will be provided by the government. Computer and telephone will be for official use only and will be subject to communications management monitoring and security monitoring.

2.4 Standard Operational Procedures, regulations, manuals, texts, briefs, and other materials associated with the project and the hardware/software noted throughout this PWS will be available to the Contractor at the place of performance.

2.5 The Contractor shall be provided with access to the e-mail system and appropriate network resources during normal duty hours.

3.0 Safety:

3.1 The Contractor shall perform all tasks in such a manner as to ensure the safety of all individuals associated with this PWS and associated tasks. During the performance of tasks, if it becomes apparent at any time that continuation of work may result in damage to equipment or structures or cause injury to personnel, the Contractor must stop that portion of work and report the circumstances immediately to the COR. It shall be the Contractor’s responsibility to comply with all federal, state, and local safety regulations, procedures, and instructions. It shall be the Contractor’s responsibility to adhere to all applicable AR 385-1 (The Army Safety Program), Occupational Safety and Health Act (OSHA) standards and documents during performance of tasks under this contract.

4.0 Quality Control/Quality Assurance

4.1 Quality Assurance, the COR will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). When an observation indicates defective performance, the COR shall require the Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that the Contractor has been made aware of the defective performance IAW the quality control plan.

4.2 The Contractor shall evaluate performance under this contract in accordance with the QASP and apply all performance standards as described therein. When performance is below the baseline or standard immediate notification to the COR is required.

4.3 Key Control: The contractor shall establish and maintain a key control system in accordance with AR 190-11 and AR 190-51 to ensure that Government keys/key cards

Performance Work issued to the Contractor are not lost, stolen, or used by unauthorized persons. The Contractor shall utilize DA Form 5513-R for key control. NOTE: All references to keys include key cards. Do not duplicate keys issued to the Contractor by the Government. Develop procedures covering key control and include the procedures in the QCP. Include in the procedures turn-in of any issued keys by personnel who no longer require access to locked areas. Immediately report any occurrences of lost or duplicate keys to the COR and the

KO.

4.4 Lost Keys: The contractor shall report lost keys to the COR and the KO. In the event keys, other than master keys, are lost or duplicated, the cost of replacing the keys or replacing the affected locks will be deducted from the Contractor’s monthly invoice. In the event a master key is lost or duplicated, all locks and keys for that system will be replaced by the Government and the total cost deducted from the monthly payment due the

5.0 Common Access Card (CAC):

Accounting for Common Access Cards (CACs) for Contractor Personnel, CAC Issuance and Revocations: DoDI 5200.46, September 9, 2014. A CAC will not be issued (or maintained) by a person if there is a reasonable basis to believe, based on the individual’s criminal or dishonest conduct, that issuance of a CAC poses an unacceptable risk.

5.1 Individual Conduct:

a. An individual’s conduct involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with rules and regulations can raise questions about his or her reliability or trustworthiness and may put people, property, or information systems at risk. An individual’s past criminal or dishonest conduct may put people, property, or information systems at risk.

b. Therefore, conditions that may be disqualifying…