Draft PWS ESS VIII .pdf

PERFORMANCE WORK STATEMENT

ELECTRONIC SECURITY SYSTEMS

DRAFT

INDEX

1. General Information

2. Acronyms

3. Government Property and Services

4. Contractor Furnished Items and Services

5. Specific Tasks

6. Applicable Publications

PART 1 GENERAL INFORMATION

1.1 Description of Services/Introduction: Provide all personnel, equipment, tools, materials, supervision, non-personal services, and other items necessary to procure, install, service and maintain Electronic Security Systems (ESS); physical security and/or force protection measures; automated control systems such as Building Automation Systems (BAS), Fire Alarm Systems (FAS), life safety systems, chemical / biological / radiological detection / response systems, and Mass Notification Systems (MNS); and other related electronic systems.

1.2 Background: The U.S. Army Engineering and Support Center, Huntsville (HNC) is designated and responsible for maintaining the ESS Mandatory Center of Expertise (ESS-MCX). The ESS-MCX provides world-wide support to the Department of Defense (DoD), other Federal agencies, other customers in partnership with the U.S. Army Corps of Engineers (USACE) commands, and non-DoD agencies to deliver the highest quality ESS projects. ESS applications including, but are not limited to, electronic access control/Access Control Systems (ACS); Closed- Circuit Television (CCTV)/Video Surveillance Systems (VSS); Intrusion Detection Systems (IDS); annunciation systems; Data Transmission Systems (DTS) including information assurance, data processing, and data storage;

systems sustainment; command and control systems; and integration of the various subsystems and components.

1.3 Objectives: Provide engineering, procurement, installation, testing, monitoring, maintenance and service for ESS and other systems defined in Paragraph 1.1 throughout the areas designated in this Performance Work Statement

(PWS).

1.4 Scope: This contract requires Contractor to have the capability to respond to multiple requests for work at diverse locations throughout the Contiguous United States (CONUS) and Outside of the Contiguous United States (OCONUS). OCONUS locations include Alaska, Hawaii, other U.S. territories, and the foreign countries of Australia, Bahrain, Belgium, Bulgaria, Diego Garcia, Djibouti, Germany, Greece, Guam, Honduras, Israel, Italy, Japan, Jordan, Kosovo, Kuwait, Netherlands, Poland, Portugal, Republic of Cuba, Republic of the Marshall Islands, Republic of South Korea, Romania, Saudi Arabia, Spain, State of Qatar, Turkey, United Arab Emirates, and United Kingdom/England. Additional OCONUS locations and foreign countries may be added to the contract to fulfill Department of Defense requirements. The services include, but are not limited to, planning, procurement, installation, monitoring, maintenance, and service as further described within Part 5.

1.5 Ordering Period: The effort will be accomplished by individual task orders awarded within the base contract period of thirty-six months with two optional twenty-four-month periods. Dates for task order deliverables will be specified in each task order award. Performance of work under task order awards may continue after the contract has expired until all requirements are complete. No new requirements may be awarded under the contract after the ordering expiration date.

1.6 Quality: Contractor shall maintain an effective quality control program to ensure services are performed in accordance with (IAW) the contract terms and conditions. The Government will provide quality assurance.

1.6.1 Corporate Quality Control and Surveillance Program: Contractor shall develop, document, and implement an effective quality control and surveillance program for this contract to ensure services are performed IAW this PWS.

This program shall be documented in a Corporate Quality Control Plan (QCP) and shall be submitted within 30 calendar days after base contract award for the Contracting Officer (KO) or Contracting Officers Representative

(COR) review and approval. The QCP shall describe the quality control program, organization, inspection procedures, recordkeeping, reports and formats, performance standards, and other information as required to demonstrate compliance with the contract. The QCP must also ensure procedures are developed and implemented to identify, prevent, and ensure non-recurrence of defective services. At a minimum, Contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”.

Once the QCP is accepted, any Contractor proposed changes to the quality control system must receive KO’s written acceptance before implementing.

1.6.2 Site Specific Quality Control Plan and Surveillance Plan (task order specific): When applicable, a site specific QCP shall be developed/adapted to the requirements of the individual task order and shall be submitted and approved.

1.6.3 Quality Assurance (QA): Contractor’s performance under this contract shall be IAW Technical Exhibit 1, “Performance Requirements Summary” and will include an evaluation of Contractor’s performance. This plan is primarily focused on what the Government must do to ensure that Contractor has performed IAW the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum Acceptable Quality Level (AQL). The Government will conduct QA inspections IAW the schedule set out in Technical Exhibit 1, “Performance Requirements Summary”, or at other times, as necessary, when circumstances require. If any Government QA review identifies a process/work product failure or identifies noncompliance with safety practices, Contractor will be issued a Corrective Action Request (CAR). Each CAR will be annotated as a Critical Nonconformance, Major Nonconformance, or Minor Nonconformance. Definitions and required Contractor response times are:

1.6.3.1 Critical Nonconformance is nonconformance that is likely to result in hazardous or unsafe conditions for individuals using, maintaining, or depending upon the supplies or services; or is likely to prevent performance of a vital agency mission. Contractor is provided twenty-four (24) hours (one business day) to provide written response to the CAR.

1.6.3.2 Major Nonconformance is nonconformance, other than critical, that is likely to result in failure of the supplies or services, or to materially reduce the usability of the supplies or services for its intended purpose. Contractor is provided seventy-two (72) hours (three business days) to provide written response to the CAR.

1.6.3.3 Minor Nonconformance is nonconformance that is not likely to materially reduce the usability of the supplies or services for their intended purpose or is a departure from established standards having little bearing on the effective use or operation of the supplies or services. Contractor is provided up to fifteen (15) business days to provide written response to the CAR.

1.6.4 Government Remedies: The KO will follow FAR 52.246-4, “Inspection of Services-Fixed Price” for Contractor’s failure to perform satisfactory services or failure to correct non-conforming services.

1.7 Place of Performance: Contractor is responsible for performing the services required under this contract at the location as specified in the individual task orders.

1.8 Type of Contract: Task orders will be firm-fixed price contracts.

1.9 Security Requirements: This contract may require the handling and generation of classified information. Security classification and requirements appropriate for each task order will be delineated in the individual task order. Task Orders issued under this contract may require a security level of SECRET or above.

1.9.1 Contractor shall meet the Industrial Security requirements of the National Industrial Security Programming Operating Manual (NISPOM) for Safeguarding Classified Information (DoD 5220.22M). The clearance level will be determined by the User Agency. A Directives Division (DD) Form 254, Contract Security Classification Specification, will be provided by the Government with the base contract. Should a higher clearance or other security requirements other than what is provided at the base contract be required, a DD 254 will be issued with the task order. Contractor shall at a minimum have an Interim Facility Clearance at or above the level required in the DD 254. No classified work is authorized without an approved DD 254 with the appropriate personnel and facility security clearance. Personnel security clearances and Facility security clearances shall be obtained by Contractor IAW the NISPOM. Facility security clearances will be obtained by the User Agency Security Office.

1.9.1.1 Physical Security: There will be no Government Property provided for Contractor use.

1.9.1.2 Site Specific Security Requirements: Contractor personnel at Government sites, installations or facilities shall follow all security procedures and processes of the installation as stated and directed by the Government personnel at the site.

1.9.1.3 Information Technology Systems: For task orders requiring access to Information Technology (IT) Systems (stand-alone computers, network computers/systems, e-mail, etc.), not classified in nature, the following requirements apply:

1.9.1.3.1 Contractor employees, to include subcontractor employees, shall, at a minimum, meet Tier 3 Federal Investigative Standards (FIS).

1.9.1.3.2 A Common Access Card (CAC) is also required for access to Government IT systems. Proof of the appropriate investigative requirement/background check will be verified through the Joint Personnel Adjudication System (JPAS) by HNC security personnel. When proof of a background check cannot be verified, the HNC security personnel will obtain the appropriate background check for the contractor employee.

1.9.1.3.3 To obtain or renew a CAC credential, the Facility Security Officer (FSO)/ContractorSecurity Manager (CSM) must complete and sign a CAC Request Form and transmit it to hnc-ess-cac-request@usace.army.mil. The CAC request form outlines the information required to be submitted for both a renewal and a new request.

1.9.2 Non-U.S. Citizens: When working on a USACE facility, foreign nationals must be approved by the HQUSACE Foreign Disclosure Officer before beginning work on the contract or task order. This approval requirement also pertains to subcontractor employees. Contractor shall submit the names of all foreign nationals proposed for performance under this contract or individual task orders to the KO, along with documentation to verify the individual is legally admitted into the country and has authority to work.

1.10 Safety and Health: Site activities in conjunction with this contract may pose safety and health hazards, which require specialized expertise to effectively address and eliminate.

1.10.1 IAW Federal Acquisition Regulation 52.236-13, Accident Prevention (FAR 52.236-13), Contractor shall comply with the latest version of the Engineer Manual (EM) 385-1-1 (USACE Safety and Health Requirements Manual) including any updates and interim revisions, in effect at the time of the task order solicitation. All federal, state, and local including host nation laws, e.g., the Occupational Safety and Health Administration (OSHA) requirements (29 CFR 1910 and 1926), will be followed; the most stringent requirements will govern.

1.10.2 Accident Experience, Exposure, and Lost Workday Reporting: For Contractor awarded task orders, Contractor shall, IAW the latest version of EM 385-1-1, complete a monthly summary report of accident experience and exposure on the electronic data collection tool provided by the CEHNC Safety Office, and forward to the Government Designated Authority no later than close of business the 10th calendar day of the following month. The Government Designated Authority will be identified in the individual task orders.

1.10.3 Hazardous Materials: If hazardous materials (asbestos, lead-based paint, etc.) are encountered, Contractor shall immediately stop all work and notify the KO, COR, and the Facility Manager in writing within 24 hours.

Remaining work shall not commence until written notification is given from the KO.

1.10.4 Contractor shall be responsible for the following as specified on individual task orders:

1.10.4.1 Safety and Health Program (SHP). The contractor is required to develop and maintain a written Safety and Health Program (SHP) in compliance with the requirements of the Occupational Safety and Health Administration (OSHA), the USACE safety and health requirements, 29 CFR 1910, 29 CFR 1926, 29 CFR 1960, EM 385- 1-1, and FAR 52.236-13. The contractor shall submit this plan to CEHNC for review within 30-days after base contract mailto:request@usace.army.mil.

award and prior to the commencement of any work under the awarded contract.

1.10.4.2 Accident Prevention Plan (APP). The contractor is required to submit an Accident Prevention Plan (APP) to the Contracting Officer in accordance with the milestone schedule of each individual task order. The APP shall address applicable items listed in Appendix A of the EM 385-1-1 in addition to other applicable OSHA requirements. The APP shall be job-specific and shall address any unusual or unique aspects of the project or activity for which it is written. The APP is a document that details how the safety and health requirements of OSHA;

other regulatory codes and documents; and the EM 385-1-1 are to be accomplished.

1.10.4.3 Site Visit Accident Prevention Plan (SVAPP). The contractor will be required to submit a “fill-in-the-blank” Abbreviated Accident Prevention Plan (AAPP) to the CEHNC Safety Office prior to commencement of any site visit. The template shall be capable of being adapted to sites specified in the individual task orders and shall be prepared prior to each site visit. The template shall be submitted to the CEHNC Safety Office before any work under this contract has been awarded. The SVAPP shall be used for a site visit only.

1.10.4.4 Activity Hazard Analysis (AHA). The Activity Hazard Analysis (AHA) is to be developed before beginning each work activity involving a type of work presenting hazards not experienced in previous project operations or where a new work crew or sub-contractor is to perform work, the contractor performing that work activity shall prepare an AHA. AHAs will define the activities being performed and identify the sequences of work, the specific hazards anticipated, the site conditions, equipment, materials, and the control measures to be implemented to eliminate or reduce each hazard to an acceptable level of risk. Work will not begin until the AHA for the work activity has been accepted by the CEHNC Safety Office. AHAs shall be prepared in accordance with the most current version of EM 385-1-1.

1.10.4.5 Site Safety and Health Officer (SSHO). The contractor shall employ a competent person at each project to function as the Site Safety and Health Officer (SSHO). The SSHO will manage the contractor’s APP. For site-specific SSHO requirements and SSHO qualifications refer to the EM 385-1-1, 01.A.17.

1.10.4.6 Safety Training. The contractor is responsible for providing employee training in accordance with the EM 385-1-1, Section 01.B and the task order PWS. Employee safety training shall be documented (subject, date, attendees, etc.) in the monthly report submitted by the contractor to CEHNC.

1.11 Post Award Conference/Periodic Progress Meetings: Attend any post award conference convened by the contracting activity or contract administration office IAW FAR Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with Contractor to review Contractor's performance. At these meetings the KO will apprise Contractor of how the Government views Contractor’s performance and Contractor will apprise the Government of problems, if any, being experienced. Contractor shall take appropriate action on outstanding issues.

1.12 Equal Opportunity for Veterans: In addition to complying with the requirements outlined in FAR Part 22.13, FAR Provision 52.222-38, FAR Clause 52.222-35, FAR Clause 52.222-37, DFARS 222.13 and Department of Labor regulations, USACE contractors and subcontractors at all tiers are encouraged to promote the training and employment of U.S. veterans while performing under a USACE contract. While no set-aside, evaluation preference, or incentive applies to the solicitation or performance under the resultant contract, USACE contractors are encouraged to seek out highly qualified veterans to perform services under this contract. The following resources are available to assist USACE contractors in their outreach efforts:

1.12.1 Federal Veteran employment information: http://www.fedshirevets.gov/index.aspx

1.12.2 Department of Labor Veterans Employment Assistance: http://www.dol.gov/vets/

1.12.3 Department of Veterans Affairs, Veterans Opportunity to Work to Hire Heroes Act: http://benefits.va.gov/vow/

1.12.4 Army Wounded Warrior Program: http://wtc.army.mil/modules/employers/index.html

1.12.5 U.S. Chamber of Commerce Foundation, Hiring Our Heroes: http://www.hiringourheroes.org/ http://www.fedshirevets.gov/index.aspx http://www.dol.gov/vets/ http://benefits.va.gov/vow/ http://wtc.army.mil/modules/employers/index.html http://www.hiringourheroes.org/

1.12.6 Guide to Hiring Veterans, Reference Material:

http://www.whitehouse.gov/sites/default/files/docs/white_house_business_council_guide_to_hiring_veterans_0.pdf

1.13 Program Manager: Contractor shall provide a Program Manager (PgM, reference Technical Exhibit 3, “Qualification of Contractor Personnel”) who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for Contractor when the PgM is absent shall be designated in writing to the KO. The PgM or alternate shall have full authority to act for Contractor on all contract matters relating to daily operation of this contract.

1.14 Identification of Contractor Employees: Contractor personnel attending meetings and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

PART 2 ACRONYMS

ACA – Agent of the Certifying Authority ACP – Access Control Point ACS – Access Control Systems AHA – Activity Hazard Analysis AIE – Automated Installation Entry APL – Approved Products List APP – Accident Prevention Plan AQL – Acceptable Quality Level AR – Army Regulation ATC – Authority to Connect ATO – Authority to Operate BAS – Building Automation System C&A – Certification and Accreditation CAC – Common Access Card CAR – Corrective Action Request CCE – Contracting Center of Excellence CCTV – Closed Circuit Television CND – Computer Network Defense CONUS – Contiguous United States COR – Contracting Officer’s Representative CEHNC – U.S. Army Corps of Engineers, Huntsville Center DA – Department of Army DD – Directives Division DISA – Defense Information Systems Agency DFARS – Defense Federal Acquisition Regulation Supplement DMEA – Defense Micro Electronics Activity DTM – Data Transmission Media DTS – Data Transmission System DoD – Department of Defense DODD – Department of Defense Directives DODI – Department of Defense Instructions DoDIN – DoD Information Network EM – Engineer Manual eMASS – Enterprise Mission Assurance Support Service ESC – Electronic Security Center ESS – Electronic Security System FAR – Federal Acquisition Regulation FAS – Fire Alarm System FIS – Federal Investigative Standards FSC – Federal Service Code HNC – U.S. Army Engineering and Support Center, Huntsville HQUSACE – Headquarters, U.S. Army Corps of Engineers IA – Information Assurance IASAE – Information Assurance System Architect and Engineer IAT – Information Assurance Technical IAVA – Information Assurance Vulnerability Alerts IAW – In Accordance With IDS – Intrusion Detection System PIT –Platform Information Technology IT – Information Technology JTR – Joint Travel Regulation JPAS – Joint Personnel Adjudication System KO – Contracting Officer LDD – Lost, Damaged, or Destroyed

MATOC – Multiple Award Task Order Contract MCX – Mandatory Center of Expertise MNS – Mass Notification Systems NDAA – National Defense Authorization Act NEC – Network Enterprise Center NISPOM – National Industrial Security Programming Operating Manual NTP – Notice to Proceed OCONUS – Outside of the Contiguous United States ODC – Other Direct Costs O&M – Operation and Maintenance OSHA – Occupational Safety and Health Administration Pd – Probability of Detection PGI – Procedures, Guidance, and Information PgM – Program Manager PMP – Project Management Professional PWS – Performance Work Statement QA – Quality Assurance QASP – Quality Assurance Surveillance Plan QC – Quality Control QCP – Quality Control Plan QCS – Quality Control System RFP – Request for Proposal RMF – Risk Management Framework RMS – Resident Management System SAT – System Acceptance Testing SD – Submittal Description SHP – Safety and Health Program SSHO – Site Safety and Health Officer SVAPP – Site Visits Accident Prevention Plan UFC – Unified Facilities Criteria UFGS – Unified Facilities Guide Specification UIC – Unit Identification Code USACE – U.S. Army Corps of Engineers VSS – Video Surveillance System also known as CCTV

PART 3

GOVERNMENT PROPERTY AND SERVICES

3.1 Government Property: There will be no Government property provided for Contractor use for this acquisition.

3.2 Services: The Government will make utilities available to the contractor. The cost associated with connecting to these utilities will be borne by the Contractor. The equipment installed by the contractor will become the property of the Government upon acceptance.

3.3 Information: The Government will provide Contractor with all necessary Government publications to include regulations, engineering pamphlets, technical manuals, standards, user’s manuals, and forms as necessary for the performance of tasks related to the work described in the individual task orders.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 All equipment and materials shall be provided by Contractor unless specified otherwise in the task order.

4.2 National Defense Authorization Act (NDAA): Equipment shall be compliant with the John S. McCain National Defense Authorization Act (NDAA) of Fiscal Year 2019 and shall not contain "telecommunications equipment or services" banned by the NDAA, nor employ any component or technology of any system - substantial, essential, critical, or otherwise - from banned companies.

PART 5

SPECIFIC TASKS

5.1 Basic Services: The following requirements and deliverables are required under the base contract and may apply to any task order issued. Requirements described in each task order may complement, emphasize, increase, and/or decrease any requirements or processes mentioned in this Part. Each task order will identify the unique nature and scope of work required.

5.2 Contractor shall be able to perform all the specific tasks listed below. All tasks are to be performed IAW the requirements of the individual task order’s PWS, specifications, drawings, original manufacturer’s published procedures (if applicable), and any Submittal Description (SD) that may be required at the task order level.

Contractor shall be able to:

5.2.1 Prepare system and component documentation to include drawings related to installation and assembly of the computers, field equipment panels, data transmission equipment, interfaces, instrumentation, and all other equipment, wiring diagrams, procedures for field installation of all equipment, and system testing procedures.

5.2.2 Procure and install software. All software and software updates shall be approved by the Government prior to installation.

5.2.2.1 Install software IAW original software developer’s published procedures and documentation, and as required by the specification and individual task order. Software intended for initial installation will be required to undergo the DoD Risk Management Framework (RMF) process and comply with all applicable regulations. RMF requirements will be addressed further in individual task orders.

5.2.2.2 Procure and apply software license, as applicable to the system installed, and as further clarified by individual task orders.

5.2.2.3 Procure and provide software support agreements, as applicable to the systems installed, and as further clarified by individual task orders.

5.2.3 Procure and install hardware. All hardware shall be approved by the Government prior to installation.

Contractor shall install hardware IAW manufacturer’s published procedures and documentation, and as required by the specifications and individual task orders.

5.2.4 Procure and install all data transmission systems IAW with specifications, drawings, and manufacturer’s published documentation. Contractor shall comply with applicable certification and accreditation requirements of the Network Enterprise Center (NEC) or equivalent authority.

5.2.5 Provide interface to all existing data transmission systems IAW specifications, drawings, and manufacturers’ published documentation. Contractor shall comply with all requirements of the NEC related to interfacing with the existing communication system. Contractor shall provide technical data, equipment, and software in compliance with Information Assurance (IA) policies and requirements.

5.2.6 Identify and provide recommendations for procurement of long lead items that could adversely impact a task order’s schedule.

5.2.7 Develop the database for the system, with the required features stated in the specifications. Contractor shall use survey data, drawings, manufacturer’s data, and equipment lists in conjunction with industry standards to develop the database to meet the requirements for each task order.

5.2.8 Provide graphics for the system using data from drawings, engineering surveys, and manufacturer’s data.

5.2.9 Perform all factory, pre-acceptance, functional, burn-in, and IA testing/commissioning IAW applicable and referenced sections of criteria and specification of the task order.

5.2.10 Perform minor construction and ancillary work required to support equipment installation.

5.2.11 Perform engineering surveys or assessments to develop installation drawings and equipment lists. Contractor shall provide a written report (Site Survey Report) indicating recommended equipment installation and any differing conditions from those stated in the individual task order.

5.2.12 Perform a current site conditions survey to validate design drawings or identify conditions that affect performance of the system to be installed. As part of the survey, Contractor shall determine compatibility and interface required between new and existing equipment. Contractor shall provide a written report stating all compatibility requirements.

5.2.13 Provide all required Operation and Maintenance (O&M) Manuals.

5.2.14 Provide training of systems installed as required by the applicable sections of the specifications listed in the individual task order PWS.

5.2.15 Provide all maintenance and service as specified in individual task orders.

5.2.16 Provide monitoring services as specified in individual task orders.

5.2.17 Prepare as-built installation drawings. Contractor shall provide drawings in electronic media in the format designated in the individual task order. Contractor shall provide hard copies and electronic copies as required in the individual task orders. Contractor shall deliver all drawings within thirty (30) days after written acceptance of the system by the Government.

5.2.18 Perform special engineering services and studies as defined in individual task orders.

5.2.19 Provide warranty for all systems installed.

5.2.20 Provide after-action reports, accident reports, minutes of meetings and installation progress reports as required per task order.

5.2.21 Participate in a post-award conference at the site prior to installation work. The work will be IAW the applicable contract specifications, standard installation details, site specific requirements, and regulatory requirements as applicable.

5.2.22 Comply with Cybersecurity Requirements: Contractor shall design, develop, and integrate cybersecurity (to include, but not limited to, all hardware, software and/or equipment) IAW the DoD, Department of the Army (DA), U.S. Army Network Enterprise Center (NEC), and other applicable Government Agencies. This work shall be done IAW all applicable cybersecurity Regulations and Directives, as provided in this PWS and the individual task order.

Any equipment provided that is subject to the DoD Unified Capabilities Requirements shall be listed on the DoD Information Network Approved Products List (DoDIN APL).

5.2.22.1 The systems (to include, but not limited to, all hardware, software and/or equipment) provided by Contractor shall be able to obtain a favorable Authority to Operate (ATO) to all requisite Government networks. Contractor shall perform all cybersecurity activities associated with Technical Exhibit 2, “Cybersecurity Requirements”.

5.2.22.2 Contractor shall provide cybersecurity that is IAW current policies, procedures, and statutes, to include (but not limited to) the following:

5.2.22.2.1 AR 25-1, Army Information Technology

5.2.22.2.2 AR 25-2, Information Assurance

5.2.22.2.3 The Federal Information Security Management Act (FISMA)

5.2.22.2.4 Committee National Security Systems, Policy No. 11

5.2.22.2.5 Federal Information Processing Standards

5.2.22.2.6 Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)

5.2.22.2.7 DoD Directive 8500.1, Information Assurance

5.2.22.2.8 DoD Instruction 8500.2, Information Assurance Implementation

5.2.22.2.9 DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology

5.2.22.2.10 DoD 8570.01-M Information Assurance Workforce Improvement Program

5.2.22.3 Contractor shall provide all documentation required to obtain a favorable ATO IAW Technical Exhibit 2, “Cybersecurity Requirements”. The cybersecurity requirements will be considered complete upon obtaining an ATO and the successful connection to local infrastructure (as required), for the purposes of this PWS.

5.2.22.4 DFARS Clause 252.239-7001 Information Assurance Contractor Training and Certification (JAN 2008).

Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions IAW DoD 8570.01-M, Information Assurance Workforce Improvement Program. Contractor shall meet the applicable information assurance certification requirements, including:

5.2.22.4.1 DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M.

5.2.22.4.2 Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

5.2.22.4.3 Upon request by the Government, Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

5.2.22.5 At his/her sole discretion, the Contracting Officer may require consideration from Contractor equivalent to reimbursing the cost of the Agent of the Certifying Authority (ACA) assessment (including, but not limited to the labor and travel of personnel conducting the reassessment) in the form of a credit to the contract price if Contractor does not pass the initial ACA assessment.

5.2.22.6 System Security Engineering Maintenance and Support. Contractor shall adhere to Information Assurance regulations and directives and provide system security engineering. Contractor shall provide timely patches for vulnerabilities (vendor specific as well as globally published vulnerabilities), adhere to Information Assurance Vulnerability Alerts (IAVAs), and maintain a favorable ATO and an ATC to all requisite networks for the life of the contract.

5.3 Task Order Requirements:

5.3.1 Each task order will be negotiated after base contract award. Perform the work under individual task orders.

Each task order will identify the specific work to be performed. Individual task orders may include additional technical requirements as necessary to define the work, including specifications, technical manuals, engineer instructions, and engineer technical letters. The performance period will be negotiated and determined for each individual task order. Contractor shall prepare and submit a detailed project schedule that shows an appropriate breakout of activities and includes any key milestones that may be stated in individual task orders.

5.3.2 When required, task orders will be competed among the awardees under the Multiple Award Task Order Contracts (MATOC). An electronic Request for Proposal (RFP) will be submitted to Contractor. Contractor will review the RFP and prepare a task order proposal as defined in the individual RFP letter for each task order.

5.3.3 Contractor shall itemize submitted proposals in sufficient detail such that the Government can determine that Contractor demonstrates an understanding of the requirements of the PWS, and familiarity with the technical and logistical requirements of the project.

5.3.4 Contractor shall provide sufficient detail in cost and pricing data to substantiate any proposed costs, so that the Government can determine whether the pricing proposed is fair and reasonable. Task order proposals shall include all ancillary costs associated with the requirements of each specific task order in an editable and unlocked format.

5.3.5 Contractor’s detailed and summarized cost breakdown shall reflect a clear understanding of the requirements outlined in the task order PWS, and IAW the base contract. Price proposals shall identify (for both the Prime and Subcontractor costs) the labor, equipment, and material costs for each installed security component. Correlate labor costs to the material installed. The price proposal shall also identify and detail travel, Other Direct Costs (ODC), profit, etc.

5.3.6 Task order awards will be determined based on best value to the Government.

5.4 Information Support and Documentation:

5.4.1 Contractor shall deliver all required technical information and data IAW the requirements, quantities, and schedules set forth in the individual task order PWS, or as otherwise specified or required. The requirements for contents and detail of operation and maintenance manuals, and testing documentation (including level and detail) shall be as described in applicable Unified Facilities Guide Specifications (UFGS) and shall be further clarified in the individual task order PWS.

5.4.2 Contractor shall prepare after-action and other reports to include progress reports, minutes of all meetings, confirmation notice for telephone calls, field inspection reports, calibration reports and installation reports.

Contractor shall furnish copies of all such documents within five (5) working days to the points of contact identified in the task order after each specific action. Contractor shall formally report project status on a monthly basis, or other interval specified in the individual task order.

5.4.3 Contractor shall submit all Contractor-generated text in electronic form such as on CDs in Microsoft Word or Microsoft Excel, as appropriate, in addition to hard copies as defined in the individual task order. Extensive use of Internet e-mail communications will be required.

5.5 Continuation and Completion of Work:

5.5.1 A Contracting Officer's Representative (COR) will be appointed by the Contracting Officer to administer the contract. This representative shall be responsible for the coordination of all work under each individual task order.

The company officer or representative designated as Contractor Manager shall be responsible for the complete coordination of all work under this contract. All work shall be accomplished IAW Contractor’s approved QCP. The Government may elect to provide third party technical inspection.

5.5.2 Contractor shall provide warranty coverage for the systems, all its components, subsystems, workmanship, data transmission system, and all Contractor-furnished software. Provide warranty coverage for all products and services provided under each task order for a period of one (1) year from the date of Government acceptance, or the offeror's standard commercial warranty period, whichever is greater. Government acceptance will be defined in the individual task order. Contractor shall provide the necessary support required to maintain the warranty. Upon any defect or product or service failure during the warranty period, Contractor’s response time to restore system service shall be within the timeframes indicated herein or as stated in the individual task order. “Mission Critical Outages” will require a maximum of four (4) hour response time during normal working hours and maximum of sixteen (16) hour response time for after hours and one (1) day to restore system operation. All other outages will require a maximum of three (3) days response time and seven (7) days to restore system operation. System outages assessed as “Mission Critical” will be at the discretion of the Contracting Officer or Contracting Officer’s Representative.

5.6 Travel: All travel and related expenses associated with the execution of work shall be reimbursed IAW FAR 31.205-46. Obtain all necessary documents/permits required for travel and performance of work. As task orders are issued for services, the travel requirements shall be identified by the Government and the offeror shall propose travel costs along with the methodology utilized in determining how travel costs were proposed in order to demonstrate cost and price reasonableness.

5.6.1 Reserved

5.7 The Government may use the Resident Management System (RMS) for Windows, or other appropriate methodology and system, to assist in its monitoring and administration, as designated per task order. If required by the specific task order, use the Government-furnished Construction Contractor Module of RMS, referred to as Quality Control System (QCS), to record, maintain, and submit various types of information throughout the task order period. This joint Government-Contractor use of RMS and QCS will facilitate electronic exchange of information and overall management of the contract. QCS provides the means for Contractor to input, track, and electronically share information with the Government in the following areas: Administration, Finances, Quality Control, Submittal Monitoring, Scheduling, and Import/Export of Data.

5.8 Performance Standards:

5.8.1 Performance Standards for each task order will be established by the Government before award and conforming to FAR Subpart 37.6. The Government will monitor Contractor’s performance under this contract using the method of surveillance specified in Technical Exhibit 1, “Performance Requirements Summary”.

5.8.2 The applicable performance measures for the base contract include socio-economic goals, client satisfaction and quality review; and performance over all task orders awarded.

5.9 Contractor Personnel:

5.9.1 Prior to employees beginning work under the terms of this contract, Contractor will ensure that employees, at a minimum, meet the qualification requirements listed for each discipline shown in Technical Exhibit 3, “Qualification of Contractor Personnel” and, and if applicable, have the required current and valid professional certifications. At least one key personnel under the base contract must have the authority to contractually bind Contractor. The PgM, Senior Contracts Manager, Senior Electronic Security Engineer, and Quality Control Manager are key personnel that shall be identified and appointed for the base contract. For each individual task order the following personnel may be required and will be considered as key personnel at the task order level: Project Manager, Electronic Security Engineer, Security System Engineer, Network Specialist and Site Superintendent.

Each of these positions shall be identified and appointed as required for each individual task order and shall meet the minimum requirements identified in Technical Exhibit 3, “Qualification of Contractor Personnel”. Contractor shall notify the Government of any key management personnel changes in writing within five (5) days of the change. The Government reserves the right to disapprove any changes that do not meet the requirements outlined in this PWS.

5.9.2 Contractor shall notify the Government of any key installation or maintenance technical personnel who are required to maintain clearances, certifications, or a required number of years of experience as defined in the individual task order.

5.10 Contractor Man-hour Reporting: The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where Contractor will report Contractor manpower information (including subcontractor manpower information) required for performance of this contract.

Contractor shall submit all the information required in the format specified at the System for Award Management website (www.sam.gov). The required information includes:

http://www.sam.gov/

5.10.1 Contract Number

5.10.2 Delivery Order Number (if applicable)

5.10.3 Task Order Number (if applicable)

5.10.4 Requiring Activity Unit Identification Code (UIC)

5.10.5 Command

5.10.6 Contractor Contact Information

5.10.7 Federal Service Code (FSC)

5.10.8 Direct Labor Hours

5.10.9 Direct Labor Dollars

5.10.10 Location Information (where Contractor and subcontractors (if applicable) performed the services)

5.10.11 Contractor shall fill in the above fields on the website. Reporting period will be the period of performance not to exceed twelve (12) months ending September 30 of each Government fiscal year and shall be reported no later than 15 October of each calendar year. If your particular contract crosses fiscal years, two entries shall be made to capture the data for the contract period; for example, if the contract start date is 1 January 2027 and ends 31 December 2027, the data for the period from 1 January 2027 through 30 September 2027 shall be entered not later than 15 October 2027 and the period 1 October 2027 through 31 December 2027 shall be entered not later than 15 January 2028.

PART 6

APPLICABLE PUBLICATIONS

6.1 All technical and programmatic work performed under this contract and its task orders shall comply with the applicable criteria issued by the DoD, Department of the Army (DA), and other Government Agencies within and outside the DoD for systems defined in Paragraph 1.1. The criteria documents issued by USACE are available at the Whole Building Design Guide web site (www.wbdg.org) and shall be used as the primary criteria, unless alternate, additional, or supplementary criteria is stated in the individual task order. Applicable regulations issued by the DA with associated DoD issued policy and Department of Defense Instructions (DoDI), and/or Department of Defense Directives (DoDD) shall be followed. Where these regulations, policy and criteria are applicable, those requirements shall be incorporated.

6.2 Individual task orders will include a list of regulations and criteria documents applicable for procurement and installation activities.

http://www.wbdg.org/

TECHNICAL EXHIBIT 1

PERFORMANCE REQUIREMENTS SUMMARY

Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable quality levels for each requirement.

These thresholds are required for mission success.

Performance Objectives

PWS

Reference Level

Acceptable Performance Level (Standard)

Performance Threshold

Monitoring Methods Performed by the Government

Note

Prepare and submit

SVAPP

Task Order

IAW EM 385-1-1 and “accepted” by Government prior to survey activities at the site

Zero discrepancies

100 percent inspection

Preparation and submittal of Accident Prevention Plan

IAW EM 385-1-1 and “accepted” by Government prior to mobilization for on-site work

Prepare and Submit Health & Safety Reports

Base Contract

Submit monthly NLT 10th of each month

On time delivery 100 percent inspection

Preparation and submittal of all applicable technical deliverables

IAW all technical requirements and references, as stated in the

PWS.

On time delivery within Project

Schedule and “A” or “B” grade in

RMS

Submittal of security engineering and cybersecurity documentation

IAW technical requirements and references, as stated in the PWS and applicable Information Assurance regulations

Adherence to accepted project schedule

Task Order Within established contract period of performance

No more than 2 percent variance from critical path

Periodic inspection 1

Preparation and submittal of all non- technical deliverables to include contract compliance documentation

IAW contract deliverable table in PWS

Meet all contract reporting requirements

Periodic surveillance

Deliver complete and operational system

Task Order IAW all technical requirements and references as stated in the

PWS

Meet all contract requirements

Periodic surveillance and random sampling

Complete System Acceptance Testing (SAT)

IAW specifications, drawings, manufacturer’s published procedures and PWS

First-time pass without significant punch- list items

Formal testing witnessed

Contract Reports (manpower, GFP, Subcontract)

Base Contract &

IAW PWS

Meet all contract requirements

Small Business Subcontract Plan (Large Business Only)

Base Contract

Meet or exceed Small Business Goals

100 percent inspection

Note 1: A contractor not receiving a satisfactory evaluation may be in danger of not having options exercised and/or receiving an adverse past performance report.

Note 2: Liquidated Damages IAW FAR 19.705-7(b) is determination of Good Faith Effort of meeting the Small Business Subcontracting Plan and/or next option period may not be exercised.

TECHNICAL EXHIBIT 2

CYBERSECURITY REQUIREMENTS

1.0 General:

This exhibit provides detailed cybersecurity requirements for this PWS. Upon Contractor request the Government will provide a review of documents before official submittals. Cybersecurity will be placed on the agenda of the post award orientation meeting for further discussion upon contractor request.

2.0 Completion and Government Acceptance of the System(s) Security Plan:

IAW DoDI 8510.01, Risk Management Framework (RMF), all DoD Information Systems and Platform Information Technology (PIT) systems are required to obtain an Authority to Operate (ATO) via the RMF process. The DISA Enterprise Mission Assurance Support Service (eMASS) is the tool used for producing and submitting a System Security Plan that meets the requirements of RMF, in order to obtain an ATO.

3.0 Completion and Government Acceptance of Cybersecurity Artifacts and Other Required Cybersecurity Documents:

Contractor shall develop and upload into eMASS, all required artifacts and supporting documentation. This effort should result in the creation of a System Security Plan (SSP) packet. The required artifacts are determined by the system security classification, system categorization, and cybersecurity controls. This information may include but is not limited to the list below:

a) System Description Statement

b) Configuration Management Plan

c) Disaster Recovery Plan

d) Continuity of Operations

e) Contingency Plan

f) Incidence Response Plan

g) Risk Assessment Report

h) Plan of Action and Milestones (POAM)

i) System Architecture / Topology / Data Flow

j) Configuration Validation Checklist

k) Security Classification Guide

l) System Configuration Guide

m) Hardware Inventory List (use the CIO/G-6 template)

n) Software Inventory List (use the CIO/G-6 template)

o) Physical Security Plan

p) Personnel Security Plan

q) Information Assurance Vulnerability Management (IAVM) Process

r) Patch Management Process, Connection Approval / System Approval documentation

s) Ports, Protocols, and Services (PPS) List

t) Active Directory (AD) Documentation, (if applicable) The data representing this information may either be uploaded directly, or cut and pasted, into eMASS for each applicable control. In addition, eMASS will provide a rollup of inherited controls for each system once it has been properly identified and classified within eMASS. It is recommended that the current version of the Department of Homeland Security (DHS) Cyber Security Evaluation Tool (CSET) be used as a development tool for eMASS artifacts.

4.0 Completion of Scan/Fix/Scan Testing and Analysis:

This work is performed before the Security Control Assessor (SCA) assesses the system(s) and provides a certification recommendation to the Authorizing Official (AO). Contractor shall assess (scan and perform manual checks) its own system using approved cybersecurity scanning tools. When issues are found (High, Medium, Low Impact Levels) Contractor shall fix those issues and rescan the system to ensure all issues have been fixed and/or properly and acceptably mitigated. High impact level findings that cannot be fixed are to be reported to the Government immediately along with a valid reason the vulnerability cannot be fixed and a mitigation plan to fix the vulnerability in the future. The goal is for the system to have a proper cybersecurity posture before the SCA comes in to assess the system. The scan/fix/scan process should find and fix all issues before the SCA’s assessment.

5.0 Completion of Documentation to…