Solicitation_W912HZ-16-R-0013_.pdf

SEE ADDENDUM

(No Collect Calls)

W912HZ-16-R-0013 10-Jun-2016

b. TELEPHONE NUMBER

601-634-5234

8. OFFER DUE DATE/LOCAL TIME

04:00 PM 11 Jul 2016

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912HZ9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

VINCENT DURMAN

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

WOMEN-OWNED SMALL

BUSINESS (WOSB)

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

ERDC CONTRACTING OFFICE

3909 HALLS FERRY ROAD

VICKSBURG MS 39180-6199

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL BUSINESS

(EDWOSB)

SIZE STANDARD:

$27,500,000.00

NAICS:

541512

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF96

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 Job

IGF::OT::IGF LABOR

FFP

The Contractor shall perform Security Control Assessor-Validator (SCA-V) services in accordance with Section C, all applicable attachments, and the fully loaded labor rates in Section B. Specific requirements will be identified through Performance Work Statements (PWS) to be included in each individual task order.

FOB: Destination

NET AMT

0002 Job

TRAVEL

COST

Travel must be authorized by the Contracting Officer's Representative (COR) and be in conformance with the contract requirements (See travel as required by the Performance Work Statement). Contractor travel required in the performance of SCA-V Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed.

Established Federal Government per diem rates will apply to all contractor travel.

ESTIMATED COST

0003 Job Contractor Manpower Reporting

FFP

The Contractor shall provide all required Contractor Manpower Reporting in accordance with Section H. Specific requirements will be identified thorugh the Performance Work Statement to be included in each Task Order.

NET AMT

Section C - Descriptions and Specifications

Performance Work Statement (PWS) SCA‐V Service Contract

1/15/2016

Performance Work Statement (PWS)

ERDC Security Control Assessor‐Validator (SCA‐V) Service Contract

1 Introduction The U. S. Army Corps of Engineers (USACE) Engineer Research and Development Center (ERDC) has responsibility for investigating, developing and maintaining the nation's water and related environmental resources;

constructing and operating projects for navigation, flood control, major drainage, shore and beach restoration and protection, related hydro power development, water supply, water quality control, fish and wildlife conservation and enhancement, and outdoor recreation; responding to emergency relief activities directed by other federal agencies; and administering laws for the protection and preservation of navigable waters, emergency flood control and shore protection.

1.1 Mission

The U.S. Army Corps of Engineers' (USACE) Engineer Research and Development Center (ERDC) helps solve our Nation’s most challenging problems in civil and military engineering, geospatial sciences, water resources, and environmental sciences for the Army, Department of Defense, civilian agencies, and our Nation’s public good.

1.2 Background

The ERDC Information Technology Laboratory (ITL) is responsible for building, staffing and maintaining the computer communications network in support of the Research & Development activities of ERDC. ERDC is an US Army CIO/G6 assigned Security Control Assessor - Validator (SCA-V). The SCA-V is responsible for conducting comprehensive assessments of the management, operational, and technical security controls employed within or inherited by an information system (IS) to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). SCA-Vs also provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities.

1.3 Scope

The ERDC ITL requires Risk Assessment and Security Engineering services for its mission‐critical activities in the areas of operations: ERDC Security Control Assessor‐Validator (SCA‐V) activities for the Security Control Assessor‐ Army (SCA‐A).

2 General Requirements This section describes the general requirements the contractor needs to accomplish. The following sub‐sections provide details of various considerations on this effort.

2.1 Non‐Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting Officer (PCO) immediately.

2.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification and remediation of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. When operating onsite, the contractor shall maintain continuity between ongoing activities at Vicksburg, MS, Alexandria, VA, Champaign, IL, and Hanover, NH and the contractor's corporate offices.

2.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support operations under executed task orders. The contractor shall assign work effort and maintain proper and accurate timekeeping records of personnel assigned to work on the requirement.

2.3.3 Personnel Administration

The Contractor(s) shall provide experienced and qualified personnel with all the skills necessary to perform the work identified. Some Contractor(s) personnel must have and maintain certain valid Licenses and Certifications to perform the work and will be identified at the task order level. Various required training, qualifications, licenses, security clearances, or certifications must be obtained prior to commencement of work at Contractor(s) expense.

Contractor(s) employees required to perform tasks must meet certification requirements as defined in Army and DoD Regulations. All contractor personnel shall be able to read, write, speak, and understand English, shall possess good written and verbal communications skills, and shall have sufficient knowledge of proper English grammar, spelling, capitalization, and punctuation rules to identify errors and make corrections.

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non‐work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure for services performed at the contractor's site(s).The contractor shall provide administrative support to employees in a timely fashion (time keeping, leave processing, pay, emergency needs).

2.4 Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement.

The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Procuring Contracting Officer (PCO) or Contracting Officer Representative (COR). Cross teaming may or may not be permitted.

2.5 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the labor categories as defined in the Labor Categories document utilized in the performance of each Task Order issued hereunder will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

2.5.1 Contractor Employee Conduct

The contractors employees shall observe and comply with all applicable departmental and agency regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, etc.). The contractor shall ensure that all contractor employees represent a professional appearance at all times, and that their conduct does not reflect discredit on the United States Government.

When contractor employees are working on Government facilities or participating at Government meetings, they shall wear identification badges distinguishing themselves as such. The badges at a minimum must have the employee name and word "contractor” displayed. Ideally, the company name will appear on the badge.

Additionally, not withstanding any other provisions in the PWS, the contractor shall identify themselves as a contractor in meetings, telephone conversations, all written communications and work situations so that their actions cannot be construed as acts of a Government official. The contractor shall take no actions that bind the government to a final decision or results in the exercise of governmental discretion.

2.5.2 Removal of Contractor Employees for Misconduct or Security Reasons The Government may, at its sole discretion, direct the contractor to remove any contractor employee from Government facilities for misconduct or security reasons. Such removal does not relieve the contractor of the responsibility to provide sufficient qualified personnel for adequate and timely service. The Contracting Officer will provide the contractor with an immediate rationale for removal of contractor employee.

Conflict of Interest. Neither the contractor nor its on‐site employees shall utilize their knowledge of access to information, sensitive or otherwise, for individual or company gain.

2.6 Location and Hours of Work

The headquarters site of the U.S. Army Corps of Engineers, ERDC is 3909 Halls Ferry Road, Vicksburg, MS 39180‐ 6199. Locations of work could include any potential Army location.

Core Working Hours. Government core working hours are from 0700 to 1730 local time Monday through Friday except US Federal Holidays. Government workers typically work eight (8) hours per day, 40 hours per week.

Government Facility Closure. In case of government facility closure as directed by the government, contractor employees shall be excused from work at no cost to the government.

2.7 Travel

All travel requirements (including plans, agenda, itinerary, or dates) shall be pre‐approved by the government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99‐234 and FAR 31.205‐46 Travel Costs (subject to local policy and procedures; may reference FAR).

2.8 EQUAL OPPORTUNITY FOR VETERANS

In addition to complying with the requirements outlined in FAR Part 22.13, FAR Provision 52.222- 38, FAR Clause 52.222-35, FAR Clause 52.222-37, DFARS 222.13 and Department of Labor regulations, U.S.

Army Corps of Engineers (USACE) contractors and subcontractors at all tiers are encouraged to promote the training and employment of U.S. veterans while performing under a USACE contract. While no set-aside, evaluation preference, or incentive applies to the solicitation or performance under the resultant contract, USACE contractors are encouraged to seek out highly qualified veterans to perform services under this contract. The following resources are available to assist USACE contractors in their outreach efforts:

Federal Veteran employment information at http://www.fedshirevets.gov/index.aspx Department of Labor Veterans Employment Assistance http://www.dol.gov/vets/ Department of Veterans Affairs–VOW to Hire Heros Act http://benefits.va.gov/vow/ Army Wounded Warrior Program – http://wtc.army.mil/modules/employers/index.html U.S. Chamber of Commerce Foundation–Hiring Our Heros http://www.hiringourheroes.org/ Guide to Hiring Veterans – Reference Material http://www.whitehouse.gov/sites/default/files/docs/white_house_business_council_- _guide_to_hiring_veterans_0.pdf

3 Performance Requirements The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 Cybersecurity

The Contractor shall perform activities relative to the ERDC Security Control Assessor‐Validator (SCA‐V) of the Security Control Assessor‐Army (SCA‐A).

This consists of Risk Management Framework (RMF) assessments for enclaves and major applications throughout the Army. This requires knowledge of the NIST SP 800‐53 controls, as well as DISA STIGs, DoD vulnerability assessment techniques, and applicable DoD and Army cybersecurity regulations.

The systems evaluated range in size from 10 to 10,000 IT assets consisting of Windows 7, Windows 2008R2, 2012, Unix, Linux, Network Devices, Databases, Web Servers, Mail, Active Directory, IDS, Firewalls, Multifunction Devices or any It capability that apply a DISA STIG as a security baseline. Based on the system or application categorization the tests requiring assessment range from 1700 to 3000 RMF checks. For a small effort the teams consist of 2‐3 personnel and for a larger effort the team can be 8 personnel. Project lengths consist of 3‐4 weeks with an on‐site visit of 1 ‐2 weeks depending on the size of the effort. Security Engineering may also be required for some customers that would require the creation of support RMF artifacts such as documentation, network diagrams or the scanning and remediation of security patches on applicable IT assets. The Security Engineering projects have a longer duration of 6‐12 months depending on the size of the effort.

Deliverables A0001 – Monthly Report

3.1.1 Pre‐Visit Teleconference

The Contractor shall schedule a pre‐visit coordination teleconference with the customer POC to finalize logistics to include travel arrangements, required site visit requests through the site FSO, and onsite testing schedule.

Deliverables A002 Schedule of Pre‐Visit Teleconferences

3.1.2 Technical Testing and RMF Controls

The Contractor shall test all applicable security controls as defined in NIST SP 800‐53. Technical testing includes using approved automated tools as documented by NETCOM. The contractor shall annotate all assessment procedures (AP) test results (TR) for the system under test’s delineated security controls in The Enterprise Mission Assurance Support Service (eMASS) within 30 days of departing onsite for technical testing. The contractor shall provide the government with the raw test data collected during each assessment.

Deliverables A003 Raw Test Data

3.1.3 Post‐Visit Analysis and Documentation

The Contractor shall conduct post‐visit analysis, verification and required documentation of all assessment procedures (AP) test results (TR) discovered during the technical testing IAW DISA STIGs. The contractor shall concisely document all test results for security controls for the system in eMASS.

The contractor shall perform a Risk Assessment Summary in eMASS that contains the following information for each security control of the system:

∙ Status – Current Compliance Status of security controls.

∙ Control Risk Level – Documented risk level for Non‐Compliant controls in the system baseline. Non‐ Compliant security controls are subjected to a risk assessment process that considers multiple factors in producing the risk level as described in DoDI 8510.01, Enclosure 6 and NIST SP 800‐30.

∙ Vulnerability Severity Value – Assigned to all Non‐Compliant security controls to indicate the severity associated with identified vulnerabilities.

∙ Vulnerability Summary – Details an accurate description of the finding:

o 1) An accurate description of finding detail

a) What is the finding

b) Where is it located

c) Why is it a finding o 2) An accurate description of Rationale including

a) Determination of severity level

b) Detail the reason why that severity level was assigned the Description of the finding and the rationale for the vulnerability severity level.

∙ Recommendations – Details potential countermeasures to mitigate/remove the vulnerability.

The contractor shall deliver all documentation to the ITL SCA‐V Team Lead.

Deliverables A004 Risk Assessment Summary

3.1.4 Post‐Visit Teleconference

The Contractor shall conduct a post‐analysis teleconference (sometimes known as a Risk Assessment Working Group – RAWG) with the customer’s point of contact to explain any unresolved issues identified while onsite. The contractor shall provide a draft recommendation memo with a summary of findings and risk determination to the government. A template will be provided through the NETCOM SCA‐V TTP on the RMF knowledge Service.

Deliverables A005 Schedule of RAWG teleconferences A006 Draft recommendation memo

3.2 Security Engineering

The Contractor shall conduct a security engineering for the Information System Owner (ISO) and augment their Cybersecurity staff completing a comprehensive self‐assessment in eMASS, creating draft RMF artifacts such as documentation and network diagrams. The contractor shall provide DISA Benchmark STIG files, Scan results for system administrator to remediate findings. The contractor will engage and work with the organizations staff to accomplish the creation of artifacts and security assessments in preparation for transition to RMF or in preparation for security assessment.

Deliverables A007 Draft RMF Supporting Documentation & Artifacts A008 Complete eMASS Comprehensive Self‐Assessment A009 Produce Security Assessments based on DISA STIGs, SRGs and Benchmarks

4 Special Requirements This section describes the special requirements for this effort. The following sub‐sections provide details of various considerations on this effort.

4.1 Security and Safety

4.1.1 All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable.

The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://www.lms.army.mil

4.1.2 All contractor and all associated sub‐contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

4.1.3 The contractor and all sub‐contractors employees will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely;

(2) Remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

4.1.4 Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (TSDB) (Army Directive 2014‐05 / AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative, as NCIC and TSDB are available), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

4.1.5The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH, Corps Watch, or See Something, Say Something program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after contract award.

4.1.6 All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter IAW AR 380‐67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors).

4.1.7 The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan must be reviewed and approved by the RA OPSEC Officer. The SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

4.1.8 All new contractor employees will complete Level I OPSEC training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training.

4.1.9 All contractor employees and associated sub‐contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of employment.

4.1.10 All contractor employees supporting IA/IT functions shall be appropriately certified upon contract IAW DoD 8570.01‐M, DFARS 252.239‐7001 and AR 25‐2. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award.

4.1.11 All contractor employees shall ensure the following AT/OPSEC requirements are meet prior to deploying personnel authorized to accompany U.S. Armed Forces outside the United States: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

4.1.12 The Contractor shall comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M), any revisions to DOD 5220.22‐M and Army Regulation 380‐ 49, Industrial Security. The DD254 will be attached with the contract.

4.1.13 All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

4.1.14 The Prime Contractor Company must have (or will have) a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22‐M and AR 380‐49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380‐67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD254 attached to the contract. If no FCL, the supporting Government Contracting Activity will sponsor the prime contract company in obtaining the FCL.

4.1.15 All new contractor employees will complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381‐12 . The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training.

Authorized webbased TARP training for CAC card holders is available at the following website:

https://www.us.army.mil/suite/page/655474 DD Forms 254: Overarching security requirements and Contractor access to classified information shall be as specified in the basic DD Form 254, which will be further identified in the DD Form 254 for each TO, as required. All contractor personnel with access to unclassified information systems, including e‐mail, shall have at a minimum a favorable National Agency Check (NAC).

Visitor Group Security Agreement. The contractor shall sign a Contractor Visitor Group Security Agreement to protect classified information involved in performance under this contract or Task Order. The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures;

access, accountability, storage, and transmission of classified material; marking requirements; security education;

personnel security clearances; reports; security checks; security guidance; emergency protection; protection of government resources; DD Forms 254; periodic security reviews; and other responsibilities, as required.

4.2 Transition

The contractor shall follow the transition plan submitted as part of the proposal and keep the Government fully informed of status throughout the transition period. Throughout the phase‐in/phase‐out periods, it is essential that attention be given to minimize interruptions or delays to work in progress that would impact the mission. The contractor must plan for the transfer of work control, delineating the method for processing and assigning tasks during the phase‐in/phase‐out periods. The contractor shall include the status of the transitioning of control of work as a deliverable in the monthly status report.

4.3 Government Furnished Materials

Unless otherwise indicated in a particular task order, the Government will provide all facilities, utilities, equipment and materials necessary to accomplish the work:

Laptop computer (PC) Government furnished computers may be hand‐receipted to the Contractor. The liability for the repair of damaged Government property shall be subject to the terms of the "Government Property clause set forth in Section I of the solicitation and resulting contract. When Government property is furnished to the Contractor, a Government property control receipt will be completed and signed by the Contractor. The property control receipt will indicate the assigned location for use of the property by the Contractor. A copy of the property control receipt will be furnished to the Contractor. Upon return of the Government property to the Government, the Government property control receipt will be completed indicating the return of the property by the Contractor. A copy of the returned property control receipt will be furnished to the Contractor. All Government property furnished to the Contractor shall be accomplished in accordance with this procedure. The Contractor shall establish a property control system for the use, control, protection, and preservation of Government property assigned to the Contractor.

4.4 Environmental Requirements

Not Applicable.

4.5 Applicable Directives

The contractor shall comply with all documents referenced under paragraph 3.0, Performance Requirements and as identified at the task order level.

4.6 Quality

This section describes the Quality Control components for this effort. The following sub‐sections provide details of various considerations on this effort.

4.6.1 Quality Control

The Contractor shall develop an Order Quality Control Plan (QCP) for the base and maintain an effective quality control program to ensure services are performed in accordance with the IDIQ contract and this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non‐recurrence of defective services. The Contractors QCP is the means by which he assures himself that his work complies with the requirement of the contract.

The finalized QCP will be accepted by the Government at the time of the award of the contract. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the Governments review and approval. The Government may find the QCP "unacceptable" whenever the Contractors procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found "unacceptable."

4.6.2 Quality Assurance Surveillance Plan (QASP)

The Government shall monitor the Contractors performance under this contract in accordance with the Governments QASP. The Government reserves the right to utilize other methods, as necessary, to assure the Contractor's compliance with the terms and conditions of this contract. The Government may inspect services provided by the Contractor both during and/or after performance is complete. If the Government identifies any performance deficiency, the Contractor will be advised of the deficiency as soon as possible. All such notifications will be confirmed in writing with the Contractor by the Government. Such notification will be made only to the Contractor or his/her designated onsite superintendent and not to any other agents, employees, or subcontractors. Upon receipt of such notification, the Contractor shall correct the deficiency within the time specified by the COR. However, in the event that the deficiency represents a hazard to health or safety or it serves to jeopardize operational continuity, then corrective action shall proceed immediately and continue uninterrupted until the correction is affected. In all cases, the correction of performance deficiencies shall not in any way adversely affect other contract performance.

5 Deliverables The contractor shall provide deliverables as described in subsequent task orders. Deliverables shall be specified by the government. Format and delivery schedule for deliverables shall be outlined in CDRLs and/or other means TBD at the task order level. Deliverables will typically fall within the listing below and be specified in individual task orders.

Identifier Name Description

A001 Monthly Report

A002 Schedule of Pre‐Visit Teleconferences

A003 Raw Test Data

A004 Risk Assessment Summary

A005 Schedule of RAWG teleconferences

A006 Draft recommendation memo

A007 Draft RMF Supporting Documentation & Artifacts

A008 Complete eMASS Comprehensive Self‐ Assessment

A009 Produce Security Assessments based on DISA STIGs, SRGs and Benchmarks

W912HZ-16-R-0013

Performance Requirement Summary (PRS)

Statements Standards/AQLs Methods of Surveillance

Incentive/ Disincentive

3.1. The Contractor shall

provide Monthly Report of cyber security activities conducted relative to the ERDC Security Control Assessor‐Validator.

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

e) STD: Responsive

AQL: 95%

Periodic Inspections

Customer Feedback

Performance Rating according to Rating Criteria in Table 1.

3.2 The Contractor shall

provide Monthly Report of security engineering activities conducted relative to the Information System Owner (ISO)

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

e) STD: Responsive

AQL: 95%

Periodic Inspections

Customer Feedback

Performance Rating according to Rating Criteria in Table 1.

Table 1

Performance Requirement Summary (PRS) Performance Ratings

Performance Rating

Criteria

Excellent / Outstanding Performance meets contractual requirements and exceeds many to the government’s benefits. The contractual performance of the element or sub‐ element being assessed was accomplished with no problems and contractor actions were highly effective.

Very Good Performance meets contractual requirements and exceeds some to the government benefits. The contractual performance was accomplished with few minor problems for which corrective actions taken by the contractor were effective.

Good Performance meets contractual requirements. The contractual performance contains some minor problems for which corrective actions taken by the contractor were satisfactory.

Marginal Performance does not meet some contractual requirements. The contractual performance reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 N/A N/A N/A Government

CLAUSES INCORPORATED BY REFERENCE

52.246-16 Responsibility For Supplies APR 1984

CLAUSES INCORPORATED BY FULL TEXT

52.246-4 INSPECTION OF SERVICES--FIXED-PRICE (AUG 1996)

(a) Definitions. "Services," as used in this clause, includes services performed, workmanship, and material furnished or utilized in the performance of services.

(b) The Contractor shall provide and maintain an inspection system acceptable to the Government covering the services under this contract. Complete records of all inspection work performed by the Contractor shall be maintained and made available to the Government during contract performance and for as long afterwards as the contract requires.

(c) The Government has the right to inspect and test all services called for by the contract, to the extent practicable at all times and places during the term of the contract. The Government shall perform inspections and tests in a manner that will not unduly delay the work.

(d) If the Government performs inspections or tests on the premises of the Contractor or a subcontractor, the Contractor shall furnish, and shall require subcontractors to furnish, at no increase in contract price, all reasonable facilities and assistance for the safe and convenient performance of these duties.

(e) If any of the services do not conform with contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by reperformance, the Government may (1) require the Contractor to take necessary action to ensure that future performance conforms to contract requirements and (2) reduce the contract price to reflect the reduced value of the services performed.

(f) If the Contractor fails to promptly perform the services again or to take the necessary action to ensure future performance in conformity with contract requirements, the Government may (1) by contract or otherwise, perform the services and charge to the Contractor any cost incurred by the Government that is directly related to the performance of such service or (2) terminate the contract for default.

(End of clause)

52.246-5 INSPECTION OF SERVICES--COST-REIMBURSEMENT (APR 1984)

(a) Definition. "Services," as used in this clause, includes services performed, workmanship, and material furnished or used in performing services.

(b) The Contractor shall provide and maintain an inspection system acceptable to the Government covering the services under this contract. Complete records of all inspection work performed by the Contractor shall be maintained and made available to the Government during contract performance and for as long afterwards as the contract requires.

(c) The Government has the right to inspect and test all services called for by the contract, to the extent practicable at all places and times during the term of the contract. The Government shall perform inspections and tests in a manner that will not unduly delay the work.

(d) If any of the services performed do not conform with contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, for no additional fee. When the defects in services cannot be corrected by reperformance, the Government may (1) require the Contractor to take necessary action to ensure that future performance conforms to contract requirements and (2) reduce any fee payable under the contract to reflect the reduced value of the services performed.

(e) If the Contractor fails to promptly perform the services again or take the action necessary to ensure future performance in conformity with contract requirements, the Government may (1) by contract or otherwise, perform the services and reduce any fee payable by an amount that is equitable under the circumstances or (2) terminate the contract for default.

Section F - Deliveries or Performance

F.1. Place(s) of Delivery.

The Contracting Officer’s Representative (COR) is responsible for inspection and acceptance of all deliverables provided under this contract. Originals and copies of all correspondence that require Government certification and signature shall be delivered to the COR.

F.2. Notice Regarding Late Delivery.

The contractor shall notify the COR in writing as soon as it becomes apparent that a scheduled delivery will be late. The contractor shall include in the notification the rationale for late delivery, the expected date for the delivery and the project impact. The COR will review the documentation, establish a new delivery schedule and notify the contractor.

F.3. Period Of Performance/Funding Limitation

The ordering period for the resulting contract is five years.

Maximum ordering limit is $9,900,000.00 and the minimum guarantee is $5,000.00

F.4. Place of Performance

Specific requirements for performance location will be specified in each task order.

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS UIC

0001 N/A N/A N/A N/A

0002 N/A N/A N/A N/A

0003 N/A N/A N/A N/A

52.242-15 Stop-Work Order AUG 1989 52.242-17 Government Delay Of Work APR 1984 52.247-34 F.O.B. Destination NOV 1991 252.204-7006 Billing Instructions OCT 2005

Section G - Contract Administration Data

G.1. Invoicing

Details for invoicing will be listed in individual task orders.

G.2. Other Payment Office

Task orders may be issued under this contract that designate different payment offices. Specific payment instructions will be stated at the task order level.

G.3. Identification of Correspondence

All correspondence whether submitted electronically or via mail by the Contractor under this contract shall reference the Contract Number, the Task Order Number(s) and contain a subject line. In addition the Contractor shall develop and provide for acceptance by the Contracting Officer a sequential serialization format for all correspondence submitted to and received from the Government.

G.4. Contracting Officer’s Representative

The Contractor will be notified in writing of the Contracting Officer's Representative (COR) and the authority which the COR will exercise under the terms of this contract. The COR will be the Government's contact person for the Contractor in all matters relating to this contract.

G.5. Contractor Representative

The Contracting Officer shall be notified in writing of the name, address and telephone number of the person who will represent the Contractor. The notification shall also state the authority which the Representative can exercise under the terms of this contract.

G.6. Application of Service Contract Act

Some of the disciplines covered in this solicitation are covered by a Service Contract Act (SCA) exemption, as they are considered “Executive, Administrative or Professional;” however, offerors shall be responsible for ensuring compliance with the SCA for applicable Labor Categories. Wage Determinations will be issued for particular localities with the issuance of each task order.

Section H - Special Contract Requirements

H.1 Ordering Methods

The contracting officer will order the supplies/services hereunder by the issuance of task orders using SF Form 1449. Orders may be firm-fixed-price (FFP), and/or cost-reimbursable (Cost) for other direct costs or a combination thereof. All orders shall be issued on a SF Form 1449, and the orders shall incorporate the terms and conditions of this contract.

H.2 Minimum Guarantee

The Government’s minimum guarantee is $5,000.00.

H.3 Other Direct Costs

Other direct costs are allowable to the extent they are reasonable, allocable, and determined to be allowable. All cost items shall be reimbursed in accordance with referenced FAR parts, only when prior authorization has been received from the CO or COR as specified in task order requirement. Breakdown/documentation to support cost reimbursable items may be designated at task order level and must be in compliance with FAR Part 31 provision incorporated by reference.

H.4 Safety

PROCESS FOR OBTAINING CURRENT REQUIREMENTS OF THE U.S. ARMY CORPS

OF ENGINEERS SAFETY AND HEALTH REQUIREMENTS MANUAL (EM 385-1-1)

Contractors are required to comply with the latest version, and all posted changes, of the U.S.

Army Corps of Engineers Safety and Health Requirements Manual in effect on the issue date of this solicitation. EM 385-1-1 and changes are available on the Internet at http://www.hq.usace.army.mil (at the HQ home page, select “Safety and Occupational Health”, and then select “EM 385-1-1” for the manual, or “Changes to EM” for the most recent changes to the manual). Prior to making an offer, offerors should check the referenced website for the latest changes. No separate payment will be made for compliance with the requirements of this paragraph, or for compliance with other safety requirements of the contract.

H.5 Contractor Manpower Reporting

The Office of the Assistant Secretary of the Army (Manpower and Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor is required to completely fill in all of the information in the format using the following web address: https://cmra.army.mil. The required information includes:

(1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative

(2) Contract number, including task and delivery order number

(3) Beginning and ending dates covered by reporting period

(4) Contractor name, address, phone number, e-mail address, identity of contractor employee entering data;

(5) Estimated direct labor hours (including sub-contractors)

(6) Total payments (including sub-contractors)

(7) Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different)

(8) Estimated data collection cost

(9) Organizational title associated with Unite Identification Code (UIC) for the Army Requiring Activity (the Army Requiring activity is responsible for providing the contractor with its UIC for the purposes of reporting this information

(10) Locations where contractor and sub-contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website

(11) Presence of deployment or contingency contract language (12)Number of contractor and sub-contractor employees deployed in theater this reporting period (by country).

As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement.

Reporting period will be the period of performance not to exceed 12 months ending 30 September of each government fiscal year and must be…