W912HZ-16-R-0013-0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

This solicitation is amended as seen in the follow ing pages.

The hour and date specified for receipt of Offer has been extended to 21 July 2016.

The last date for vendor submitted questions is 11 July 2016.

See changes to:

PWS

Sections L and M All Attachments

1. CONTRACT ID CODE PAGE OF PAGES

S 1 29

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 05-Jul-2016

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W912HZ-16-R-0013

X 9B. DATED (SEE ITEM 11)

10-Jun-2016

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

05-Jul-2016

CODE

ERDC CONTRACTING OFFICE

3909 HALLS FERRY ROAD

VICKSBURG MS 39180-6199

W912HZ 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

W912HZ-16-R-0013

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 11-Jul-2016 04:00 PM to 21-Jul-2016 12:00 AM.

SECTION B - SUPPLIES OR SERVICES AND PRICES

CLIN 0001

The CLIN extended description has changed from The Contractor shall perform Security Control Assessor-Validator (SCA-V) services in accordance with Section C, all applicable attachments, and the fully loaded labor rates in Section B. Specific requirements will be identified through Performance Work Statements (PWS) to be included in each individual task order. to The Contractor shall perform Security Control Assessor-Validator (SCA- V) services in accordance with Section C, all applicable attachments, and the fully loaded labor rates in Section B (reference Attachment A). Specific requirements will be identified through Performance Work Statements (PWS) to be included in each individual task order..

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

Performance Work Statement (PWS) SCA‐V Service Contract

1/15/2016

Performance Work Statement (PWS)

ERDC Security Control Assessor‐Validator (SCA‐V) Service Contract

1 Introduction The U. S. Army Corps of Engineers (USACE) Engineer Research and Development Center (ERDC) has responsibility for investigating, developing and maintaining the nation's water and related environmental resources;

constructing and operating projects for navigation, flood control, major drainage, shore and beach restoration and protection, related hydro power development, water supply, water quality control, fish and wildlife conservation and enhancement, and outdoor recreation; responding to emergency relief activities directed by other federal agencies; and administering laws for the protection and preservation of navigable waters, emergency flood control and shore protection.

1.1 Mission

The U.S. Army Corps of Engineers' (USACE) Engineer Research and Development Center (ERDC) helps solve our Nation’s most challenging problems in civil and military engineering, geospatial sciences, water resources, and environmental sciences for the Army, Department of Defense, civilian agencies, and our Nation’s public good.

1.2 Background

The ERDC Information Technology Laboratory (ITL) is responsible for building, staffing and maintaining the computer communications network in support of the Research & Development activities of ERDC. ERDC is an US Army CIO/G6 assigned Security Control Assessor - Validator (SCA-V). The SCA-V is responsible for conducting comprehensive assessments of the management, operational, and technical security controls employed within or inherited by an information system (IS) to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). SCA-Vs also provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities.

1.3 Scope

The ERDC ITL requires Risk Assessment and Security Engineering services for its mission‐critical activities in the areas of operations: ERDC Security Control Assessor‐Validator (SCA‐V) activities for the Security Control Assessor‐ Army (SCA‐A).

2 General Requirements This section describes the general requirements the contractor needs to accomplish. The following sub‐sections provide details of various considerations on this effort.

2.1 Non‐Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting Officer (PCO) immediately.

2.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification and remediation of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. When operating onsite, the contractor shall maintain continuity between ongoing activities at Vicksburg, MS, Alexandria, VA, Champaign, IL, and Hanover, NH and the contractor's corporate offices.

2.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support operations under executed task orders. The contractor shall assign work effort and maintain proper and accurate timekeeping records of personnel assigned to work on the requirement.

2.3.3 Personnel Administration

The Contractor(s) shall provide experienced and qualified personnel with all the skills necessary to perform the work identified. Some Contractor(s) personnel must have and maintain certain valid Licenses and Certifications to perform the work and will be identified at the task order level. Various required training, qualifications, licenses, security clearances, or certifications must be obtained prior to commencement of work at Contractor(s) expense.

Contractor(s) employees required to perform tasks must meet certification requirements as defined in Army and DoD Regulations. All contractor personnel shall be able to read, write, speak, and understand English, shall possess good written and verbal communications skills, and shall have sufficient knowledge of proper English grammar, spelling, capitalization, and punctuation rules to identify errors and make corrections.

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non‐work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure for services performed at the contractor's site(s).The contractor shall provide administrative support to employees in a timely fashion (time keeping, leave processing, pay, emergency needs).

2.4 Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement.

The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Procuring Contracting Officer (PCO) or Contracting Officer Representative (COR). Cross teaming may or may not be permitted.

2.5 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the labor categories as defined in the Labor Categories document utilized in the performance of each Task Order issued hereunder will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

2.5.1 Contractor Employee Conduct

The contractors employees shall observe and comply with all applicable departmental and agency regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, etc.). The contractor shall ensure that all contractor employees represent a professional appearance at all times, and that their conduct does not reflect discredit on the United States Government.

When contractor employees are working on Government facilities or participating at Government meetings, they shall wear identification badges distinguishing themselves as such. The badges at a minimum must have the employee name and word "contractor” displayed. Ideally, the company name will appear on the badge.

Additionally, not withstanding any other provisions in the PWS, the contractor shall identify themselves as a contractor in meetings, telephone conversations, all written communications and work situations so that their actions cannot be construed as acts of a Government official. The contractor shall take no actions that bind the government to a final decision or results in the exercise of governmental discretion.

2.5.2 Removal of Contractor Employees for Misconduct or Security Reasons The Government may, at its sole discretion, direct the contractor to remove any contractor employee from Government facilities for misconduct or security reasons. Such removal does not relieve the contractor of the responsibility to provide sufficient qualified personnel for adequate and timely service. The Contracting Officer will provide the contractor with an immediate rationale for removal of contractor employee.

Conflict of Interest. Neither the contractor nor its on‐site employees shall utilize their knowledge of access to information, sensitive or otherwise, for individual or company gain.

2.6 Location and Hours of Work

The work will be a mixture of on-site and off-site and will be defined at the task order level.

Onsite ‐ The headquarters site of the U.S. Army Corps of Engineers, ERDC is 3909 Halls Ferry Road, Vicksburg, MS 39180‐6199. ERDC satellite laboratory sites are located in Alexandria, VA, Champaign, IL, Hanover, NH, and other Government facilities (mainly in the continental United States). Travel will include any potential Army location where assessments are conducted.

Off‐Site – The contractor facility. Travel will include any potential Army location where assessments are conducted.

Core Working Hours. Government core working hours are from 0700 to 1730 local time Monday through Friday except US Federal Holidays. Government workers typically work eight (8) hours per day, 40 hours per week.

Government Facility Closure. In case of government facility closure as directed by the government, contractor employees shall be excused from work at no cost to the government.

2.7 Travel

All travel requirements (including plans, agenda, itinerary, or dates) shall be pre‐approved by the government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99‐234 and FAR 31.205‐46 Travel Costs (subject to local policy and procedures; may reference FAR).

2.8 EQUAL OPPORTUNITY FOR VETERANS

In addition to complying with the requirements outlined in FAR Part 22.13, FAR Provision 52.222- 38, FAR Clause 52.222-35, FAR Clause 52.222-37, DFARS 222.13 and Department of Labor regulations, U.S.

Army Corps of Engineers (USACE) contractors and subcontractors at all tiers are encouraged to promote the training and employment of U.S. veterans while performing under a USACE contract. While no set-aside, evaluation preference, or incentive applies to the solicitation or performance under the resultant contract, USACE contractors are encouraged to seek out highly qualified veterans to perform services under this contract. The following resources are available to assist USACE contractors in their outreach efforts:

Federal Veteran employment information at http://www.fedshirevets.gov/index.aspx Department of Labor Veterans Employment Assistance http://www.dol.gov/vets/ Department of Veterans Affairs–VOW to Hire Heros Act http://benefits.va.gov/vow/ Army Wounded Warrior Program – http://wtc.army.mil/modules/employers/index.html U.S. Chamber of Commerce Foundation–Hiring Our Heros http://www.hiringourheroes.org/ Guide to Hiring Veterans – Reference Material http://www.whitehouse.gov/sites/default/files/docs/white_house_business_council_- _guide_to_hiring_veterans_0.pdf

3 Performance Requirements The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 Cybersecurity

The Contractor shall perform activities relative to the ERDC Security Control Assessor‐Validator (SCA‐V) of the Security Control Assessor‐Army (SCA‐A).

This consists of Risk Management Framework (RMF) assessments for enclaves and major applications throughout the Army. This requires knowledge of the NIST SP 800‐53 controls, as well as DISA STIGs, DoD vulnerability assessment techniques, and applicable DoD and Army cybersecurity regulations.

The systems evaluated range in size from 10 to 10,000 IT assets consisting of Windows 7, Windows 2008R2, 2012, Unix, Linux, Network Devices, Databases, Web Servers, Mail, Active Directory, IDS, Firewalls, Multifunction Devices or any It capability that apply a DISA STIG as a security baseline. Based on the system or application categorization the tests requiring assessment range from 1700 to 3000 RMF checks. For a small effort the teams consist of 2‐3 personnel and for a larger effort the team can be 8 personnel. Project lengths consist of 3‐4 weeks with an on‐site visit of 1 ‐2 weeks depending on the size of the effort. Security Engineering may also be required for some customers that would require the creation of support RMF artifacts such as documentation, network diagrams or the scanning and remediation of security patches on applicable IT assets. The Security Engineering projects have a longer duration of 6‐12 months depending on the size of the effort.

Deliverables A0001 – Monthly Report

3.1.1 Pre‐Visit Teleconference

The Contractor shall schedule a pre‐visit coordination teleconference with the customer POC to finalize logistics to include travel arrangements, required site visit requests through the site FSO, and onsite testing schedule.

Deliverables A002 Schedule of Pre‐Visit Teleconferences

3.1.2 Technical Testing and RMF Controls

The Contractor shall test all applicable security controls as defined in NIST SP 800‐53. Technical testing includes using approved automated tools as documented by NETCOM. The contractor shall annotate all assessment procedures (AP) test results (TR) for the system under test’s delineated security controls in The Enterprise Mission Assurance Support Service (eMASS) within 30 days of departing onsite for technical testing. The contractor shall provide the government with the raw test data collected during each assessment.

Deliverables A003 Raw Test Data

3.1.3 Post‐Visit Analysis and Documentation

The Contractor shall conduct post‐visit analysis, verification and required documentation of all assessment procedures (AP) test results (TR) discovered during the technical testing IAW DISA STIGs. The contractor shall concisely document all test results for security controls for the system in eMASS.

The contractor shall perform a Risk Assessment Summary in eMASS that contains the following information for each security control of the system:

∙ Status – Current Compliance Status of security controls.

∙ Control Risk Level – Documented risk level for Non‐Compliant controls in the system baseline. Non‐ Compliant security controls are subjected to a risk assessment process that considers multiple factors in producing the risk level as described in DoDI 8510.01, Enclosure 6 and NIST SP 800‐30.

∙ Vulnerability Severity Value – Assigned to all Non‐Compliant security controls to indicate the severity associated with identified vulnerabilities.

∙ Vulnerability Summary – Details an accurate description of the finding:

o 1) An accurate description of finding detail

a) What is the finding

b) Where is it located

c) Why is it a finding o 2) An accurate description of Rationale including

a) Determination of severity level

b) Detail the reason why that severity level was assigned the Description of the finding and the rationale for the vulnerability severity level.

∙ Recommendations – Details potential countermeasures to mitigate/remove the vulnerability.

The contractor shall deliver all documentation to the ITL SCA‐V Team Lead.

Deliverables A004 Risk Assessment Summary

3.1.4 Post‐Visit Teleconference

The Contractor shall conduct a post‐analysis teleconference (sometimes known as a Risk Assessment Working Group – RAWG) with the customer’s point of contact to explain any unresolved issues identified while onsite. The contractor shall provide a draft recommendation memo with a summary of findings and risk determination to the government. A template will be provided through the NETCOM SCA‐V TTP on the RMF knowledge Service.

Deliverables A005 Schedule of RAWG teleconferences A006 Draft recommendation memo

3.2 Security Engineering

The Contractor shall conduct a security engineering for the Information System Owner (ISO) and augment their Cybersecurity staff completing a comprehensive self‐assessment in eMASS, creating draft RMF artifacts such as documentation and network diagrams. The contractor shall provide DISA Benchmark STIG files, Scan results for system administrator to remediate findings. The contractor will engage and work with the organizations staff to accomplish the creation of artifacts and security assessments in preparation for transition to RMF or in preparation for security assessment.

Deliverables A007 Draft RMF Supporting Documentation & Artifacts A008 Complete eMASS Comprehensive Self‐Assessment A009 Produce Security Assessments based on DISA STIGs, SRGs and Benchmarks

4 Special Requirements This section describes the special requirements for this effort. The following sub‐sections provide details of various considerations on this effort.

4.1 Security and Safety

4.1.1 All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable.

The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://www.lms.army.mil

4.1.2 All contractor and all associated sub‐contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

4.1.3 The contractor and all sub‐contractors employees will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely;

(2) Remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

4.1.4 Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (TSDB) (Army Directive 2014‐05 / AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative, as NCIC and TSDB are available), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

4.1.5The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH, Corps Watch, or See Something, Say Something program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after contract award.

4.1.6 All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter IAW AR 380‐67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors).

4.1.7 The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan must be reviewed and approved by the RA OPSEC Officer. The SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

4.1.8 All new contractor employees will complete Level I OPSEC training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training.

4.1.9 All contractor employees and associated sub‐contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of employment.

4.1.10 All contractor employees supporting IA/IT functions shall be appropriately certified upon contract IAW DoD 8570.01‐M, DFARS 252.239‐7001 and AR 25‐2. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award. The following certifications apply:

Systems Engineer ‐ Senior ‐ IASAE III Systems Engineer ‐ Intermediate ‐ IAM III Systems Engineer ‐ Associate ‐ IAT III Cybersecurity Engineer ‐ Senior ‐ IASAE III Cybersecurity Engineer ‐ Intermediate ‐ IAM III Information Security Specialist ‐ Senior ‐ IAM III Information Security Specialist ‐ Intermediate ‐ IAT III Documentation Specialist ‐ Senior ‐ IAT III Documentation Specialist ‐ Intermediate ‐ IAT III

4.1.11 All contractor employees shall ensure the following AT/OPSEC requirements are meet prior to deploying personnel authorized to accompany U.S. Armed Forces outside the United States: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

4.1.12 The Contractor shall comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M), any revisions to DOD 5220.22‐M and Army Regulation 380‐ 49, Industrial Security. The DD254 will be attached with the contract.

4.1.13 All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

4.1.14 The Prime Contractor Company must have (or will have) a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22‐M and AR 380‐49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380‐67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD254 attached to the contract. If no FCL, the supporting Government Contracting Activity will sponsor the prime contract company in obtaining the FCL.

4.1.15 All new contractor employees will complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381‐12 . The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training.

Authorized webbased TARP training for CAC card holders is available at the following website:

https://www.us.army.mil/suite/page/655474 DD Forms 254: Overarching security requirements and Contractor access to classified information shall be as specified in the basic DD Form 254, which will be further identified in the DD Form 254 for each TO, as required. All contractor personnel with access to unclassified information systems, including e‐mail, shall have at a minimum a favorable National Agency Check (NAC).

Visitor Group Security Agreement. The contractor shall sign a Contractor Visitor Group Security Agreement to protect classified information involved in performance under this contract or Task Order. The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures;

access, accountability, storage, and transmission of classified material; marking requirements; security education;

personnel security clearances; reports; security checks; security guidance; emergency protection; protection of government resources; DD Forms 254; periodic security reviews; and other responsibilities, as required.

4.2 Section not used.

4.3 Government Furnished Materials

Government furnished materials will be specified in each Task Order.

Unless otherwise indicated in a particular task order, the Government will provide all facilities, utilities, equipment and materials necessary to accomplish the work for "on‐site” employees: The government furnished materials are:

Desk Chair Access to copy machine Access to facsimile machine Telephone, including long distance and voicemail Laptop computer (PC) Government furnished computers may be hand‐receipted to the Contractor. The liability for the repair of damaged Government property shall be subject to the terms of the "Government Property clause set forth in Section I of the solicitation and resulting contract. When Government property is furnished to the Contractor, a Government property control receipt will be completed and signed by the Contractor. The property control receipt will indicate the assigned location for use of the property by the Contractor. A copy of the property control receipt will be furnished to the Contractor. Upon return of the Government property to the Government, the Government property control receipt will be completed indicating the return of the property by the Contractor. A copy of the returned property control receipt will be furnished to the Contractor. All Government property furnished to the Contractor shall be accomplished in accordance with this procedure. The Contractor shall establish a property control system for the use, control, protection, and preservation of Government property assigned to the Contractor.

4.4 Environmental Requirements

Not Applicable.

4.5 Applicable Directives

The contractor shall comply with all documents referenced under paragraph 3.0, Performance Requirements and as identified at the task order level.

4.6 Quality

This section describes the Quality Control components for this effort. The following sub‐sections provide details of various considerations on this effort.

4.6.1 Quality Control

The Contractor shall develop an Order Quality Control Plan (QCP) for the base and maintain an effective quality control program to ensure services are performed in accordance with the IDIQ contract and this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non‐recurrence of defective services. The Contractors QCP is the means by which he assures himself that his work complies with the requirement of the contract.

The finalized QCP will be accepted by the Government at the time of the award of the contract. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the Governments review and approval. The Government may find the QCP "unacceptable" whenever the Contractors procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found "unacceptable."

4.6.2 Quality Assurance Surveillance Plan (QASP)

The Government shall monitor the Contractors performance under this contract in accordance with the Governments QASP. The Government reserves the right to utilize other methods, as necessary, to assure the Contractor's compliance with the terms and conditions of this contract. The Government may inspect services provided by the Contractor both during and/or after performance is complete. If the Government identifies any performance deficiency, the Contractor will be advised of the deficiency as soon as possible. All such notifications will be confirmed in writing with the Contractor by the Government. Such notification will be made only to the Contractor or his/her designated onsite superintendent and not to any other agents, employees, or subcontractors. Upon receipt of such notification, the Contractor shall correct the deficiency within the time specified by the COR. However, in the event that the deficiency represents a hazard to health or safety or it serves to jeopardize operational continuity, then corrective action shall proceed immediately and continue uninterrupted until the correction is affected. In all cases, the correction of performance deficiencies shall not in any way adversely affect other contract performance.

5 Deliverables The contractor shall provide deliverables as described in subsequent task orders. Deliverables shall be specified by the government. Format and delivery schedule for deliverables shall be outlined in CDRLs and/or other means TBD at the task order level. Deliverables will typically fall within the listing below and be specified in individual task orders.

Identifier Name Description

A001 Monthly Report

A002 Schedule of Pre‐Visit Teleconferences

A003 Raw Test Data

A004 Risk Assessment Summary

A005 Schedule of RAWG teleconferences

A006 Draft recommendation memo

A007 Draft RMF Supporting Documentation & Artifacts

A008 Complete eMASS Comprehensive Self‐ Assessment

A009 Produce Security Assessments based on DISA STIGs, SRGs and Benchmarks

Performance Requirement Summary (PRS)

Statements Standards/AQLs Methods of Surveillance

Incentive/ Disincentive

3.1. The Contractor shall

provide Monthly Report of cyber security activities conducted relative to the ERDC Security Control Assessor‐Validator.

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

e) STD: Responsive

AQL: 95%

Periodic Inspections

Customer Feedback

Performance Rating according to Rating Criteria in Table 1.

3.2 The Contractor shall

provide Monthly Report of security engineering activities conducted relative to the Information System Owner (ISO)

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

e) STD: Responsive

AQL: 95%

Periodic Inspections

Customer Feedback

Performance Rating according to Rating Criteria in Table 1.

Table 1

Performance Requirement Summary (PRS) Performance Ratings

Performance Rating

Criteria

Excellent / Outstanding Performance meets contractual requirements and exceeds many to the government’s benefits. The contractual performance of the element or sub‐ element being assessed was accomplished with no problems and contractor actions were highly effective.

Very Good Performance meets contractual requirements and exceeds some to the government benefits. The contractual performance was accomplished with few minor problems for which corrective actions taken by the contractor were effective.

Good Performance meets contractual requirements. The contractual performance contains some minor problems for which corrective actions taken by the contractor were satisfactory.

Marginal Performance does not meet some contractual requirements. The contractual performance reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

SECTION G - CONTRACT ADMINISTRATION DATA

G.1. Invoicing

Details for invoicing will be listed in individual task orders.

G.2. Other Payment Office

Task orders may be issued under this contract that designate different payment offices. Specific payment instructions will be stated at the task order level.

G.3. Identification of Correspondence

All correspondence whether submitted electronically or via mail by the Contractor under this contract shall reference the Contract Number, the Task Order Number(s) and contain a subject line. In addition the Contractor shall develop and provide for acceptance by the Contracting

Officer a sequential serialization format for all correspondence submitted to and received from the Government.

G.4. Contracting Officer’s Representative

The Contractor will be notified in writing of the Contracting Officer's Representative (COR) and the authority which the COR will exercise under the terms of this contract. The COR will be the Government's contact person for the Contractor in all matters relating to this contract.

G.5. Contractor Representative

The Contracting Officer shall be notified in writing of the name, address and telephone number of the person who will represent the Contractor. The notification shall also state the authority which the Representative can exercise under the terms of this contract.

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

SECTION L

1.0 INTRODUCTION

1.1 Proposals shall be mailed to:

U.S. Army Engineer Research and Development Center, Contracting Office ATTN: CEERD-CT, Mr. Vincent Durman 3909 Halls Ferry Road, Vicksburg, Mississippi, 39180-6199, USA.

1.2 In accordance with the Federal Acquisition Regulation (FAR) 4.1102, prospective contractors must be registered in System for Award Management (SAM) prior to the award of a contract. You may register at the SAM website, https://www.sam.gov/portal/public/SAM/.

1.3 Offeror's Responsibility. It is the offeror's responsibility to ensure the completeness and accuracy of his or her proposal. Corrections will not be made by the Government. Errors in the proposal will be considered, among other factors, as a reflection of the offeror's technical and management capability.

1.4 Policy on Requests by Prospective Offerors for Assistance in the Preparation of Proposals. It is the policy of the Corps of Engineers to not provide any assistance to prospective offerors in the preparation of their proposals. However, this is not meant to preclude offeror's requests for information or clarification. Information will be provided if it is available and releasable, while clarification will be provided in all cases.

1.5 Offerors shall respond to all requirements of the solicitation document. Offerors are cautioned not to alter or disassemble the solicitation.

1.6 The written proposal will be the primary basis on which the Government will determine the capability of the Offeror to perform this work. It shall be specific, detailed, complete, thorough, and clear. It must address each requirement stated in the Performance Work Statement for the Base Award and Sample Task Order 0001. The Government reserves the right to award Sample Task Order 0001 as the first task order under the resulting contract if determined to be in the best interest of the Government.

1.7 The proposal shall not merely offer to comply with the Government's requirements by simply restating them, but shall specifically describe the means of accomplishment. The proposal in its entirety shall be specific, detailed, complete, through, and clear to demonstrate that the Offeror has a thorough understanding of the solicitation requirements. Non-detailed statements such as “the Offeror understands, can or will comply with the requirement listed in the Performance Work Statement”, statements that paraphrase the Performance Work Statement, or ambiguous phrases such as “standard procedures will be employed” or “well known techniques will be used” may be considered unacceptable.

1.8 Unnecessary elaboration or other presentations beyond that sufficient to present a complete and effective proposal are not desired. Elaborate artwork, expensive paper or bindings, and expensive visual or other presentation aids (with the exception of technical drawings and figures) are neither necessary nor desired. The proposal shall contain all the pertinent information in sufficient detail in the one area of the proposal where it contributes most critically to the discussion. When necessary, the Offeror shall refer to the initial discussion and identify its location within its proposal.

1.9 Please see clauses 52.203-2, Certification of Independent Price Determination and 52.203-5, Covenant Against Contingent Fees

1.10 For purposes of this solicitation, a key subcontractor defined as any subcontractor or teaming partner that will be performing more than 10% of the work. The offeror shall submit executed agreements with each subcontractor which verify the subcontractor is obligated to support this requirements as identified throughout the proposal. This documentation shall be provided in Volume III Price Proposal.

2.0 Communications Concerning the Solicitation

All questions concerning this solicitation shall be submitted to the Government via email to Vincent.Durman@usace.army.mil. The Government will accept questions up to five (5) calendar days of the proposal due date. Answers to questions will be provided via amendment to the solicitation document.

3.0 Proposal Preparation Instructions

3.1 Overall Arrangement of Proposal –The overall proposal shall consist of three (3) physically separated volumes (Vols. I, II, and III) individually titled as stated below. In addition, the Offeror shall submit one (1) copy of all proposal materials in electronic format on compact disc (CD).

In case of conflict between the paper copy of the proposals submitted, the paper copy shall take precedence. The proposals shall remain valid for a minimum of one hundred and twenty (120) days and shall not contain classified data/information.

3.1.1. Proposal Volume and Titles

Volume I – Technical Proposal Volume II – Past Performance Proposal Volume III – Price Proposal

3.2 Original and Copy requirements.

Volume I – Original and five (5) copies Volume II – Original and five (5) copies Volume III – Original and two (2) copies

3.3 Page Limitation and Volumes:

Volume Number Page Limitation Volume I – Technical Proposal

Technical Approach 20 Experience 20 Management Approach and Processes 40 Technical Approach Sample Task

Order 0001

Volume II – Past Performance As Required Volume III – Price

Fully Completed SF 1449 As Required Fully Completed Attachment A As Required Copies of legal documents outlining joint ventures or partnering arrangements if applicable

As Required

Price Proposal for Sample Task Order

As Required

3.4. Formatting and Page Limitations:

Volume I - Technical Proposal shall be typed in Times New Roman font type and font size 12 for text pages. Page size shall be 8.5 x 11 inches for text pages, and a maximum of 11 x 17 inches for spreadsheets, charts, tables, diagrams, or design drawings; font type and font size shall be appropriate for spreadsheets, charts, tables, diagrams, or design drawings. Pages larger than 8.5 x 11 inches shall count as two pages for determining page limits. Page margins shall be a minimum of one inch at the top, bottom and each side. Pages shall be numbered sequentially by volume.

3.5. Contents and Formatting

Each Offeror’s proposal shall include, but shall not necessarily be limited to, separate section, each section fully addressing the relevant requirements of the solicitation. The submission shall be clearly indexed and logically assembled. Each major section shall be clearly identified and shall begin at the top of a page. All pages shall be appropriately numbered and identified by the complete company name, date, and solicitation number in the header and/or footer. A suggested outline follows:

3.6. Volume I – Technical Proposal

Offerors shall submit their Technical Proposal following the format below. Proposals not conforming to this format may not receive as high an evaluation as a properly formatted proposal would because the information is not as easily located, extracted and analyzed by the Government. This is the largest section and it shall be subdivided as appropriate. NO PRICE

INFORMATION SHALL BE PROVIDED IN VOLUME I.

3.6.1. Cover

The cover shall indicate the following:

Title of the proposal Solicitation number Name and address of Offeror Identification of original signature copies Classified CAGE code

3.6.2. Table of Contents

The Table of Contents shall provide detail sufficient to allow the important elements to be located easily. The use of tabs and dividers is encouraged, but not necessary.

3.6.3. Introduction

The introduction shall briefly state the purpose and content of the proposal.

3.6.4. Subfactor 1: Technical Approach

The offeror shall demonstrate its capability to provide a sound technical approach to meet the requirements of the PWS and satisfy the needs outlined for each specific performance objective.

The Offeror shall describe the approach for scaling the cited capability to provide a Risk Management Framework (RMF) security assessment for the full range services of a large and complex network of at least 3,000 users.

The Offeror shall provide evidence emphasizing its existing key capabilities to be delivered under this contract (including expertise, processes, and tools), to include at a minimum the following sections identified in the PWS:

Cybersecurity (SCA-V RMF Security Assessments in eMASS) Security Engineering

3.6.5. Subfactor 2: Experience

The Offeror shall demonstrate relevant corporate experience related to the evaluation criteria outlined in Section M. Relevant corporate experience is experience (within the last 3 years) that is of the same or similar scope and complexity to the work described in the Performance Work Statement, and is of the same or similar magnitude (i.e., performing services that, on an annual basis, are at least half the dollar value proposed by the Offeror to perform the Performance Work Statement’s requirements). To demonstrate its corporate experience, the Offeror shall identify up to seven (7) of its most relevant contracts or efforts within the past three (3) years, and provide any other information the Offeror considers relevant to the requirements of the solicitation.

Descriptions of corporate experience shall clearly specify the following:

Contract/Task Order number Title of Effort Total potential dollar value Performance Period Contractor role (prime or subcontractor) Brief description of the effort

Offerors shall provide a detailed explanation demonstrating the relevance of the contracts or efforts to the requirements of the solicitation.

To the extent that the Offeror intends to subcontract portions of the effort, for each subcontractor the Offeror shall identify up to three (3) of the most relevant contracts or efforts within the past three (3) years and provide any other information the Offeror considers relevant to the requirements of the solicitation.