W912HZ-16-R-0013-0003.pdf

W912HZ-16-R-0013

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

This solicitation is amended as seen in the follow ing pages.

The hour and date specified for receipt of Offer has been extended to 26 July 2016.

Additional Questions and Answ ers have been inserted See changes to:

PWS

Attachment A and B

1. CONTRACT ID CODE PAGE OF PAGES

S 1 38

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 15-Jul-2016

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W912HZ-16-R-0013

X 9B. DATED (SEE ITEM 11)

10-Jun-2016

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

15-Jul-2016

CODE

ERDC CONTRACTING OFFICE

3909 HALLS FERRY ROAD

VICKSBURG MS 39180-6199

W912HZ 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 21-Jul-2016 12:00 AM to 26-Jul-2016 04:00 PM.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

Performance Work Statement (PWS) SCA‐V Service Contract

1/15/2016

Performance Work Statement (PWS)

ERDC Security Control Assessor‐Validator (SCA‐V) Service Contract

1 Introduction The U. S. Army Corps of Engineers (USACE) Engineer Research and Development Center (ERDC) has responsibility for investigating, developing and maintaining the nation's water and related environmental resources;

constructing and operating projects for navigation, flood control, major drainage, shore and beach restoration and protection, related hydro power development, water supply, water quality control, fish and wildlife conservation and enhancement, and outdoor recreation; responding to emergency relief activities directed by other federal agencies; and administering laws for the protection and preservation of navigable waters, emergency flood control and shore protection.

1.1 Mission

The U.S. Army Corps of Engineers' (USACE) Engineer Research and Development Center (ERDC) helps solve our Nation’s most challenging problems in civil and military engineering, geospatial sciences, water resources, and environmental sciences for the Army, Department of Defense, civilian agencies, and our Nation’s public good.

1.2 Background

The ERDC Information Technology Laboratory (ITL) is responsible for building, staffing and maintaining the computer communications network in support of the Research & Development activities of ERDC. ERDC is an US Army CIO/G6 assigned Security Control Assessor - Validator (SCA-V). The SCA-V is responsible for conducting comprehensive assessments of the management, operational, and technical security controls employed within or inherited by an information system (IS) to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). SCA-Vs also provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities.

1.3 Scope

The ERDC ITL requires Risk Assessment and Security Engineering services for its mission‐critical activities in the areas of operations: ERDC Security Control Assessor‐Validator (SCA‐V) activities for the Security Control Assessor‐ Army (SCA‐A).

2 General Requirements This section describes the general requirements the contractor needs to accomplish. The following sub‐sections provide details of various considerations on this effort.

2.1 Non‐Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting Officer (PCO) immediately.

2.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification and remediation of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. When operating onsite, the contractor shall maintain continuity between ongoing activities at Vicksburg, MS, Alexandria, VA, Champaign, IL, and Hanover, NH and the contractor's corporate offices.

2.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support operations under executed task orders. The contractor shall assign work effort and maintain proper and accurate timekeeping records of personnel assigned to work on the requirement.

2.3.3 Personnel Administration

The Contractor(s) shall provide experienced and qualified personnel with all the skills necessary to perform the work identified. Some Contractor(s) personnel must have and maintain certain valid Licenses and Certifications to perform the work and will be identified at the task order level. Various required training, qualifications, licenses, security clearances, or certifications must be obtained prior to commencement of work at Contractor(s) expense.

Contractor(s) employees required to perform tasks must meet certification requirements as defined in Army and DoD Regulations. All contractor personnel shall be able to read, write, speak, and understand English, shall possess good written and verbal communications skills, and shall have sufficient knowledge of proper English grammar, spelling, capitalization, and punctuation rules to identify errors and make corrections.

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non‐work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure for services performed at the contractor's site(s).The contractor shall provide administrative support to employees in a timely fashion (time keeping, leave processing, pay, emergency needs).

2.4 Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement.

The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Procuring Contracting Officer (PCO) or Contracting Officer Representative (COR). Cross teaming may or may not be permitted.

2.5 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the labor categories as defined in the Labor Categories document utilized in the performance of each Task Order issued hereunder will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

2.5.1 Contractor Employee Conduct

The contractors employees shall observe and comply with all applicable departmental and agency regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, etc.). The contractor shall ensure that all contractor employees represent a professional appearance at all times, and that their conduct does not reflect discredit on the United States Government.

When contractor employees are working on Government facilities or participating at Government meetings, they shall wear identification badges distinguishing themselves as such. The badges at a minimum must have the employee name and word "contractor” displayed. Ideally, the company name will appear on the badge.

Additionally, not withstanding any other provisions in the PWS, the contractor shall identify themselves as a contractor in meetings, telephone conversations, all written communications and work situations so that their actions cannot be construed as acts of a Government official. The contractor shall take no actions that bind the government to a final decision or results in the exercise of governmental discretion.

2.5.2 Removal of Contractor Employees for Misconduct or Security Reasons The Government may, at its sole discretion, direct the contractor to remove any contractor employee from Government facilities for misconduct or security reasons. Such removal does not relieve the contractor of the responsibility to provide sufficient qualified personnel for adequate and timely service. The Contracting Officer will provide the contractor with an immediate rationale for removal of contractor employee.

Conflict of Interest. Neither the contractor nor its on‐site employees shall utilize their knowledge of access to information, sensitive or otherwise, for individual or company gain.

2.6 Location and Hours of Work

The work will be a mixture of on-site and off-site and will be defined at the task order level.

Onsite ‐ The headquarters site of the U.S. Army Corps of Engineers, ERDC is 3909 Halls Ferry Road, Vicksburg, MS 39180‐6199. ERDC satellite laboratory sites are located in Alexandria, VA, Champaign, IL, Hanover, NH, and other Government facilities (mainly in the continental United States). Travel will include any potential Army location where assessments are conducted.

Off‐Site – The contractor facility. Travel will include any potential Army location where assessments are conducted.

Core Working Hours. Government core working hours are from 0700 to 1730 local time Monday through Friday except US Federal Holidays. Government workers typically work eight (8) hours per day, 40 hours per week.

Government Facility Closure. In case of government facility closure as directed by the government, contractor employees shall be excused from work at no cost to the government.

2.7 Travel

All travel requirements (including plans, agenda, itinerary, or dates) shall be pre‐approved by the government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99‐234 and FAR 31.205‐46 Travel Costs (subject to local policy and procedures; may reference FAR).

2.8 EQUAL OPPORTUNITY FOR VETERANS

In addition to complying with the requirements outlined in FAR Part 22.13, FAR Provision 52.222- 38, FAR Clause 52.222-35, FAR Clause 52.222-37, DFARS 222.13 and Department of Labor regulations, U.S.

Army Corps of Engineers (USACE) contractors and subcontractors at all tiers are encouraged to promote the training and employment of U.S. veterans while performing under a USACE contract. While no set-aside, evaluation preference, or incentive applies to the solicitation or performance under the resultant contract, USACE contractors are encouraged to seek out highly qualified veterans to perform services under this contract. The following resources are available to assist USACE contractors in their outreach efforts:

Federal Veteran employment information at http://www.fedshirevets.gov/index.aspx Department of Labor Veterans Employment Assistance http://www.dol.gov/vets/ Department of Veterans Affairs–VOW to Hire Heros Act http://benefits.va.gov/vow/ Army Wounded Warrior Program – http://wtc.army.mil/modules/employers/index.html U.S. Chamber of Commerce Foundation–Hiring Our Heros http://www.hiringourheroes.org/ Guide to Hiring Veterans – Reference Material http://www.whitehouse.gov/sites/default/files/docs/white_house_business_council_- _guide_to_hiring_veterans_0.pdf

3 Performance Requirements The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 Cybersecurity

The Contractor shall perform activities relative to the ERDC Security Control Assessor‐Validator (SCA‐V) of the Security Control Assessor‐Army (SCA‐A).

This consists of Risk Management Framework (RMF) assessments for enclaves and major applications throughout the Army. This requires knowledge of the NIST SP 800‐53 controls, as well as DISA STIGs, DoD vulnerability assessment techniques, and applicable DoD and Army cybersecurity regulations.

The systems evaluated range in size from 10 to 10,000 IT assets consisting of Windows 7, Windows 2008R2, 2012, Unix, Linux, Network Devices, Databases, Web Servers, Mail, Active Directory, IDS, Firewalls, Multifunction Devices or any It capability that apply a DISA STIG as a security baseline. Based on the system or application categorization the tests requiring assessment range from 1700 to 3000 RMF checks. For a small effort the teams consist of 2‐3 personnel and for a larger effort the team can be 8 personnel. Project lengths consist of 3‐4 weeks with an on‐site visit of 1 ‐2 weeks depending on the size of the effort. Security Engineering may also be required for some customers that would require the creation of support RMF artifacts such as documentation, network diagrams or the scanning and remediation of security patches on applicable IT assets. The Security Engineering projects have a longer duration of 6‐12 months depending on the size of the effort.

Deliverables A0001 – Monthly Report

3.1.1 Pre‐Visit Teleconference

The Contractor shall schedule a pre‐visit coordination teleconference with the customer POC to finalize logistics to include travel arrangements, required site visit requests through the site FSO, and onsite testing schedule.

Deliverables A002 Schedule of Pre‐Visit Teleconferences

3.1.2 Technical Testing and RMF Controls

The Contractor shall test all applicable security controls as defined in NIST SP 800‐53. Technical testing includes using approved automated tools as documented by NETCOM. The contractor shall annotate all assessment procedures (AP) test results (TR) for the system under test’s delineated security controls in The Enterprise Mission

Assurance Support Service (eMASS) within 30 days of departing onsite for technical testing. The contractor shall provide the government with the raw test data collected during each assessment.

Deliverables A003 Raw Test Data

3.1.3 Post‐Visit Analysis and Documentation

The Contractor shall conduct post‐visit analysis, verification and required documentation of all assessment procedures (AP) test results (TR) discovered during the technical testing IAW DISA STIGs. The contractor shall concisely document all test results for security controls for the system in eMASS.

The contractor shall perform a Risk Assessment Summary in eMASS that contains the following information for each security control of the system:

∙ Status – Current Compliance Status of security controls.

∙ Control Risk Level – Documented risk level for Non‐Compliant controls in the system baseline. Non‐ Compliant security controls are subjected to a risk assessment process that considers multiple factors in producing the risk level as described in DoDI 8510.01, Enclosure 6 and NIST SP 800‐30.

∙ Vulnerability Severity Value – Assigned to all Non‐Compliant security controls to indicate the severity associated with identified vulnerabilities.

∙ Vulnerability Summary – Details an accurate description of the finding:

o 1) An accurate description of finding detail

a) What is the finding

b) Where is it located

c) Why is it a finding o 2) An accurate description of Rationale including

a) Determination of severity level

b) Detail the reason why that severity level was assigned the Description of the finding and the rationale for the vulnerability severity level.

∙ Recommendations – Details potential countermeasures to mitigate/remove the vulnerability.

The contractor shall deliver all documentation to the ITL SCA‐V Team Lead.

Deliverables A004 Risk Assessment Summary

3.1.4 Post‐Visit Teleconference

The Contractor shall conduct a post‐analysis teleconference (sometimes known as a Risk Assessment Working Group – RAWG) with the customer’s point of contact to explain any unresolved issues identified while onsite. The contractor shall provide a draft recommendation memo with a summary of findings and risk determination to the government. A template will be provided through the NETCOM SCA‐V TTP on the RMF knowledge Service.

Deliverables A005 Schedule of RAWG teleconferences A006 Draft recommendation memo

3.2 Security Engineering

The Contractor shall conduct a security engineering for the Information System Owner (ISO) and augment their Cybersecurity staff completing a comprehensive self‐assessment in eMASS, creating draft RMF artifacts such as documentation and network diagrams. The contractor shall provide DISA Benchmark STIG files, Scan results for system administrator to remediate findings. The contractor will engage and work with the organizations staff to accomplish the creation of artifacts and security assessments in preparation for transition to RMF or in preparation for security assessment.

Deliverables A007 Draft RMF Supporting Documentation & Artifacts A008 Complete eMASS Comprehensive Self‐Assessment A009 Produce Security Assessments based on DISA STIGs, SRGs and Benchmarks

4 Special Requirements This section describes the special requirements for this effort. The following sub‐sections provide details of various considerations on this effort.

4.1 Security and Safety

4.1.1 All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable.

The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://www.lms.army.mil

4.1.2 All contractor and all associated sub‐contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

4.1.3 The contractor and all sub‐contractors employees will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely;

(2) Remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

4.1.4 Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (TSDB) (Army Directive 2014‐05 / AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative, as NCIC and TSDB are available), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

4.1.5The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH, Corps Watch, or See Something, Say Something program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after contract award.

4.1.6 All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD

Information Assurance Awareness prior to access to the information systems and then annually thereafter IAW AR 380‐67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors).

4.1.7 The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan must be reviewed and approved by the RA OPSEC Officer. The SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

4.1.8 All new contractor employees will complete Level I OPSEC training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training.

4.1.9 All contractor employees and associated sub‐contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of employment.

4.1.10 All contractor employees supporting IA/IT functions shall be appropriately certified upon contract IAW DoD 8570.01‐M, DFARS 252.239‐7001 and AR 25‐2. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award. The following certifications apply:

Systems Engineer ‐ Senior ‐ IASAE III Systems Engineer ‐ Intermediate ‐ IAM III Systems Engineer ‐ Associate ‐ IAT II Cybersecurity Engineer ‐ Senior ‐ IASAE III Cybersecurity Engineer ‐ Intermediate ‐ IAM III Information Security Specialist ‐ Senior ‐ IAM III Information Security Specialist ‐ Intermediate ‐ IAT III Documentation Specialist ‐ Senior ‐ IAT I Documentation Specialist ‐ Intermediate ‐ IAT I

4.1.11 All contractor employees shall ensure the following AT/OPSEC requirements are meet prior to deploying personnel authorized to accompany U.S. Armed Forces outside the United States: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

4.1.12 The Contractor shall comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M), any revisions to DOD 5220.22‐M and Army Regulation 380‐ 49, Industrial Security. The DD254 will be attached with the contract.

4.1.13 All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

4.1.14 The Prime Contractor Company must have (or will have) a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22‐M and AR 380‐49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380‐67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD254 attached to the contract. If no FCL, the supporting Government Contracting Activity will sponsor the prime contract company in obtaining the FCL.

4.1.15 All new contractor employees will complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381‐12 . The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training.

Authorized webbased TARP training for CAC card holders is available at the following website:

https://www.us.army.mil/suite/page/655474 DD Forms 254: Overarching security requirements and Contractor access to classified information shall be as specified in the basic DD Form 254, which will be further identified in the DD Form 254 for each TO, as required. All contractor personnel with access to unclassified information systems, including e‐mail, shall have at a minimum a favorable National Agency Check (NAC).

Visitor Group Security Agreement. The contractor shall sign a Contractor Visitor Group Security Agreement to protect classified information involved in performance under this contract or Task Order. The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures;

access, accountability, storage, and transmission of classified material; marking requirements; security education;

personnel security clearances; reports; security checks; security guidance; emergency protection; protection of government resources; DD Forms 254; periodic security reviews; and other responsibilities, as required.

4.2 Section not used.

4.3 Government Furnished Materials

Government furnished materials will be specified in each Task Order.

Unless otherwise indicated in a particular task order, the Government will provide all facilities, utilities, equipment and materials necessary to accomplish the work for "on‐site” employees: The government furnished materials are:

Desk Chair Access to copy machine Access to facsimile machine Telephone, including long distance and voicemail Laptop computer (PC) Government furnished computers may be hand‐receipted to the Contractor. The liability for the repair of damaged Government property shall be subject to the terms of the "Government Property clause set forth in Section I of the solicitation and resulting contract. When Government property is furnished to the Contractor, a Government property control receipt will be completed and signed by the Contractor. The property control receipt will indicate the assigned location for use of the property by the Contractor. A copy of the property control receipt will be furnished to the Contractor. Upon return of the Government property to the Government, the Government property control receipt will be completed indicating the return of the property by the Contractor. A copy of the returned property control receipt will be furnished to the Contractor. All Government property furnished to the Contractor shall be accomplished in accordance with this procedure. The Contractor shall establish a property control system for the use, control, protection, and preservation of Government property assigned to the Contractor.

4.4 Environmental Requirements

Not Applicable.

4.5 Applicable Directives

The contractor shall comply with all documents referenced under paragraph 3.0, Performance Requirements and as identified at the task order level.

4.6 Quality

This section describes the Quality Control components for this effort. The following sub‐sections provide details of various considerations on this effort.

4.6.1 Quality Control

The Contractor shall develop an Order Quality Control Plan (QCP) for the base and maintain an effective quality control program to ensure services are performed in accordance with the IDIQ contract and this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non‐recurrence of defective services. The Contractors QCP is the means by which he assures himself that his work complies with the requirement of the contract.

The finalized QCP will be accepted by the Government at the time of the award of the contract. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting

Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the Governments review and approval. The Government may find the QCP "unacceptable" whenever the Contractors procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found "unacceptable."

4.6.2 Quality Assurance Surveillance Plan (QASP)

The Government shall monitor the Contractors performance under this contract in accordance with the Governments QASP. The Government reserves the right to utilize other methods, as necessary, to assure the Contractor's compliance with the terms and conditions of this contract. The Government may inspect services provided by the Contractor both during and/or after performance is complete. If the Government identifies any performance deficiency, the Contractor will be advised of the deficiency as soon as possible. All such notifications will be confirmed in writing with the Contractor by the Government. Such notification will be made only to the Contractor or his/her designated onsite superintendent and not to any other agents, employees, or subcontractors. Upon receipt of such notification, the Contractor shall correct the deficiency within the time specified by the COR. However, in the event that the deficiency represents a hazard to health or safety or it serves to jeopardize operational continuity, then corrective action shall proceed immediately and continue uninterrupted until the correction is affected. In all cases, the correction of performance deficiencies shall not in any way adversely affect other contract performance.

5 Deliverables The contractor shall provide deliverables as described in subsequent task orders. Deliverables shall be specified by the government. Format and delivery schedule for deliverables shall be outlined in CDRLs and/or other means TBD at the task order level. Deliverables will typically fall within the listing below and be specified in individual task orders.

Identifier Name Description

A001 Monthly Report

A002 Schedule of Pre‐Visit Teleconferences

A003 Raw Test Data

A004 Risk Assessment Summary

A005 Schedule of RAWG teleconferences

A006 Draft recommendation memo

A007 Draft RMF Supporting Documentation & Artifacts

A008 Complete eMASS Comprehensive Self‐ Assessment

A009 Produce Security Assessments based on DISA STIGs, SRGs and Benchmarks

Performance Requirement Summary (PRS)

Statements Standards/AQLs Methods of Surveillance

Incentive/ Disincentive

3.1. The Contractor shall

provide Monthly Report of cyber security activities conducted relative

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective

Periodic Inspections

Customer Feedback

Performance Rating according to Rating Criteria in Table 1.

to the ERDC Security Control Assessor‐Validator.

actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

e) STD: Responsive

AQL: 95%

3.2 The Contractor shall

Report of security engineering activities conducted relative to the Information System Owner (ISO)

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

Periodic Inspections

Customer Feedback

Performance

Table 1

Performance Requirement Summary (PRS) Performance Ratings

Performance Rating

Criteria

Excellent / Outstanding Performance meets contractual requirements and exceeds many to the government’s benefits. The contractual performance of the element or sub‐ element being assessed was accomplished with no problems and contractor actions were highly effective.

Very Good Performance meets contractual requirements and exceeds some to the government benefits. The contractual performance was accomplished with few minor problems for which corrective actions taken by the contractor were effective.

Good Performance meets contractual requirements. The contractual performance contains some minor problems for which corrective actions taken by the contractor were satisfactory.

Marginal Performance does not meet some contractual requirements. The contractual performance reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

Performance Requirement Summary (PRS)

Statements Standards/AQLs Methods of Surveillance

Incentive/ Disincentive

3.1. The Contractor shall

Report of cyber security activities conducted relative to the ERDC Security Control Assessor‐Validator.

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

Customer Feedback

Performance Rating according to Rating Criteria in Table 1.

3.2 The Contractor shall

provide Monthly Report of security engineering activities conducted relative to the Information System Owner (ISO)

a) STD: Accurate

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

Customer Feedback

Performance

Table 1

Performance Requirement Summary (PRS) Performance Ratings

Performance Rating

Criteria

Excellent / Outstanding Performance meets contractual requirements and exceeds many to the government’s benefits. The contractual performance of the element or sub‐ element being assessed was accomplished with no problems and contractor actions were highly effective.

Very Good Performance meets contractual requirements and exceeds some to the government benefits. The contractual performance was accomplished with few minor problems for which corrective actions taken by the contractor were effective.

Good Performance meets contractual requirements. The contractual performance contains some minor problems for which corrective actions taken by the contractor were satisfactory.

Marginal Performance does not meet some contractual requirements. The contractual performance reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

SECTION J - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

The following have been modified:

QUESTIONS AND ANSWERS

QUESTIONS AND ANSWERS FOR ERDC SOLICITATION W912HZ-16-R-0013

(Answers are in Bold)

1. On the DD254, Page 2, Block 13, Ref 10g. The second sentence seems to be incomplete.

Personnel with access to NATO ATOMAL ………. DD254 has been corrected by ERDC Security

2. Section 3.6.5 states " Offeror shall identify up to seven (7) of its most relevant contracts or efforts within the past three (3) years". Is this only relevant to the Offeror or can it be a combination of the Offeror & it's subcontractors? For example (3) from the offeror and (3) from the Subcontractor. Please refer to section 3.6.5. There must be evidence in your proposal submission indicating the subcontractor is bound / obligated to support this requirement.

3. Per attachment D, there is no SCI clearance required for the employees. In sections 4.1.13 of the solicitation, it references “appropriate security clearance.” What is the required clearance? Secret. See revised DD254.

4. The Government is asking for a Transition/Phase-In Plan, “should address the Offerors approach to ensure a seamless transition with outgoing contractor.” Question: Block 4 of the DD 254 indicates this is NOT a follow-on contract; so, is there an incumbent contractor for Offeror to transition from? No. See revised Section L.

5. Can the Government provide a two year forecast of Task Order requirements (to include estimated resource requirements, project durations, start/finish dates, etc)? The sample task order PWS has been revised to include a period of performance.

6. Can the Government project the estimated resource requirements by geographical site?

This is a performance based requirement. The government does not specify the type and/or number of personnel.

7. For the past performance references, do contracts have to have been completed or can they be in-progress contracts? They can be “in-progress contracts”

8. Section L, 3.8, references that “legal documents outlining joint ventures or partnering arrangements” should be included. Does that mean copies of TAs (teaming agreements) with our subcontractors? Yes, please include teaming agreements if they are official agreements.

9. There are only three CLINs listed on the SF1449—are these for the sample task order? Are these CLINs for just one year? Was this a mistake? The SF1449 CLINs are for the BASE IDIQ. Each CLIN is for the five year level of effort. No monetary amounts are to be entered by the offeror in Section B. The government will complete Section B at time of award.

10. Are there specific years of experience or education requirements for the labor categories listed in Attachment A? Are specific qualifications up to the Offeror? Per FAR 39.104, When acquiring information technology services, solicitations must not describe any minimum experience or educational requirement for proposed contractor personnel.

11. We understand Vicksburg is Headquarters, but the solicitation references Vicksburg, Alexandria, VA, Hanover, NH and Champaign IL and paragraph 2.6 states work could include any potential Army location. What would some potential locations be? See revised PWS.

12. DD 254- SIPRNET access is required. Are we to assume that means only from a Government facility? Section 4.3 says Government provides all facilities. DD 254 (Block

10) also says we must be able to receive and generate classified material – Does this mean e-mail too? If the contractor has the capability to access SIPRNET from their facility, it can be utilized. Otherwise, SIPRNET access will be from a government facility.

This includes email. Section 4.3 of the PWS has been revised.

13. Does the OPSEC coordinator have to be on-site in Vicksburg or is the position remote?

Remote.

14. Past Performance Requirement states: To the extent that the Offeror intends to subcontract significant portions of the effort, for each subcontractor the Offeror shall identify up to three (3) of the most relevant contracts or efforts within the past three (3) years. Is this in addition to the seven (7) from the Prime? The government assumes the question is referring to Section L 3.6.5 under the technical requirement rather than the Past Performance requirement. Yes, only if relevant to this requirement and There must be evidence in your proposal submission indicating the subcontractor is bound / obligated to support the requirement.

15. Paragraph 3.6.6. Subfactor 3: Management Approach and Processes: The fourth paragraph states: For key subcontractors (defined as any subcontractor or teaming partner that will be performing more than 10% of the work), Does 10% of the work mean at the IDIQ level or task order level? IDIQ level

16. For paragraph 3.3.2 “Use of tabs and dividers is encouraged.”- Do these tabs/dividers count toward page count? No

17. For paragraph 3.4 Formatting and Page Limitations “Times New Roman font type and font size 12 for text pages”. What is the font type and font size for Tables and graphics? Font type and font size shall be appropriate for spreadsheets, charts, tables, diagrams, or design drawings. The font must be legible without electronic enlargement.

18. For paragraph 3.6.3 Introduction states “shall briefly state the purpose and content of the proposal”. Is this to be considered an executive summary? What is the page limit?

Vendors have been known to label this section as an executive summary. Please limit the Introduction to one page or less.

19. Volume III Price Proposal: ODC Cost Rate: it is unclear how we should price this or how it will be evaluated. Can Government provide clarification? See change in section M 2.3

20. Section L requires Section B to be filled out in a manner that is not set up for in the section B format provided, and how do you cost travel by Job when every task order will be different? Page 3 & 4, Section B. No monetary amounts are to be entered by the offeror on SF1449 Section B. The government will complete Section B at time of award. See amendment revised Section L.

21. Can the compensation plan be a separate document as that alone can exceed the page count for the Management Section? Page 78, section 3.6.6, last sentence.

The page limitation has been increased to 40. See revised solicitation.

22. What is the “bidding schedule” to be completed? Page 80, section 3.8, 4th bullet from the bottom of the page. No monetary amounts are to be entered by the offeror in Section B.

The government will complete Section B at time of award. The contractor is only required to complete the schedule of labor categories and rates provided in Attachment A in addition to the Sample Task Order Pricing based on rates in Attachment A. See Revised Section L 3.8.

23. If we current in SAM are we still required to complete Section K? Page 80, section 3.8, 3rd bullet from the bottom of the page. See Amendment. See revised Section L 3.8

24. Section B is not set up for what you request. How are we to provide fully loaded labor rates for all labor categories for five years in Section B? Page 80, section 3.8, last bullet.

No monetary amounts are to be entered by the offeror in Section B. The government will complete Section B at time of award. See Amendment revised Section L

25. Are all labor categories considered FTE’s and do you want fully loaded annual costs for each of the labor categories proposed? Attachment 4. Labor rates need to be fully burdened. The Task Order will be performance based on the appropriate level of effort the task order PWS. Fully burdened FFP labor rates are required per attachment A. The government made the assumption you were referring to attachment A

26. How do we cost ODC’s, which should only be travel, when we do not know the locations we will travel, how long or how frequent? Attachment 4. The government assumes this question is referring to the Price Proposal for the Sample Task Order. Please see revised Sample Task Order PWS.

27. If attachment 4 is not all FTE’s, how are you evaluating total price? Page 81, section 3.8, 1st bullet The government made the assumption you were referring to attachment A.

Please see section M.

28. Why is everything being evaluated for two years when attachment 4 is five years? Page 81, section 3.8, 1st bullet See Amendment. See revised section L 3.8.

29. How do you provide a total cost when the sample task order talks about travel to other locations? To provide a total cost, to include travel, we would need locations, approximate dates and duration, or is the travel to other locations going to be under separate task orders?

Page 81, section 3.8, 2nd bullet, Sample Task Order. See revised Sample Task Order

PWS.

30. What is the period of performance for this sample task order? See revised Sample Task Order

31. How do we cost travel IAW section L of RFP if do not have travel identified? Sample Task Order Section 2.7. The government assumes this question is related to the price proposal for Sample Task Order 0001. Travel locations have been identified in the Sample Task Order PWS. Please see revised Sample Task Order PWS.

32. How many current employees need to be transferred for this task order? Sample Task Order Section 4.2 Sample Task Order has been revised to delete section 4.2

33. In Subfactor 2: Experience the government states “Relevant corporate experience is experience (within the last 3 years) that is of the same or similar scope and complexity to the work described in the Performance Work Statement, and is of the same or similar magnitude (i.e., performing services that, on an annual basis, are at least half the dollar value proposed by the Offeror to perform the Performance Work Statement’s requirements).” When talking about the “at least half dollar value as proposed by the offeror” is the government saying that for the cited reference that at least half the work must be relevant to the USACE…