W912PQ-20-Q-0052.pdf

SEE ADDENDUM

(No Collect Calls)

W912PQ20Q0052 23-Sep-2020

b. TELEPHONE NUMBER

518-786-4739

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 25 Sep 2020

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912PQ9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

HEMWATIE RAMASAMI

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011542066

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

USPFO NY PURCHASING & CONTRACTING

330 OLD NISKAYUNA ROAD

LATHAM NY 12110-2224

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W56PPG 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

JFHQ-NY, ATTN: MNCI

JFHQ-NY

330 OLD NISKAYUNA ROAD

LATHAM NY 12110

TEL: FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$41,500,000

NAICS:

511210

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF76

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W912PQ20Q0052

Section SF 1449 - CONTINUATION SHEET

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

FOR

SOLARWINDS ACCESS RIGHTS MANAGER (ARM) AND ORION INTEGRATION

SERVICE CONTRACT

NEW YORK ARMY NATIONAL GUARD

(PERIOD OF PERFORMANCE: 1 YEAR: 30 SEP 20 TO 29 SEP 21 WITH 4 OPTION

YEARS)

1.0 General: The New York National Guard (NYARNG) has a requirement to improve the capability and usability of active directory (AD), along with providing an auditing and management solution. This can be accomplished using the Solarwinds Access Rights Manager (ARM) application which would work cooperatively with the existing Solarwinds Orion product. This will provide a crucial component for compliance in the upcoming Command Cyber Readiness Inspection (CCRI) currently scheduled for August of 2021. The contractor will be required to configure ARM and Orion, ensure interoperability, and provide training for both Solarwind Orion and ARM products. With the COVID-19 situation, the contractor will configure and training in person (preferred) or live virtual. No self-pace training.

1.1 Scope: This performance work statement (PWS) defines requirements for the contractor to maintain, patch, upgrade and provide help desk availability to maintain the performance and efficiency of the application. This requirement is for Orion and ARM products.

1.2 Background: The MNCI Directorate of the New York State Division of Military and Naval Affairs (DMNA) requires acquisition, configuration, and Secure Technical Implementation Guidance (STIG) compliance of Solarwinds Active Rights Manager (ARM) to work cooperatively with an existing Solarwinds product (Orion) to provide highly effective Information Technology infrastructure auditing and management that is required for the NYARNG Cyber Command Readiness Inspection (CCRI). To execute this initiative properly MNCI requires on-site configuration and setup of Solarwinds Access Rights Manager (ARM) and Orion products.

1.3 Period of Performance (PoP): The Period of Performance will be on-site between:

30 September 2020 to 29 September 2021.

1.3.1 Place of Performance: 330 Old Niskayuna Road, Latham, NY 12110. If any Virtual training, it will take place on either Microsoft Teams or Cisco WEBEX platforms.

1.4 General Information:

1.4.1 Quality Control (QC): The contractor will maintain an effective QC plan (QCP) to ensure services are performed in accordance with the PWS. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements to the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in paragraph 6.1.2 (required end state).

1.4.2 Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP) (

Appendix E). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality levels.

1.4.3 Recognized Holidays: the following are recognized US Holidays. The contractor shall not be required to perform services on these days:

1.4.3.1 New Year’s Day: January 1st

1.4.3.2 Martin Luther King, Jr.’s Birthday

1.4.3.3 President’s Day

1.4.3.4 Memorial Day

1.4.3.5 Independence Day: July 4th

1.4.3.6 Labor Day

1.4.3.7 Columbus Day

1.4.3.8 Veteran’s Day: November 11th

1.4.3.9 Thanksgiving Day

1.4.3.10 Christmas Day

1.4.5 Security Requirements: On-site technician/contractor, shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the Division of Military and Naval Affairs Chief Information Officer (CIO). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the agency. The contractor shall ensure compliance with all personal identity verification requirements as directed by The Division of Military and Naval Affairs and/or other local policy. Should the Force Protection Condition (FPCON) change, the Government may require changes in contractor security matters or processes.

1.4.5.1 COMSEC/IT Security. All communications with DOD organizations are subject to Communications Security (COMSEC) review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations.

DOD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DOD organizations.

Therefore, the contractor is advised that any time contractor place or receive a call they are subject to COMSEC procedures. The contractor is require before coming to site to be properly vetted through NYARNG J2, and have a clearance level of SECRET. The contrctor shall ensure wide and frequent dissemination of the above information to all employees dealing with DOD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

1.4.5.3 Protection of Personally Identifiable Information (PII). The contractor shall protect all Personally Identifiable Information (PII) encountered in the performance of services in accordance with DFARS 224.103 and DoDD 5400.11, Department of

Defense Privacy Program, and DoD 5400.11-R. If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who’s PII has been compromised.

2.0 Definitions and Acronyms:

2.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.3 DELIVERABLE. Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.4 KEY PERSONNEL. Familiarity with Orion products 2019.4 and ARMs 2019.4

NPM

NTM

IPAM

NTA

Netpath

NCM

Orion Core ARM Core

Orion installed in both the SIPR/NIPR networks. ARM installed only on NIPR network.

2.1.5 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.6 QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.7 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.8 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.9 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.10 WORK DAY. N/A.

2.1.11 WORK WEEK. N/A.

2.2 ACRONYMS:

AEI Army Enterprise Infostructure AT/OPSEC Antiterrorism/Operational Security CIO Chief Information Officer DFARS Defense Federal Acquisition Regulation Supplement DMNA Division of Military and Naval Affairs (New York State) DOD Department of Defense FSO Facility Security Officer/Supervisor GFP/M/E/S Government Furnished Property/Material/Equipment/Services

IA Information Assurance IS Information System(s) OCI Organizational Conflict of Interest ODC Other Direct Costs PII Personally Identifiable Information PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S):

N/A.

4.0 N/A.

5.0 Requirements. Contractor will have proper clearance (Secret) provide all updates, patches, software revisions and normal workday access to technical support as required to allow continuous function of the application.

5.1.1 Updates/upgrades are provided as required to maintain normal function of the application.

5.1.2 Patches are provided as required to maintain normal function of the application.

5.1.3 Access to vendor technical support via telephone or email.

5.1.4 Access to technical support is provided by e-mail or telephone.

5.1.5 Access to Technician Technical Support for issues that cannot be resolved by the above.

5.1.6 Requires to be contractors before coming to site to be properly vetted through

NYARNG J2.

6.1 General Description. Below is a general description of what currently exists followed by the desired end-state.

6.1.1 Current: The MNCI directorate currently has both Solarwind Orion and ARM products in our NYARNG virtual server infrastructure. Orion installed on both SIPR and NIPR networks. ARM installed only on the NIPR network. Both products are currently on

2019.4 but due to STIG requirements might be updated to the latest version. The MNCI Directorate requires either on-site configuration support or live virtual support of both Solarwind ARM and Orion. Orion is currently monitoring 265 out of 500 nodes and Orion NPM is monitoring 208 out of 500 nodes. ARM is monitoring NYARNG organizational unit (OU) and is monitoring permissions on all NYARNG file servers. MNCI staff requires the Solarwinds products to be compliant for NYARNG Cyber Command Readiness Inspection (CCRI) and be configure to assist MNCI staff to be in compliance for CCRI. This must be done without additional 3rd party solutions that will incur additional costs to DMNA. Due to COVID-19, Employees of MNCI are working both in person and virtual during the hours of 0700-1700.

6.1.2 Required End State: Configuration, integration and compliance all of NYARNG Solarwinds products to achieve a compliant and integrated software solution in which it will be use as a requirement for successful IT infrastructure management and control necessary for the passing of NYARNG CCRI in August 2021.

6.1.3 Functional Specs: The requirements described below MUST be included in the solution quoted/proposed. Requirements:

6.1.3.1 This contract will provide:

6.1.3.1.1 Installation, configuration, and make compliant software:

6.1.3.1.2 Solarwinds Access Rights Manager (ARM)

Analysis and configured ARMS based on NYARNG Infrastructure

• Workflows/templates that need to be created and tested (Appendix A)

General user:

• New users request

• File share group request

• Change position request

• Renewal of account

• Privilege user:

• New user request

• User Data Owner Request

• Renewal of account

• Change Data Owner Request

• Recertification of user account

• Create CCRI reports (Appendix B)

• Make CCRI Compliant (Appendix C)

• Configure Data Owner Hierarchy

• Configure Active Directory Logga

• Configure File Server Logga

• Configure User Management

• Configure Dashboards

• Configure web client

• Allow administrators to add notes to user accounts and groups

• Set up Permission Analysis on both Active Directory and File Server

• Set up Security Monitoring on both Active Directory and File Server

• Setup and configure Role and Process Optimization

• Set up scans for both AD and File Shares

• Set up and teach how to create templates

• Set up Easy Connect CSV and SQL

• Set up alerts and custom reports (Appendix D)

• Set up and configure Data Owners infrastructure

• Set up and define ARM user’s roles and permissions.

6.1.3.1.3 Solarwinds Orion:

• Analysis and configured ARMS based on NYARNG NIPR/SIPR

Infrastructures

• Create and configure Executive Dashboard

• Compliance for CCRI

• Complete upgrade to the latest version

• Configure new features of the most recent version

• Maximize the usage of NYARNG Orion product based on current licensing

• Configure and check STIG Compliance checker

• Set up generating network visualization

• Configure device lifecycle management

• Set up configuration backup

• Set up alerts custom, monitors, and reports

• Set up DNS and DHCP Monitoring and Management

• Set up SysLog and Orion Log monitoring

• Set up Monitoring of ASA

• Set up Monitoring of wireless networks

• Create custom monitors in NPM

• Set up monitoring of Hardware Health

• Proper account provisioning

• IPAM VMware Integration setup

• Set up Net flow management

6.1.3.1.4 System testing and validation

• Capture equipment status and configuration report

• Create Solarwinds Support request to update configuration information

• Verify configuration aligns with the design

6.1.3.1.5 Instruction and education

Instruct and educate selected users of Solarwinds ARM and Orion products and configuration Create how-to guides based on the configuration of NYARNG

Solarwinds environment

6.1.3.1.6 Optional Requirements: None.

Appendixes Appendix A Appendix B Appendix C Appendix D Appendix E

Appendix A The following are a combination of workflow to include creating templates and recertification request.

General user:

New user’s request- General user logs into ARMS web portal, filling out a form to request an account and uploads the forms. Then routes to J2 that can check user’s security level. Once J2 approves, route to IA for final approval which then creates the account in Active Directory and associates the account to the right groups.

File Share Group Request- General user logs into ARMS web portal, fills out a form to request access to a file share. Routes to data owner of the share drive.

Change position- General user logs into ARMS web portal, fills out a form to request change of position, routes to IA for final approval

Renewal of account- General user logs into ARMS web portal, fills out a form to request renewal of account to included uploading documents/certification.

Privilege user:

New Privilege User Request- Potential privilege user logs into ARMS web portal, filling out a form to request an account and uploads the forms.

Routes to IA for final approval which then creates the account in Active Directory, associate Data Owner, and associates the account to the right groups.

User Data Owner Request- Privilege user logs into ARMS web portal, fills out a form to request to be a Data Owner. Routes to IA and add them to data owner.

Renewal of Account- Privilege user logs into ARMS web portal, fills out a form to request renewal of account every three months. Routes to IA for approval.

Change Data Owner Request- Privilege user logs into ARMS web portal, fills out a form to request to change Data Owner. Routes to IA and change them to new data owner.

Recertification of user account- Privilege users logs into the ARMs web portal, fill out a form and upload documentations. Routes to IA for approval.

Appendix B The following are the CCRI reports that need to be created/set up

Who is in each file share group permissions

Who is in privilege groups What file share groups belong in each file share What level of privilege does each group/account have on a file share Who has access where Group Membership and account details Inactive accounts Local accounts on servers

Appendix C The following is to make Solarwinds Products CCRI Compliant:

Make sure both Solarwinds Orion and ARMs up to date with the latest

STIG

Make sure both Solarwinds Orion and ARMs are up to the latest National Guard Bureau support OS and software

Make sure both Solarwinds Orion and ARMs have SSL Certificates Appendix D Setup, configure, and create alerts on the following reports:

Set up and configure reports to be run on web client ARMs, Active Directory, and File share.

Active Directory OU members and group membership Who has passwords on their accounts Permission differences Directories who owners are not administrators Usage of everyone and authenticated users Unresolved SIDs Direct permissions Who has access through which permission groups Where do employees of a manager have access

Appendix E

QUALITY ASSURANCE SURVEILLANCE PLAN

For: SOLARWINDS ACCESS RIGHTS MANAGER (ARM) AND ORION INTEGRATION

SERVICE CONTRACT

Contract Number:

Contract Description:

Contractor’s name: Solar Winds (hereafter referred to as the contractor).

1. PURPOSE.

This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:

What will be monitored.

How monitoring will take place.

Who will conduct the monitoring.

How monitoring efforts and results will be documented.

This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance. In addition, the QASP should recognize that unforeseen and uncontrollable situations may occur.

This QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor.

Updates shall ensure that the QASP remains a valid, useful, and enforceable document.

Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

The following FAR clauses may apply depending on contract type:

N/A.

2. GOVERNMENT ROLES AND RESPONSIBILITIES.

The following personnel shall oversee and coordinate surveillance activities.

a. Contracting Officer (KO) - The KO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and shall safeguard the interests of the United States in the contractual relationship. The KO shall also ensure that the contractor receives impartial, fair, and equitable treatment under this contract. The KO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

Assigned KO:

Organization or Agency: New York State Division of Military and Naval Affairs Telephone: (518) 786- Email:

b. Contract Specialist (KS) - The KS acts as an acquisition consultant and serves as liaison between the TMA Contract Operations Division – Falls Church (COD-FC) and the requesting program office, as well as liaison between the TRICARE Management Activity (TMA) and the supporting contracting office.

Assigned KS:

Telephone: (518) 786- Email: .civ@mail.mil

c. Contracting Officer’s Representative (COR) - The COR is responsible for technical administration of the contract and shall assure proper Government surveillance of the contractor’s performance. The COR shall keep a quality assurance file. At the conclusion of the contract or when requested by the KO, the COR shall provide documentation to the KO. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf. The contractor shall refer any changes they deem may affect contract price, terms, or conditions to the KO for action.

Assigned COR: Dennis D. Kavanagh Telephone: 518-786-4819 Email: dennis.d.kavanagh.civ@mail.mil

Other Key Government Personnel –

Title: Systems Administrator Name: Ms Jeanette Gibson Telephone: (518) 786-4872 Email: Jeanette.m.gibson5.mil@mail.mil

Title: Network Manager Name: SFC John Mustico Telephone: (518) 786-4818 Email: john.m.mustico.mil@mail.mil

3. CONTRACTOR REPRESENTATIVES:

The following employees of the contractor serve as the contractor’s Program Manager and Task Manager for this contract.

a. Program Manager - Telephone:

Email:

b. Task Manager - Telephone:

Email:

c. Other Contractor Personnel - Title:

Telephone:

Email:

4. PERFORMANCE STANDARDS.

Performance standards define desired services. The Government performs surveillance to determine if the contractor exceeds, meets or does not meet these standards.

The Performance Requirements Summary Matrix, paragraph in the Performance Work Statement includes performance standards. The Government shall use these standards to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

Performance Requirements Summary

This Performance Requirements Summary includes performance standards. The Government will use these standards to determine contractor performance and will compare contractor performance to the Acceptable Quality Level (AQL).

PWS Paragraph Task Performance Standard

Acceptable Quality Levels

(AQL)

Surveillance Method / By

Whom

Para. 6.1.3.1.1

The contractor shall provide a configured and compliant application.

Installation.

Application and updates/upgrades are installed, tested and certified as fully functional by MNCI Staff.

Application meets performance standards.

Network Administrator confirms proper functioning.

Report to COR.

Para. 6.1.3.1.2

The contractor will ensure applications configured to

NYARNG

infrastructure with all with all workflows and templates created and tested IAW App A, B, C, and D

Applications are correctly configured and templates and workflows functioning IAW App A, B, C, and

D

Application meets performance standards.

Network Administrator and Network Manager confirms proper

Para. 6.1.3.1.3

The contractor shall ensure configuration system testing and validation meets all

STIG And CCRI implementation requirements for NIPR and SIPR infrastructures.

Contractor provides properly vetted and credentialed personnel to work on

NIPR and SIPR enclaves.

Configuration meets all STIG and CCRI implementation and configuration standards for

NIPR and SIPR infrastructures.

Contractor personnel are properly vetted and credentialed.

Application meets performance standards.

Network Administrator and Network Manager confirms proper

Para. 6.1.3.1.4

Contractor provides validated system testing configuration reports and verifies configuration aligns with requested design.

Validated testing and configuration report verifies configuration and alignment with requested design.

Application meets performance standards.

Network Administrator and Network Manager confirms proper

Para. 6.1.3.1.5 Contractor provides instruction/education to select users on

Selected users receive appropriate level

Application meets

Network Administrator and Network Manager applications and production/reports to include how-to guides based on the configuration of the

Solar Winds environment created.

of training and reference materials to effectively and efficiently enter data, create/receive reports.

performance standards.

confirms proper

5. INCENTIVES. N/A.

6. METHODS OF QA SURVEILLANCE.

Various methods exist to monitor performance. The COR shall use the surveillance methods listed below in the administration of this QASP.

Regardless of the surveillance method, the COR shall always contact the contractor's task manager or on-site representative when a defect is identified and inform the manager of the specifics of the problem. The COR, with assistance from the COD KS, shall be responsible for monitoring the contractor’s performance in meeting a specific performance standard/AQL.

a. DIRECT OBSERVATION.

b. MANAGEMENT INFORMATION SYSTEMS (MIS).

c. PERIODIC INSPECTION.

d. USER SURVEY. .

e. VALIDATED USER/CUSTOMER COMPLAINTS. PWS.

f. PERIODIC SAMPLING.

g. RANDOM SAMPLING.

Surveillance results may be used as the basis for actions (to include payment deductions) against the contractor. In such cases, the Inspection of Services clause in the Contract becomes the basis for the KO’s actions.

8. RATINGS.

Metrics and methods are designed to determine if performance exceeds, meets, or does not meet a given standard and acceptable quality level. A rating scale shall be used to determine a positive, neutral, or negative outcome. The following ratings shall be used:

EXCEPTIONAL:

Performance significantly exceeds contract requirements to the Government’s benefit.

SATISFACTORY: Performance meets contractual requirements.

UNSATISFACTORY: Performance does not meet contractual requirements.

9. DOCUMENTING PERFORMANCE.

a. ACCEPTABLE PERFORMANCE.

The Government shall document positive performance. A report template is attached.

Any report may become a part of the supporting documentation for fixed fee payments, award fee payments, or other actions.

b. UNACCEPTABLE PERFORMANCE.

When unacceptable performance occurs, the COR shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR shall document the discussion and place it in the COR file.

When the COR determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR), and present it to the contractor's task manager or on-site representative. A CDR template is attach to this QASP.

The contractor shall acknowledge receipt of the CDR in writing. The CDR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government shall review the contractor's corrective action plan to determine acceptability.

Any CDRs may become a part of the supporting documentation for contract payment deductions, fixed fee deductions, award fee nonpayment, or other actions deemed necessary by the KO.

10. FREQUENCY OF MEASUREMENT.

a. Frequency of Measurement.

During contract/order performance, the COR shall take periodic measurements, weekly as specified in the AQL column of the Performance Standards Summary Matrix, and shall analyze whether the negotiated frequency of measurement is appropriate for the work being performed.

b. Frequency of Performance Assessment Meetings.

The COR shall meet with the contractor quarterly to assess performance and shall provide a written assessment.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months Solarwinds Support and Training

FFP

Solarwinds Support and Training FOB: Destination

PURCHASE REQUEST NUMBER: 0011542066

PSC CD: D306

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0002 1 Job Contractor Manpower Reporting

FFP

Contractor Manpower Reporting (CMR): The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract. The contractor is required to completely fill in all required data fields using the following web address:

www.sam.gov.

The Contractor shall report, in accordance with paragraphs (c) and (d) of this clause, annually by October 31, for services performed during the preceding Government fiscal year (October 1-September 30) under this contract for orders that exceed the thresholds established in 4.1703(a)(2).

(c) The Contractor shall report the following information:

(1) Contract number and order number.

(2) The total dollar amount invoiced for services performed during the previous Government fiscal year under the order.

(3) The number of Contractor direct labor hours expended on the services performed during the previous Government fiscal year.

(4) Data reported by subcontractors under paragraph (f) of this clause.

(d) The information required in paragraph (c) of this clause shall be submitted via the internet at www.sam.gov. (See SAM User Guide). Contractors may direct questions to the help desk at www.sam.gov

FOB: Destination

PSC CD: D306

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 30-SEP-2020 TO

29-SEP-2021

N/A JFHQ-NY, ATTN: MNCI

JFHQ-NY

330 OLD NISKAYUNA ROAD

LATHAM NY 12110

FOB: Destination

W56PPG

0002 N/A N/A N/A N/A

CLAUSES INCORPORATED BY REFERENCE

52.204-7 System for Award Management OCT 2018 52.204-10 Reporting Executive Compensation and First-Tier

Subcontract Awards

JUN 2020

52.204-13 System for Award Management Maintenance OCT 2018 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-22 Alternative Line Item Proposal JAN 2017 52.204-23 Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

JUL 2018

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment.

AUG 2020

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

AUG 2020

52.204-26 Covered Telecommunications Equipment or Services-- Representation.

DEC 2019

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations--Representation

NOV 2015

52.209-6 Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, or Proposed for Debarment

JUN 2020

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations

NOV 2015

52.212-1 (Dev) Instructions to Offerors - Commercial Items. (DEVIATION 2018-O0018)

JUN 2020

52.212-4 Contract Terms and Conditions--Commercial Items OCT 2018 52.214-34 Submission Of Offers In The English Language APR 1991 52.214-35 Submission Of Offers In U.S. Currency APR 1991 52.219-6 (Dev) Notice of Total Small Business Set-Aside (DEVIATION

2020-O0008).

MAR 2020

52.222-3 Convict Labor JUN 2003 52.222-21 Prohibition Of Segregated Facilities APR 2015 52.222-26 Equal Opportunity SEP 2016 52.222-41 Service Contract Labor Standards AUG 2018 52.222-50 Combating Trafficking in Persons JAN 2019 52.222-55 Minimum Wages Under Executive Order 13658 DEC 2015 52.222-62 Paid Sick Leave Under Executive Order 13706 JAN 2017

52.223-18 Encouraging Contractor Policies To Ban Text Messaging While Driving

JUN 2020

52.225-13 Restrictions on Certain Foreign Purchases JUN 2008 52.232-33 Payment by Electronic Funds Transfer--System for Award

Management

OCT 2018

52.233-1 Disputes MAY 2014 52.233-3 Protest After Award AUG 1996 52.237-3 Continuity Of Services JAN 1991 52.242-15 Stop-Work Order AUG 1989 52.247-34 F.O.B. Destination NOV 1991 52.253-1 Computer Generated Forms JAN 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7008 Compliance With Safeguarding Covered Defense Information

Controls

OCT 2016

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information

OCT 2016

252.225-7001 Buy American And Balance Of Payments Program-- Basic DEC 2017 252.225-7002 Qualifying Country Sources As Subcontractors DEC 2017 252.225-7051 Prohibition on Acquisition of Certain Foreign Commercial

Satellite Services.

DEC 2018

252.225-7051 Prohibition on Acquisition of Certain Foreign Commercial Satellite Services.

DEC 2018

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.239-7001 Information Assurance Contractor Training and Certification JAN 2008 252.243-7001 Pricing Of Contract Modifications DEC 1991 252.247-7023 Transportation of Supplies by Sea FEB 2019

CLAUSES INCORPORATED BY FULL TEXT

52.203-18 PROHIBITION ON CONTRACTING WITH ENTITIES THAT REQUIRE CERTAIN INTERNAL

CONFIDENTIALITY AGREEMENTS OR STATEMENTS--REPRESENTATION (JAN 2017)

(a) Definition. As used in this provision-- Internal confidentiality agreement or statement, subcontract, and subcontractor, are defined in the clause at 52.203- 19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements.

(b) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions), Government agencies are not permitted to use funds appropriated (or otherwise made available) for contracts with an entity that requires employees or subcontractors of such entity seeking to report waste, fraud, or abuse to sign internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

(c) The prohibition in paragraph (b) of this provision does not contravene requirements applicable to Standard Form 312, (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(d) Representation. By submission of its offer, the Offeror represents that it will not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

(End of provision)

52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS OR

STATEMENTS (JAN 2017)

(a) Definitions. As used in this clause-- Internal confidentiality agreement or statement means a confidentiality agreement or any other written statement that the contractor requires any of its employees or subcontractors to sign regarding nondisclosure of contractor information, except that it does not include confidentiality agreements arising out of civil litigation or confidentiality agreements that contractor employees or subcontractors sign at the behest of a Federal agency.

Subcontract means any contract as defined in subpart 2.1 entered into by a subcontractor to furnish supplies or services for performance of a prime contract or a subcontract. It includes but is not limited to purchase orders, and changes and modifications to purchase orders.

Subcontractor means any supplier, distributor, vendor, or firm (including a consultant) that furnishes supplies or services to or for a prime contractor or another subcontractor.

(b) The Contractor shall not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

(c) The Contractor shall notify current employees and subcontractors that prohibitions and restrictions of any preexisting internal confidentiality agreements or statements covered by this clause, to the extent that such prohibitions and restrictions are inconsistent with the prohibitions of this clause, are no longer in effect.

(d) The prohibition in paragraph (b) of this clause does not contravene requirements applicable to Standard Form 312 (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(e) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015, (Pub. L. 113-235), and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions) use of funds appropriated (or otherwise made available) is prohibited, if the Government determines that the Contractor is not in compliance with the provisions of this clause.

(f) The Contractor shall include the substance of this clause, including this paragraph (f), in subcontracts under such contracts.

(End of clause)

52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS OR

STATEMENTS (JAN 2017)

(a) Definitions. As used in this clause-- Internal confidentiality agreement or statement means a confidentiality agreement or any other written statement that the contractor requires any of its employees or subcontractors to sign regarding nondisclosure of contractor information, except that it does not include confidentiality agreements arising out of civil litigation or confidentiality agreements that contractor employees or subcontractors sign at the behest of a Federal agency.

Subcontract means any contract as defined in subpart 2.1 entered into by a subcontractor to furnish supplies or services for performance of a prime contract or a subcontract. It includes but is not limited to purchase orders, and changes and modifications to purchase orders.

Subcontractor means any supplier, distributor, vendor, or firm (including a consultant) that furnishes supplies or services to or for a prime contractor or another subcontractor.

(b) The Contractor shall not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

(c) The Contractor shall notify current employees and subcontractors that prohibitions and restrictions of any preexisting internal confidentiality agreements or statements covered by this clause, to the extent that such prohibitions and restrictions are inconsistent with the prohibitions of this clause, are no longer in effect.

(d) The prohibition in paragraph (b) of this clause does not contravene requirements applicable to Standard Form 312 (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(e) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015, (Pub. L. 113-235), and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions) use of funds appropriated (or otherwise made available) is prohibited, if the Government determines that the Contractor is not in compliance with the provisions of this clause.

(f) The Contractor shall include the substance of this clause, including this paragraph (f), in subcontracts under such contracts.

52.204-8 ANNUAL REPRESENTATIONS AND CERTIFICATIONS (MAR 2020)

(a)(1) The North American Industry Classification System (NAICS) code for this acquisition is 511210.

(2) The small business size standard is $41,500,000.

(3) The small business size standard for a concern which submits an offer in its own name, other than on a construction or service contract, but which proposes to furnish a product which it did not itself manufacture, is 500 employees.

(b)(1) If the provision at 52.204-7, System for Award Management, is included in this solicitation, paragraph (d) of this provision applies.

(2) If the provision at 52.204-7, System for Award Management, is not included in this solicitation, and the Offeror has an active registration in the System for Award Management (SAM), the Offeror may choose to use paragraph (d) of this provision instead of completing the corresponding individual representations and certifications in the solicitation. The Offeror shall indicate which option applies by checking one of the following boxes:

( ) Paragraph (d) applies.

( ) Paragraph (d) does not apply and the offeror has completed the individual representations and certifications in the solicitation.

(c) (1) The following representations or certifications in SAM are applicable to this solicitation as indicated:

(i) 52.203-2, Certificate of Independent Price Determination. This provision applies to solicitations when a firm-fixed-price contract or fixed-price contract with economic price adjustment is contemplated, unless—

(A) The acquisition is to be made under the simplified acquisition procedures in Part 13;

(B) The solicitation is a request for technical proposals under two-step sealed bidding procedures; or

(C) The solicitation is for utility services for which rates are set by law or regulation.

(ii) 52.203-11, Certification and Disclosure Regarding Payments to Influence Certain Federal Transactions. This provision applies to solicitations expected to exceed $150,000.

(iii) 52.203-18, Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements--Representation. This provision applies to all solicitations.

(iv) 52.204-3, Taxpayer Identification. This provision applies to solicitations that do not include the provision at 52.204-7, System for Award Management.

(v) 52.204-5, Women-Owned Business (Other Than Small Business). This provision applies to solicitations that—

(A) Are not set aside for small business concerns;

(B) Exceed the simplified acquisition threshold; and

(C) Are for contracts that will be performed in the United States or its outlying areas.

(vi) 52.204-26, Covered Telecommunications Equipment or Services--Representation. This provision applies to all solicitations.

(vii) 52.209-2, Prohibition on Contracting with Inverted Domestic Corporations--Representation.

(viii) 52.209-5, Certification Regarding Responsibility Matters. This provision applies to solicitations where the contract value is expected to exceed the simplified acquisition threshold.

(ix) 52.209-11, Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law. This provision applies to all solicitations.

(x) 52.214-14, Place of Performance--Sealed Bidding. This provision applies to invitations for bids except those in which the place of performance is specified by the Government.

(xi) 52.215-6, Place of Performance. This provision applies to solicitations unless the place of performance is specified by the Government.

(xii) 52.219-1, Small Business Program Representations (Basic, Alternates I, and II). This provision applies to solicitations when the contract will be performed in the United States or its outlying areas.

(A) The basic provision applies when the solicitations are issued by other than DoD, NASA, and the Coast Guard.

(B) The provision with its Alternate I applies to solicitations issued by DoD, NASA, or the Coast Guard.

(C) The provision with its Alternate II applies to solicitations that will result in a multiple-award contract with more than one NAICS code assigned.

(xiii) 52.219-2, Equal Low Bids. This provision applies to solicitations when contracting by sealed bidding and the contract will be performed in the United States or its outlying areas.

(xiv) 52.222-22, Previous Contracts and Compliance Reports. This provision applies to solicitations that include the clause at 52.222-26, Equal Opportunity.

(xv) 52.222-25, Affirmative Action Compliance. This provision applies to solicitations, other than those for construction, when the solicitation includes the clause at 52.222-26, Equal Opportunity.

(xvi) 52.222-38, Compliance with Veterans' Employment Reporting Requirements. This provision applies to solicitations when it is anticipated the contract award will exceed the simplified acquisition threshold and the contract is not for acquisition of commercial items.

(xvii) 52.223-1, Biobased Product Certification. This provision applies to solicitations that require the delivery or specify the use of USDA-designated items; or include the clause at 52.223-2, Affirmative Procurement of Biobased Products Under Service and Construction Contracts.

(xviii) 52.223-4, Recovered Material Certification. This provision applies to solicitations that are for, or specify the use of, EPA- designated items.

(xix) 52.223-22, Public Disclosure of Greenhouse Gas Emissions and Reduction Goals--Representation. This provision applies to solicitations that include the clause at 52.204-7.)

(xx) 52.225-2, Buy American Certificate. This provision applies to solicitations containing the clause at 52.225-1.

(xxi) 52.225-4, Buy American--Free Trade Agreements--Israeli Trade Act Certificate. (Basic, Alternates I, II, and III.) This provision applies to solicitations containing the clause at 52.225- 3.

(A) If the acquisition value is less than $25,000, the basic provision applies.

(B) If the acquisition value is $25,000 or more but is less than $50,000, the provision with its Alternate I applies.

(C) If the acquisition value is $50,000 or more but is less than $83,099, the provision with its Alternate II applies.

(D) If the acquisition value is $83,099 or more but is less than $100,000, the provision with its Alternate III applies.

(xxii) 52.225-6, Trade Agreements Certificate. This provision applies to solicitations containing the clause at 52.225-5.

(xxiii) 52.225-20, Prohibition on Conducting Restricted Business Operations in Sudan--Certification. This provision applies to all solicitations.

(xxiv) 52.225-25, Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions Relating to Iran—Representation and Certification. This provision applies to all solicitations.

(xxv) 52.226-2, Historically Black College or University and Minority Institution Representation. This provision applies to solicitations for research, studies, supplies, or services of the type normally acquired from higher educational institutions.

(2) The following representations or certifications are applicable as indicated by the Contracting Officer:

[Contracting Officer check as appropriate.]

(i) 52.204-17, Ownership or Control of…