A01_DRAFT_PWS_USAASC_-_Information_Technology_SA_Support.DOCX

Performance Work Statement (PWS)

For

U.S. Army Acquisition Support Center bldgs. 201 & 210

Information Technology Support and Systems Administration

Table of Contents

1. Introduction and Background

1.1 Responsibilities

2. Scope

2.1 Contract Description ……………………………………………………………………………………3

3.0 Technical Requirements

3.1 Desktop Support ……………………………………………………………………………………….3

4.0 Administrative Requirements

4.1 Place of Performance…………………………………………………………………………………..4

4.2 Work Schedule

4.3 Training

4.4 Travel Requirements

4.5 Security

4.6 Information Assurance

4.7 Safety

4.8 Government Provided Resources

4.9 Access to Protected Information

4.10 Accounting for Contractor Support

4.11 Alternate Smart Card Login (ASCL)

4.12 Contractor Responsibilities

4.13 Conservation of Utilities

4.14 Additional Governance and Standards

5. Deliverables

5.1 Service Incident Reporting……………………………………………………………………………..11

5.2 Status Reports and Documentation

6. Quality Control and Quality Assurance

6.1 Quality Assurance

6.2 Quality Control

7. References

7.1 Publications and Forms

8. Terms

9. Appendixes

9.1 Technical Exhibit 1

9.2 Technical Exhibit 2

1. Introduction and Background.

1.1. Responsibilities.

1.1.1. The U.S. Army Acquisition Support Center requires dedicated information technology desktop services in support of our mission. The dedicated onsite desktop support will be onsite at building 201, Ft Belvoir, Virginia and will support both buildings 201 and 210.

1.1.2. Building 201 site enterprise architecture includes one internal sensitive compartmented information facility (SCIF) with Joint Worldwide Intelligence Communications System (JWICS), SIPRnet, and NIPRnet. Building 201 also has one open storage secret room with SIPRnet and secure VTC. Buildings 201 and 210 each include two externally managed networks (unclassified (NIPR), classified (SIPR). The environments consist of Hewlett Packard/Dell Windows based desktops and laptops.

2. Scope.

2.1. Contract Description.

2.1.1. The Contractor shall provide information technology (IT) desktop technical support services at buildings 201 and 210, Ft Belvoir, VA. The Contractor shall deliver comprehensive desktop support that includes hardware and software installation and configuration, VTC facilitation, and limited VOIP phone support/coordination with the local provider. This work will be in and on both unclassified and classified spaces and systems, NIPRnet, SIPRnet, and JWICS network systems and telephone systems conforming to National Telephone Security Working Group within TSG-6/CNSSI 5006, National Instruction for Approved Telephone Equipment, or an equivalent TSG 2/CNSSI 5002.

2.1.2. The Contractor shall document the work scheduled, work performed, status of ongoing work, problems encountered and their resolution, as well as a summary of major events, and other pertinent information in the form of End of Day and Monthly Reports that will be submitted to the Contracting Officer’s Representative (COR).

3. Technical Requirements.

3.1 Desktop Technical Support.

The Contractor shall:

3.1.1 Provide Windows Desktop System Administration services and be responsible for the installation, configuration, overall management of all hardware and software related to USAASC’s desktop/laptop computing environment. The environment consists of supporting approximately 120 users utilizing Dell/HP computers connected to USAASC’s externally hosted operations networks. Additional support shall be required for printers and phones located on site.

3.1.2 Install, configure, and troubleshoot the approved Army standard suite of software found in the Army Golden Master (AGM) software portfolio. User requests for software assistance shall be submitted through SharePoint service tickets.

3.1.3 The contractor is responsible for physically transporting and placing PCs/workstations/ laptops/ printers/faxes/phones to areas within USAASC’s office building and joining the PCs, workstations, and laptops to the designated network. The Contractor shall work this task based on move, add, and change service ticket submissions. Contractor will conform to Committee on National Security Systems (and any other guidance for classified IT systems) when installing, troubleshooting, or removing any hardware or software within the open storage room (SECRET) or the SCIF.

3.1.4 Respond with answers to user’s questions related to establishing network passwords, publishing Public Key Infrastructure (PKI) certificates to support Common Access Card (CAC) login and e-mail encryption/ digital signature, creating network drives, and setting up Microsoft Outlook.

3.1.5 Perform manual installation of software, software upgrades, and software security patches on PCs/workstations/laptops. The Contractor shall accomplish this task using new software versions and security patches released from software manufacturers. This requirement will be worked/tracked through SharePoint ticket requests in addition to the software tracking spreadsheet.

3.1.6 The contractor shall image desktop and laptops with SCCM in coordination with the local NEC. The Contractor shall perform this task when new system are deployed or for existing systems that are failing to install required security updates.

3.1.7 Contact external vendors if needed to repair hardware/software under warranty or under a maintenance contract. The contractor shall utilize existing support maintenance agreements when available to resolve technical issues with hardware and software. The COR can provide such need information.

3.1.8 Perform hardware troubleshooting and repair (using government furnished computer parts) on PCs/workstations/laptops not under warranty or under a maintenance contract.

3.11.9 Troubleshoot and resolve PC/workstation/printer to network connectivity issues in response to users submitting a service request through USAASC’s ticketing system...

3.11.10 Keeps PC/workstation/laptop antivirus software up-to-date using automated and manual procedures. The Contractor shall perform this task, automated with the McAfee console, when new updates become available by notice from the COR or CTO. Manual installs may be required when the automated procedure fails.

3.11.11 Quarantines, cleans virus affected PCs/workstations and laptops. In the event a PC cannot be cleaned, PC/workstations and laptops shall be re-imaged.

3.11.12 Communicate movement of IT equipment with the Division Hand Receipt Holder and the USAASC Property Book Officer to ensure accurate property accountability by routing standard asset accountability forms. The Contractor shall perform this task when requested for a move, add, and change are submitted through the ticketing system. Movement of equipment into and out of the SCIF area will be in coordination with the organization Information Systems Security Manager (ISSM) and the Special Security Officer (SSO).

3.11.13 As part of Daily Status Reporting utilizing Ricoh web interface, remotely monitor status of network printers to identify impending maintenance, repair, and supply needs and report that status to the Government IT Operations Manager through Daily reporting or verbally/e-mail should immediate action be required by Gov’t personnel.

3.11.14 Monitor software inventories tracked within the software tracking spreadsheet and alerts the Government IT Operations Manager verbally or via e-mail when availability issues might be forecasted to occur.

3.12.15. Facilitate USAASC’s buildings 201 and 210 Classified and Unclassified VTC systems responsible for coordinating internal connectivity between buildings and DoD/Army locations and remote connectivity to locations worldwide, to include US Allied partners. USAASC will utilize DISA’s Global Video Services (GVS). The USAASC Classified and Unclassified systems are H.323, or equivalent, based allowing for full use of the existing TCP/IP infrastructure and current cable plant for internal and external routing. The Contractor shall complete the online GVS facilitator training required to facilitate USAASC’s VTC systems. The Contractor shall coordinate with distant end facilitators, including US Allied facilitators, to schedule and conduct pre-tests for all requested and scheduled VTCs.

4. Administrative Requirements.

4.1. Place of Performance

4.1.1 The primary place of performance for the tasks listed in this Performance Work Statement is the U.S. Army Acquisition Support Center Office Bldg. 201 and 210, 9900 Belvoir Rd, Fort Belvoir, VA 22060

4.2. Work Schedule

4.2.1 The Contractor shall provide services during core hours, which are from 8 a.m. to 5 p.m. local time. The normal work week is 40 hours, and the Contractor shall obtain advance authorization whenever the work week will exceed 40 hours.

4.2.2 Holidays. The Contractor is not required to perform services on US Federal holidays as determined by the Office of Personnel Management (OPM). A list of current holidays is on the OPM website, https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/.

4.3. Training

4.3.1. Training of Contractor employees assigned to the contract will be performed at the Contractor’s own expense. Contractor employee training may be authorized at the government’s expense if the Government changes hardware or software during the performance of the contract, or new procedures are required in order to improve current processes and it is determined to be in the best interest of the Government. Whenever new procedures are incorporated and training is required, the contractor will include their DA civilians in this training and are authorized to use Government funds in order to train DA civilians’ counterparts as long as this is in the best interest of the government. The CTO will determine and communicate whether the Government will pay for the training. Government will consider contractor personnel hours used in training related to this task order as part of the contractor employees regular work hours.

4.3.2. The Contractor shall provide their own transportation in the course of accomplishing normal duties. For repairs and replacement of end items and ancillary devices, for Life Cycle Replacement Operations and Functions, USAASC contractors will have access to Government vehicles for delivery of workstation and/or network equipment. Contractors driving Government Vehicles shall be required to obtain a Government Driver’s License, after the successful completion of Accident Avoidance Course per Defense Regulation 4500-36-R and by Army Regulation 58-1. The Contractor shall provide the COR with a training certificate within one month of contractor start date and before operating a Government Owned Vehicle. The Government Driver’s License Course is an on-line instruction based course. There is no charge for the instruction for the Army Accident Avoidance Course. This course will be taken at a government facility and is the standard online Army Safety course.

4.4. Travel Requirements

4.4.1. Travel may be required to support USAASC events on Fort Belvoir and within the national capital region.

4.5. Security

4.5.1. Physical Security. The contractor shall safeguard all Government property and controlled forms provided for contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

4.5.2. Clearance Requirements. DD Form 254. Comply with, coordinate and complete a DD Form 254, Department of Defense Contract Security Classification Specification requirements. Upon execution of award, the CO will sign the DD Form 254 for incorporation into the TO. The customer/requiring activity will provide security classification guidance for contract performance. The Government will oversee handling and storage of classified information and provide appropriate storage capability for all classified material. All classified information shall be returned to the Government upon termination of the TO.

4.5.2.1. Contractor personnel must maintain at a minimum a SECRET clearance. Contractor personnel who require TOP SECRET clearance will be verified by the Joint Personnel Adjudication System (JPAS) or any other official United States Government security clearance data system. When required, contractor personnel shall have final TOP SECRET clearances with SCI eligibility prior to the performance start date and maintain the clearance throughout the contract performance period. The contractor shall also complete visit requests in JPAS for each individual performing work on a TO. Visit requests must be completed prior to the performance start date unless otherwise approved in writing by the KO. The JPAS system serves as the DOD system of record for the determination of contractor eligibility and access. The contractor shall comply with the provisions of Chapter 2, Security Clearances of the National Industrial Security Program Operating Manual (NISPOM).

4.5.2.2. Contractor Facility Clearance Requirements. The contractor shall have a TOP SECRET Facility Clearance (FCL) at the time of the receipt of proposals. The contractor may be precluded from performance if unable to comply with AR380-49, Industrial Security Program.

4.5.3. Contractor Identification. Contractor Identification Requirements; In accordance with FAR 37.114(c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. .Contractor personnel shall also ensure that all emails, documents, or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor’s company name.

4.5.4. Common Access Card (CAC). The Government will provide a Common Access Card (CAC) for all permanent contract personnel and follow AR 190-13 paragraph 8-2.c. and DTM 09-012 paragraph 2.b.4. for determining facility access. USAASC’s Trusted Agent will request through the Trusted Agent Sponsorship System (TASS) for contractor CACs after completion of CAC request form is signed by the COR. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems (reference DD254 for systems access) to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR and the USAASC Security Manager immediately.

4.5.5. Contractor personnel require access to SIPRNET and JWICS in support of this work effort. SIPRNET and JWICS network access shall only be at specified Government work locations. Contractor employees will be required to be read into SCI and NATO Secret. The USAASC security manager will provide the read-ins or schedule them.

4.5.6 The Contractor shall control, protect, safeguard, and account for COMSEC and/or CCI in accordance with AR 380-40, TB 380-41, and other Army, DoD and National level policy, as directed by the Government requiring activity. The Contractor shall comply with all applicable regulations and directives, including requiring activity policies and procedures in effect at requiring activity work locations. The Contractor shall remove any Contractor employee who fails to comply with COMSEC directives, policies and procedures from performance on this contract. Additionally, contractor employees who violate COMSEC directives, policies and procedures could be subject to criminal prosecution or other legal action.

4.5.6.1 Contractor personnel shall be familiar with AR 380-40, Chapter 6, on what constitutes a reportable incident and shall report any such incident immediately but no later than 4 hours to the responsible CAM and Contracting Officer’s Representative (COR). Contractor personnel shall be familiar with the security classification guidelines in AR 380-40, Appendix B and shall ensure any incident information is properly marked/protected and reported via secure means (STE or SIPRNET) from Government requiring activity work locations.

4.5.7 Contractor personnel shall be subject to the Department of the Army Cryptographic Access Program (DACAP) prior to being granted access to any SECRET or TOP SECRET cryptographic information that meets the criteria established in AR 380-40, Chapter 7. Contractor enrollment in DACAP requires: receipt of a DACAP briefing administered by the supporting Government requiring activity Security Office, G-2/S-2; written acknowledgement that they may be randomly selected to undergo a non-lifestyle, counterintelligence scope polygraph (CSP) examination administered in accordance with applicable directives and law; agreement to report all foreign travel and contacts in accordance with AR 380-67; and execution of Part I, SD 572 (Cryptographic Access Certification and Termination Statement). By executing Part I, SD 572, the Contractor employee acknowledges and agrees to be subject to a CSP examination as a requirement for continuing access to classified cryptographic information. When such access is no longer required, Contractor personnel will be debriefed and shall execute Part II of the SD 572.

The Government will deny access to classified cryptographic information to any Contractor employee who refuses to participate in DACAP. The Government will also immediately terminate access to classified cryptographic information for any Contractor employee who declines to submit to a CSP examination, and that employee shall debriefed by the Government requiring activity Security Office, G-2/S-2.

4.5.8. Visitor Group Security Agreement (VGSA). The contractor shall enter into a long term visitor group security agreement if contract performance is on base for 90 days or more. This agreement shall outline how the contractor integrates security requirements for contract operations with the Army to ensure effective and economical operation on the installation. Enter into a long term VGSA through the USAASC Security Manager, when applicable. Visitor Groups shall safeguard all collateral classified information IAW DoD 5200.1-R, Information Security Program; AR380-5, Information Security Program; AR380-49, Industrial Security Program, and other directives deemed necessary by the servicing security office.

4.5.9. Security training. The company facility security officer will provide contract employees with security briefings in accordance with the provisions of the NISPOM. The USAASC security manager will provide additional briefings as necessary in addition to having the company employees execute a non-disclosure agreement SF312 and local agreements. Contract employees will be required to complete antiterrorism (AT) level I training, Operations Security (OPSEC) level I training, Combatting Trafficking in Persons training, , Threat Awareness and Reporting Program (TARP) training, DoD cyber-awareness training, and SCI unauthorized disclosure training.

4.5.10. Lock Combinations. Control access to all Government-provided lock combinations to prevent unauthorized entry. The contractor is not authorized to record lock combinations without written approval by the COR. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

4.5.11. For Official Use Only (FOUO). Comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting and safeguarding FOUO material.

4.5.12. All inquiries, comments or complaints arising from any matter observed, experienced, or learned of, as a result of or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the COR and the KO.

4.5.13 The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

4.5.14. U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the Contractor, but remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5.15. Contractor personnel may receive keys or access control system cards to access Government controlled facilities. All Contractor personnel shall sign out Government controlled keys, issued by the Security Manager on designated DA Form 5513 Key Control Register Inventory Log. Contractor personnel will be issued safe combinations by Government managers. Safe combinations shall not be written down nor given out to other Contractor personnel, and must be safeguarded at all time.

4.6. Information Assurance

4.6.1. Information Assurance (IA) Training- All Contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as specified by the Government requiring activity during in-processing at USAASC. Training is available at https://ia.signal.army.mil

4.6.2. Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil/iastar/index.php, in the unit container managed by the COR and/or ATCTS Manager. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

4.6.3. The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at the start of work performance during in-processing at USAASC and annually thereafter for the duration of this contract.

4.6.4. Information Assurance Workforce Certification- DFARS clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

4.6.5. The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

4.6.6. The Contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/appj/dwc/index.jsp.

4.6.7. Table 1 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M and Information Assurance BBP 05-PR-M-0002.

Table 1.

Functional Category

IT Level (IAW AR 25-2) IA Certification Category and Level (IAW DOD 8570.01-M and BBP 05- PR-M-0002)

Background Investigation Required

Security Access Level Required

Computing Environment Certifications Required

Desktop Administration

IT-11

IAT-II

T3 or comparable

Secret

Yes (Sec+)

Desktop and SCI Administration

IT-1

IAT II

T5 or comparable

SCI

Yes, (Sec+)

4.6.8. Non-Government-owned computing systems or devices- The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information Assurance Manager (IAM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

4.6.9. Protection of Sensitive Unclassified Data- the Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media and in DoD Component implementing instructions.

4.6.10. Antiterrorism Level I Training- The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after completion of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil/Atlas2/faces/page/login/Login/.seam, course #JS-US007.

4.6.11. Emergencies and Force Protection Conditions- During declare emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined and communicated by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. If the Government work location is closed for any reason, including inclement weather, Contractors are required to report their accountability to the COR, or assigned Government representative. Contractor accountability will be reported following USAASC’s accountability reporting process.

4.6.13. Operations Security (OPSEC) – The Contractor shall comply with DoD Directive 5205.0E2, Army Regulation 530-1, and the requiring activity OPSEC program. Failure to comply with the OPSEC directives shall be deemed adequate cause for the removal of a Contractor employee from performance on this contract and could be considered for appropriate legal action. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

4.6.14. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This training shall be completed within 60 calendar days of contract award and within 60 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

4.7. Safety. The Contractor shall maintain safety and health standards compliant with requirements of the Occupational Safety and Health Administration (OSHA).

4.8. Government Provided Resources

4.8.1. The Government will provide all IT hardware, software, spare parts, test equipment, hardware spares, diagnostic software, and sustained preventive maintenance contracts to effectively execute the tasks as described herein.

4.8.2. The Government will provide all cubicles, office space, furniture, conference rooms, break rooms, rest rooms, telephone service, electricity, and personal security to effectively execute the tasks as described herein.

4.8.3. The Contractor shall not be required to furnish any supplies, equipment, or facilities to perform work under this contract.

4.9. Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the U.S. Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

4.10. Accounting for Contractor Support. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor shall report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract/task order. The Contractor is required to completely fill in all the information in the format using the following Web address: https://cmra.army.mil. The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer's Representative; (2) Contract number, including task or delivery order number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, e-mail address, identity of Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractors; (6) Estimated direct labor dollars paid this reporting period (including sub-Contractors); (7) Total payments (including sub-Contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (11) Locations where the Contractor and sub-Contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-Contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a Contractor's systems to the secure website without the need for separate data entries for each required data element at the website. The specific formats for the XML direct transfer may be downloaded from the website. The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Army via the eCMRA secure data collection site. The contractor is required to completely fill-in all required data fields within the eCMRA. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2018. Contractors may direct questions to the help desk at: http://www.ecmra.mil/.

4.11. Alternate Smart Card Login (ASCL).

4.11.1. All SAs and other privileged administrative accounts, shall utilize Government issued ASCL tokens, issued by the Army Registration Authority, to authenticate into RNEC-NCR servers. The Contractor shall provide support to Government assurance personnel in providing data required to obtain and activate ASCL tokens. It may be necessary for personnel to have multiple ASCL tokens depending on how the Government assigns the responsibility.

4.11.2. The Contractor shall immediately notify the IAM when an ASCL token is lost or stolen or one of your personnel is no longer assigned to the contract. The Contractor shall not assign personnel to perform SA or privileged account duties until applicable ASCL tokens have been obtained. Personnel assigned to system administrator duties will maintain both a regular user account, with CAC authentication and one or more system administrator accounts requiring one of more ASCL tokens.

4.12. Contractor Responsibilities. The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor’s performance. At these meetings the KO will apprise the Contractor of how the Government views the Contractor’s performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meeting shall be at no additional cost to the Government.

4.13. Conservation of Utilities. The Contractor shall make every effort to conserve utility costs during performance of the tasks herein in accordance with (IAW) DOD, ARMY and local Energy Conservation Policies and regulations.

4.14. The contractor shall follow all additional Governance and Standards stated within this PWS.

4.14.1. All Contractor personnel shall speak English.

4.14.2. The Contractor shall comply with all applicable laws, rules and regulations.

4.14.3. All Contractor employees shall dress appropriately for the tasks being performed.

4.14.4. Contracting Officer’s Representative (COR). The KO will provide a COR Designation Letter for this Contract upon award. The Contractor shall acknowledge the COR Designation Letter in writing and return to the KO within 5 business days of receipt.

4.14.5. Reserved

5. Deliverables. Deliverables schedule is further identified in Technical Exhibit 2.

5.1. System Status Report. The Contractor shall provide a systems status report each morning to the CTO/COR identifying any issues that could impact network operations. The report will cover all major systems and services.

5.2. End of Day Report (EOD). The Contractor lead will provide the EOD to the CTO/COR at the end of each work day. The reports should cover all functional areas and provide detailed updates on new or existing issues and what actions are being taken in response.

6. Quality Control and Quality Assurance.

6.1. Quality Assurance. The Government will verify that services are being performed by the Contractor according to acceptable standards based on the Government’s Quality Assurance Surveillance Plan.

The Government may conduct surveillance at any time and any place where contract performance occurs.

6.2. Quality Control.

6.2.1. Quality Control Plan- the Contractor shall establish and maintain a complete Quality Control Plan (QCP) to ensure the requirements of the contract are provided. The Contractor shall provide three copies of a comprehensive written QCP to the KO and COR within five calendar days of the start of performance and within five working days when changes are made thereafter.6.2.2. The Contractor shall develop a process to assure contractual requirements are being met. The Contractor shall select the proper methods to analyze these processes and to continuously improve the system.

7. References.

7.1. Publications and Forms. The following publications form a part of this contract. The publications below with which the Contractor shall comply are “Mandatory.” The Contractor shall use current commercial practices and publications whenever possible. A significant number of Army regulations that govern the conduct of the required work are listed below. The PWS may set a higher standard of performance than an applicable Army regulation. The PWS will control over the regulations unless a particular PWS provision is in direct conflict with the applicable provision of the Army regulation. The publications can be accessed from internet site www.usapa.army.mil. The Government will provide those publications not available on a web site. The Contractor shall comply with changes to publications. The Contractor shall inform the KO of any changes to a publication or document that impact the cost of the contract. Additional technical design and policy reference information governing the SIPRNET can be accessed from the following web sites: http://iase.disa.mil/policy-guidance/index.html#trustedproducts and http://iase.disa.mil/stigs. Copies of the referenced DoD documents are available at http://www.dtic.mil/whs/directives/index.html. Copies of Fort Belvoir Network Enterprise Policy documents are available at http://www.doim.belvoir.army.mil/pubs/Belvoir/Pl/_PDF_TableofContentsPL.html.

AR 25-1, Army Information Technology AR 25-13, Telecommunications and Unified Capabilities AR 25-2, Information Assurance AR 25-55 The Department of the Army Freedom of Information Act Program AR 190-13 The Army Physical Security Program AR 190-51 Security of Unclassified Army Property (Sensitive and Non-sensitive) AR 380-5 Department of the Army Information Security Program AR 380-40 Safeguarding and Controlling Communications Security Material (FOUO requires AKO access) AR 381-12 Threat Awareness and Reporting Program AR 385-10 The Army Safety Program AR 380-49 Industrial Security Program AR 380-67 Personnel Security Program AR 381-12 Threat Awareness and Reporting Program (TARP) DA Pam 25-1-1 Army Information Technology Implementation Instructions DISA Cir 300-115-3 Defense Information System Network (DISN) Secret Internet Protocol Routing Network Security Classification Guide DoDM 5200.01-V1 DoD Information Security Program: Overview, Classification, and Declassification DoDM 5200.01-V2 DOD Information Security Program: Marking of Classified Information DoDM 5200.01-V3 DOD Information Security Program: Protection of Classified Information DoDM 5200.01-V4 DoD Information Security Program: Controlled Unclassified Information (CUI) DoDD 5205.02E DoD Operations Security (OPSEC) Program DoDD 5400.11 DoD Privacy Program AR 525-13 Antiterrorism (FOUO requires AKO access) AR 530-1 Operations Security DOD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) DODI 8510.01, DOD Information Assurance Certification and Accreditation Process Guidance.

DODD 8570.1 Information Assurance Training, Certification, and Workforce Management DoD 8570.01-M, Information Assurance Workforce Improvement Program DoDI 8500.01 Cybersecurity TB 380-41Security: Procedures for Safeguarding Accounting and Supply Control of COMSEC Material (FOUO – available from the Government Requiring Activity) Army C4/IM Services List Version 3.0 Army Information Technology Metrics Program Definitions and Units of Measure Privilege Level Access Acceptable User Policy Agreements of Fort Belvoir.

Section 3541 of Title 44, United States Code (USC), Federal Information Security Management Act Section 508 of the Rehabilitation Act, 29 USC §794d.

DI-MGMT-81453, Data Item Description: Data Accession List (DAL (27 Sep 07)) DISESS-81000C, Data Item Description: Commercial Drawings, Models, and associated lists (10 Sep

04) Army CIO/G-6 Best Business Practice 05-PR-M-0002, Information Assurance (IA Training and Certification (available at https://www.milsuite.mil/wiki/Best_Business_PracticesCommittee on National Security Systems Instructions (CNSSI) 4009, National Information Assurance Glossary (available at http://www.cnss.gov/full-index.html) Memorandum, Department of the Army G-2, 29 May 2007, subject: Classified Visit Request Process (available from the Government requiring agency) Memorandum, Office of the Under Secretary of Defense, 1 April 2005, subject: Facilitating Classified Visits within Department of Defense (available from the Government requiring agency) Memorandum, Office of the Under Secretary of Defense, 5 December 2001, subject: Facilitating Necessary Access to NATO Classified Information (available from the Government requiring agency)

8. Terms.

Acceptable Quality Level - The term as used in this contract evaluates to the maximum percent defective that, for purposes of sampling inspections can be considered satisfactory. This percentage is 99%. C4IM Service List - Command, Control, Communications, and Computers Information Management Service List. This is the source document that provides supporting definition for Army Enterprise “target” baseline and Mission IT services provided and/or supported by the USAG, FB-NEC. This list of service definitions is the foundation for the C4IM Service Catalog. The C4IM Service List and the Catalog will define the funding responsibilities for services and tasks.

Contracting Officer - A person with authority to enter into, administer, or terminate contracts, and make related determinations and findings on behalf of the government. This is the only individual who can obligate the government in a legally binding manner.

Contracting Officer’s Representative - An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Government Property - All property owned or leased to the government or acquired by the Government under the terms of the contract. Government property includes both Government furnished property and Contractor acquired property as defined in FAR 45.101.

Performance Requirement - The threshold that divides acceptable and unacceptable performance. When the method of surveillance is other than random sampling, the performance requirement is the number of defective or maximum percent defective in the lot before the Government will affect the price computation system in accordance with the performance Requirements Summary and the inspection of services clause.

Performance Requirements Summary - The summarized key service outputs of the contract, which will be evaluated by the Government. This is to assure Contractor meets the performance standards.

Physical Security - Actions that prevent the loss or damage of government property.

Subcontractor - Private business entity that enters into a subcontract and assumes some of the obligations of the primary Contractor.

Support Request - Defined as an automated or verbal communication from appointed Fort Belvoir Network Enterprise Center personnel or a supported customer. Automated support requests will be obtained through Army Enterprise Remedy software and all support requests regardless of source will be tracked and documented within the Army Enterprise Remedy software throughout the support request’s lifecycle.

9. Appendixes.

9.1. Technical Exhibit 1

IT Systems Equipment, Hardware and Software Supported

CISCO Network Products Citrix Presentation Xenapp 6.5 Enterprise Edition Crypto Equipment – KIV -7 Encryptor TACLANE Dell Products (computers and servers) Enterprise SQL 2005and 2008 General Dynamics TACLANES HP Products (computers and servers) HP ProLiant Blade Servers HP StorageWorks STORAGE AREA NETWORK (SAN) Storage Area Network (SAN) Enterprise Virtual Array (EVA) 6000 32TB System Center Configuration Manager (SCCM) 2007 APC Smart UPS Quantum Tape Library Appliance

Apple iOS Approve IT 6.5 Army Golden Master Microsoft Windows Brocade Network Analysis CA SPECTRUM (Network Tool) CITRIX XENAPP 6.5 CISCO Works Management Software 4.0 CISCO Secure Authentication Control System 4.2 CISCO VPN 5.0.5 and 5.0.7 DCPDS - Jinitiator 1.2.1.29 and Ghostview Eclipse - Sun FlowMetrix General Dynamics GEM 3.5.5 General Dynamics Generic Discovery Server 3.5 Global 360 – Keyflow 9.1 IRONVIEW (Brocade Network Tool) Lotus Form Viewer 3.5.1 Microsoft Office Product Suite PureEdge 6.5 Remedy Action Request System and Helpdesk Microsoft SQL Svr Microsoft Server SharePoint System Center Configuration Manager (SCCM) Tumbleweed Visual Studio Whats Up Gold

9.2. Technical Exhibit 2

Deliverables Schedule

Deliverable

Frequency/Due Date

CDRL

System Status Report (Par. 5.1)

Daily at 0800

A0001

100%

COR/CTO

Inspection

End of Day Report (Par. 5.2)

Daily by 1700

A0002

100%

COR/CTO

Inspection

9.3. Technical Exhibit 3

Performance Requirements Summary

Required Services

Performance Standards

Acceptable Quality Levels

Surveillance Methods Incentives / Disincentives for Meeting or Not Meeting Performance Standards

Security Operation Services (para 3.2.3,3.2.10, 3.7.13)

Physical Security Inspections

Security Integrity (IAVA, STIG and Network Access Controller (NAC)

Block both internal and…