1.05 NEP Services PWS v4.0.pdf

RECORD OF CHANGES PAGE

Version

Change

Date

Author Change

Description

V1.0 21 December 2022 Donald Moor Initial PWS

V2.0 16 March 2023 Valerie Kolaric Revised PWS

V3.0 23 March 2023 Cory Harvey Posted comments for corrections and made updates

V4.0 27 March 2023 Donald Moor Updated per Cory Harvey comments

V5.0 18 May 2023 Donald Moor Updated Travel Section

Performance Work Statement (PWS) for Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC)

NAVSUP Enterprise Platform (NEP) Service Support and Licensing 03 March 2023

1.0 Introduction:

Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC) has deployed Appian Low Code Application Platform (LCAP) as the technology to implement and deploy the NAVSUP Enterprise Platform (NEP). NEP provides the enterprise with a web-based, Impact Level 5 (IL5) cloud hosted, application platform to rapidly deploy routine administrative business capabilities across all business areas. NEP enables applications and automated business processes to be rapidly created, customized, and maintained within the platform without need for full-scale custom development. NEP also provides support for simplified application test, deployment and management in order to elevate mission readiness and enhance stakeholder value by increasing speed and agility in IT delivery.

This effort will provide technical resources for the NAVSUP Enterprise Platform (NEP) to facilitate the establishment of technical governance policies and procedures and provide developer support. The technical governance program will define how NAVSUP makes decisions to guide its platform implementation, and ensure that the implementation and architecture plans are executed in accordance with DoD and industry best practices.

The objective of this contract is to provide the product and solution support services NAVSUP Business Systems Command (BSC) needs to advance the modernization of the NEP system beyond initial operational capability. These services involve the analysis of existing legacy policies and procedures as well as the design, configuration and implementation services of two (2) Full Expert Delivery Services Teams as well as an Appian Accelerator Team to achieve successful operational deployment of a yet unidentified number of business capabilities.

2.0 Background:

NAVSUP BSC chose the Appian Low Code Application Platform (LCAP) as the technology to implement and deploy the NAVSUP Enterprise Platform (NEP). NEP provides the enterprise with a web-based, Impact Level 5 (IL5) cloud hosted, application platform to rapidly deploy routine administrative business capabilities across all business areas. NEP enables applications and automated business processes to be rapidly created, customized, and maintained within the platform without need for full-scale custom development. NEP also provides support for simplified application test, deployment and management in order to elevate mission readiness and enhance stakeholder value by increasing speed and agility in IT delivery.

NEP will have recently achieved an RMF ATO at the beginning of this period of performance.

This effort will provide technical resources for the NAVSUP Enterprise Platform (NEP) to facilitate the establishment of technical governance policies and procedures and provide developer support. Enterprise licensing will also be procured through this vehicle. The technical governance program will define how NAVSUP makes decisions to guide its platform implementation, and ensure that the implementation and architecture plans are executed in accordance with DoD and industry best practices.

2.1 Requiring Organization:

NAVSUP Business Systems Center 5450 Carlisle Pike, Code 92, Suite 409 Mechanicsburg PA 17050-2411

2.2 Project Description:

The purpose of this PWS is to obtain contractor support service in the development and documentation of and enterprise platform governance structure consisting of two full Appian Delivery Services Teams (consisting of (1) Technical Delivery Manager, (1) Appian Architect,

(1) Lead Consultant, and (2) Consultants) and an Appian Accelerate Plus Team. NAVSUP will also require enterprise licensing for a single large instance IL5 Appian Gov Cloud.

3.0 Scope:

The goal of this PWS is to obtain contractor support services to provide the following:

Agile Software Support o Agile Release Teams overseen by NAVSUP Government Product Owner and Scrum Master o Appian Technical Delivery Manager o Appian Architect o Appian Developer (Lead) o Appian Developer (Senior) o Functional Analyst o Change Management Specialist (Senior)

Cybersecurity Mentoring and Knowledge Transfer Services Transition Support

The number and type of resources required can change based on current project needs.

Resources can fill multiple roles as certain requirements will only be necessary on occasion.

Appian CSS will provide flexible solutions and product consulting to the Government to assist in the configuration of the Appian software to execute the selected business processes for the project’s customers. The contractor shall configure and update the Appian software, as required, using an agile delivery methodology to align the system’s configuration with the functional requirements of each business capability area. Appian CSS will provide product delivery support from project initiation through application transition to a sustainment team.

Option Year (1)

During the first option year, Delivery Services will remain the same as the base year. Licensing will increase from (1) to (2) large instances IL5 Appian Gov Cloud to accommodate increased user capacity. If needed, NAVSUP BSC reserves the right to order additional delivery services at the option year (2) quoted rate.

Option Year (2)

During the second option year, Delivery Services will again remain the same as the base year.

Licensing will again increase from (2) to (3) large instances IL5 Appian Gov Cloud to accommodate increased user capacity. If needed, NAVSUP BSC reserves the right to order additional delivery services at the option year (3) quoted rate.

4.0 Directives:

The contractor shall comply with the following directives, and any updated/future versions as they are released:

Federal Information Security Modernization Act of 2014 (“FISMA”) Common Criteria for Information Technology Security Evaluation, Part 3: Security

Assurance Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003 DoD Instruction 5400.11, DoD Privacy and Civil Liberties Programs, 29 January 2019

(incorporating Change 1, 8 December 2020) DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016

(incorporating Change 1 July 2017) DoD Directive 8140.01, Cyberspace Workforce Management, 5 October 2020 DoD Instruction 4161.02, Accountability and Management of Government Contract

Property, 27 April 2012 (incorporating Change 2, 31 August 2018) DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and

Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017)

DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019 DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information

Technology, 12 March 2014 (incorporating Change 3, 29 December 2020) DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing

Unclassified Nonpublic DoD Information, 9 December 2019 SECNAVINST 5510.36B, DoN Information Security Program, 12 July 2019 DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19

December 2005 (incorporating Change 4, 10 November 2015) SECNAV Instruction 5211.5F, Department of the Navy Privacy Program, 20 May 2019 SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May 2016 SECNAV M-5239.2, DoN Information Assurance Manual, June 2016 OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July 2018

OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity Safety Program, 14 September 2018

SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities, 24 January 2012

DoD Public Key Infrastructure (https://cyber.mil/pki-pke) ISO/IEC/IEEE 12207:2017 Systems and Software Engineering – Software Life Cycle

Processes ANSI/EIA 649C-2019 – Configuration Management Standard ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability Federal Risk and Authorization Management Program (“FedRAMP”) Department of Defense Cloud Computing Security Requirements Guide, Version 1, Release 3, dated 6 March 2017 All applicable Security Requirements Guides, Security Technical Implementation

Guides, and National Security Agency security configuration guides when assessment and authorization is required

NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, December 2018

U.S. Navy Risk Management Framework Process Guide, Version 3.2, 2 September 2020 NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and

Organizations, September 2020 includes updates as of 10 December 2020 NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal

Information Systems and Organizations, December 2014, includes updates as of 18 December 2014

NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020

NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018

NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace Operations Policy, 25 March 2019

ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management Systems - Requirements

ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software Identification Tag

ISO/IEC 19770 Series - Information Technology – IT Asset Management A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Sixth

Edition Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment

Act of 1998, 7 August 1998) SECNAVINST 5720.44C - Department of the Navy Policy for Content of Publicly

Accessible World Wide Web Sites, 21 February 2012 (incorporating Change 1, 14 October 2014)

SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January

Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004

DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017 (incorporating Change 1, 29 October 2020)

DoD Manual 5200.08-R, Physical Security Program, 9 April 2007 (incorporating Change 2, 19 October 2020)

NTTP 3-13.3, Operations Security (OPSEC), September 2017 DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 NSAMECHINST 5530.1C CH-1, Naval Support Activity Mechanicsburg Installation

Access Control, 23 August 2019 ASN(RDA) and DON CIO Joint Memorandum, Department of the Navy Cloud Policy, 7

December 2020 NAVADMIN 122-21, Navy Cloud Implementation Plan, 9 June 2021

5.0 Requirements/Tasks:

The contractor shall be obligated contractually to perform all requirements in this Performance Work Statement (PWS), except roles specifically for NAVSUP’s Government Product Owner and Government Scrum Master as specified in Tasks 5.1 and 5.2. A description of the NAVSUP-specific agile roles is included in this PWS to delineate the Contractor role and responsibilities to be performed. The contractor will work in a Team-based agile environment on the Agile Release Team with high-level requirements/capabilities being provided to the Agile Team by the Government Product Owner.

As in typical Scrum-based agile processes, the Government Product Owner and Government Scrum Master will work together with the Team to develop and estimate product backlog items (PBIs) and establish acceptance criteria. The acceptance criteria will specify expected functionality for a PBI, as well as any non-functional requirements that must be met. The Government Product Owner and Government Scrum Master, supported by Subject Matter Experts and Business Analysts, will determine whether acceptance criteria have been satisfied.

Not every performance requirement has a related standard expressed in this document or in the Quality Assurance Surveillance Plan (QASP). In such cases, the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 NAVSUP Government Product Owner. The Government Product Owner shall be responsible for:

5.1.1 Defining and prioritizing PBIs via backlogs.

5.1.2 Working with the Agile Release Teams to estimate PBI in the Product Backlog.

5.1.3 Working with stakeholders to regularly groom the product backlog to ensure the work is clearly defined, in priority order, and is accompanied by reasonable estimates.

5.1.4 Collaborating with business stakeholders and NAVSUP Program Management

Office (PMO)/Project Manager to develop a high-level strategic plan to guide organizational vision and align expectations for future development.

5.1.5 Identifying and mitigating risks impacting delivery and overall success.

5.1.6 Briefing customers, Program/Project team, and management on project status, strategies, software solutions, etc.

5.2 NAVSUP Government Scrum Master. The Government Scrum Master is responsible for facilitating agile ceremonies and discussions among development, Agile Release Team, and Mission Partner team members. The Government Scrum Master is responsible for coaching the team on the agile processes and removes impediments for the team. The Government Scrum Master, working with the Agile Release Team, shall be responsible for:

5.2.1 Facilitating Scrum Meetings: The Government Scrum Master coordinates and facilitates Scrum meetings, such as Sprint planning, Backlog Refinement, Sprint Reviews, and Sprint Retrospectives, and provides sufficient records.

5.2.2 Defining Team Performance Metrics: The Government Scrum Master works with product leadership and the Agile Release Team to define and deliver relevant metrics that are formulated and utilized for meeting project objectives.

5.2.3 Delivering Team Performance Metrics: The Government Scrum Master works with product leadership and the Agile Release Team to deliver relevant metrics that are formulated and utilized for meeting project objects. Examples include release burnup, sprint burn down, planned vs accepted, escaped defects, and velocity. NAVSUP BSC expects these metrics to evolve over time.

5.2.4 Planning and Coordinating Team Training: When appropriate, the

Government Scrum Master shall plan and coordinate training for the Agile Release Team on the Scrum processes. The Government Scrum Master also helps to remove team roadblocks.

5.2.5 Supporting the adoption of agile principles and practices: Work with the

Program/Project Manager, Product Owner(s), Scrum Master(s), Agile Release Teams, and others as needed to address issues related to agile process implementation or performance.

5.3 Agile Release Teams.

The Appian Developer (Senior/Lead), Appian Architect, Appian Technical Delivery Manager, and Quality Assurance/Software Testing Analyst are key players on the Agile Release Teams to support NAVSUP NEP Project Manager by completing product backlog items. A PBI represents any unit of measurable work that provides value to the NAVSUP NEP Project Manager and will serve as a deliverable. The Agile Release Teams can work on any system backlog for a new or existing system or application that requires the use of the current NAVSUP NEP Technical Landscape or an evolution of the Technical Landscape.

In collaboration with the Government Product Owner, the Agile Release Team shall provide PBIs with the requisite information to complete the work. No PBI can be started by a team until approved by the Government Product Owner and contain acceptance criteria and a definition of done. PBI approval occurs at the sprint planning event and shall be documented in Azure DevOps Services (ADS).

PBI acceptance occurs at the sprint review event and shall be documented in the ADS. At the sprint review, the delivered user PBIs shall be compared against the Definition of Done and acceptance criteria defined at sprint planning to determine the quality of the deliverable PBI. The PBI shall meet all requirements defined in the sprint Definition of Done and Acceptance Criteria to be accepted.

The Appian Developer (Senior/Lead) and Quality Assurance/Software Testing Analyst are responsible for the following:

5.3.1 Ensuring complete transparency and for logging all activities in the Enterprise Platform, Azure DevOps Services (ADS) and shall be kept current within 2-business days.

5.3.2 Adhering to Scrum best practices and performing recommended Scrum Events and Artifacts in accordance with the 2020 Scrum Guide:

https://www.scrumguides.org/index.html, or utilize Agile Kanban practices, or any other Agile or Scrum best practices approved by the Government Product Owner and Government Scrum Master.

5.3.3 Providing the full range of System/Software Development Lifecycle activities to include requirements, analysis, design, development, test, security, and deployment.

5.3.4 Coordinating all activities (analysis, design, development, testing and deployment) required to complete each PBI as defined in the Acceptance Criteria and Definition of Done.

5.3.5 Working with the Government Product Owner to decompose each PBI down to the level that is achievable within a sprint (i.e., generally requiring less than 10 business days to complete) and identify the Acceptance Criteria for each PBI and define the sprint Definition of Done.

5.3.6 Identify all tasks required to, successfully, complete each PBI and document in

ADS.

5.3.7 Showing traceability and dependencies between requirements (Epics, Features, PBIs and Tasks) and systems in ADS.

5.3.8 Effectively facilitating scrum and Agile events and practices.

5.3.9 Proposing a Minimal Viable Product (MVP) solution containing features that provide initial capability to the end-user while also encouraging end-users to provide feedback to influence future development sprints.

5.3.10 Work closely with the Government to ensure that the Product Backlog, stored in ADS, is continually and regularly maintained in alignment with the Agile cadence so that the necessary Release and Sprint Backlog items (epics and PBIs) are defined with acceptance criteria and prioritized by the Government prior to the start of each release and sprint. The contractor shall prioritize development in accordance with the Program Backlog.

5.3.11 Working with the Government Product Owner and Government Scrum Master, define and deliver relevant metrics that are formulated and utilized for meeting project objectives.

5.4 The Appian Developer (Senior/Lead) with Functional Analysis shall:

5.4.1 Perform functions relating to agile software engineering/programming

(create/maintain source code), design, automated/manual unit testing and Integrated System Testing (IST), and maintenance of assigned NAVSUP NEP applications/modules.

5.4.2 Analyze/refine systems requirements, determine and design system/application architecture, write/debug/maintain code, and develop/maintain system/application documentation in adherence to Appian and NAVSUP best practices.

5.4.3 Provide application and environment engineering perspective when interfacing with Mission Partners/users and NAVSUP NEP teams.

5.4.4 Perform evaluation of new technology tools/methodologies, supporting application engineering, and provide technical advice to NAVSUP NEP team, management, and Mission Partners/users.

5.4.5 Recommend the use of recognized standard system engineering best practices, resulting in improved supportability, survivability, reliability, and maintainability of program code and Appian platform.

5.4.6 Perform code quality assurance audits to ensure coding standards have been practiced and that the code is compatible across the platform. Utilize code analysis tools, as necessary, to discover common issues, vulnerabilities and guideline violations.

5.4.7 Perform manual code analysis in order to detect bugs, performance bottlenecks, security vulnerabilities and maintainability risks.

5.4.8 Maintain all source code in accordance with NEP governance. All source code will be uploaded at the end of each business day to ensure no loss of work accomplished. Developer shall program code for applications utilizing the architecture, technologies, and standards as defined by the agile team and in compliance with Appian best practices and all other applicable standards.

5.4.9 Perform required testing based upon Acceptance Criteria and Definition of Done, assuring software and systems quality and functionality.

5.4.10 Determine the feasibility of design alternatives, translate systems requirements into application prototypes, and develop problem resolutions.

5.4.11 Providing functional authority and functional knowledge expertise for assigned applications and performing assigned tasks for assigned applications.

5.4.12 Obtaining requirements from Mission Partners/users.

5.4.13 Identifying, defining, or modifying interfaces with other systems/applications, ensuring agreements are formally documented with the interfacing system/application.

5.4.14 Providing training resources/support to Mission Partners/users after pre-implementation.

5.4.15 Developing documentation based upon Agile Scrum best practices and the

NAVSUP BSC Service Delivery Model (SDM).

5.4.16 Supporting NAVSUP NEP Production outages, as required.

5.4.17 Providing support to the development of the release packages.

5.4.18 Creating and updating work items in Azure DevOps Services (ADS) on a regular basis (i.e., daily).

5.4.19 Analyzing system requirements, converting functional design to detailed logic for coding into computer language for the assigned software systems, to include but not limited to, the NAVSUP NEP Modules and Components.

5.4.20 Reviewing each module as well as the system for design validity. This includes, but is not limited to, validation of record input, data elements and output reports.

5.5 Quality Assurance/Software Testing Analyst shall:

5.5.1 Perform all software testing and quality control/quality assurance management procedures, track and analyzing key metrics, monitor quality procedures and participate in software reviews and testing.

5.5.2 Evaluate, recommend and implement automated test tools and strategies, develops, maintains and upgrades automated test scripts and architectures for application products, writes, implements and reports status for system test cases for testing and analyzes test cases and provides regular progress reports.

5.5.3 Ensure all test cases and results are created/updated and stored within Azure DevOps and uploaded at the end of each business day to ensure no loss of work accomplished.

5.5.4 Perform required testing based upon Acceptance Criteria and Definition of Done, assuring software and systems quality and functionality.

5.5.5 Developing documentation based upon Agile Scrum best practices and the

NAVSUP BSC SDM.

5.6 The Change Management Specialist (Senior) shall:

5.6.1 Apply a structured methodology and lead change management activities.

5.6.2 Apply a change management process and tools to create a go-live business approach, and a strategy to support adoption of the changes required by NEP.

5.6.3 Support the design, development, delivery and management of communications.

5.6.4 Conduct impact analyses, assess change readiness and identify key stakeholders.

5.6.5 Provide input, document requirements and support the design and delivery of training programs.

5.6.6 Identify, analyze and prepare risk mitigation tactics.

5.6.7 Create and maintain the communications plan, sponsor roadmap, training plan, and resistance management plan.

5.6.8 Ensure that NEP program objectives are realized on time, by ensuring employee adoption and usage of the application.

5.6.9 Support managing and communicating changes to business processes, systems and technology, job roles and organizational structures.

5.7 Cybersecurity.

The Appian Developer (Senior/Lead) and Quality Assurance/Software Testing Analyst shall:

5.7.1 Be responsible for meeting and maintaining the CYBER certification and accreditation requirements. This support includes researching, testing and providing technical information for obtaining the CYBER accreditation.

5.7.2 Ensure the team’s technical information/support is in accordance with the Federal Information Security Management Act (FISMA).

5.7.3 Ensure software scanning for security vulnerabilities.

5.7.4 Ensure full RMF support including security automation through DevOps.

5.7.5 Monitor Security Technical Implementation Guide (STIG)/Patches, Assured

Compliance Assessment Solutions (ACAS) scans, End of Life software, End of Life hardware, contingency/control tests, Information Assurance Vulnerability Alerts (IAVAs), Information Assurance Vulnerability Bulletins (IAVBs), Information Assurance Vulnerability Tests (IAVTs).

5.7.6 Monitor NEP security posture, including providing guidance and notifying the

NEP Program/Project management along with the NEP technical team. This support includes initiating, maintaining, and updating ADO of open vulnerabilities and applied mitigations utilizing Department of Defense Enterprise Mission Assurance Support Service (eMASS) tool.

5.7.7 Maintain/update certification and accreditation documentation for all NEP system accreditations.

5.7.8 Research Cyber Security concerns/issues for Management/NEP technical team.

5.7.9 Monitor all database and application software used in NEP for version change control and nearing/exceeding last date allowed in the Department of Navy Application Database Management System (DADMS).

5.7.10 Coordinate/interface with NEP Technical Team, Defense Information Systems Agency (DISA), Cyber Security Staff, and Fleet Cyber Command to document, review, revise, and submit changes related to Ports, Protocols, and Services (PPS), Access Control Lists (ACLs), and Whitelists. This support includes preparing and submitting the registration forms for new requirements.

5.7.11 Support DOD Portfolio Repository–DON (DITPR-DON) to support the annual review.

5.8 Mentoring/Knowledge Transfer. The Appian Developer (Senior/Lead) and Quality Assurance/Software Testing Analyst shall complete tasks that will provide a comprehensive application Transfer of Knowledge to NAVSUP BSC and application sustainment team personnel. Areas of knowledge transfer will be presented as succinct and shop-usable lesson plans.

The Appian Developer (Senior/Lead) and Quality Assurance/Software Testing Analyst shall:

5.8.1 Explain what procedures that are incorporated into production are necessary for testing and how fixes/functional additions are deployed.

5.8.2 Provide walkthrough exercises of all application modules explaining each.

5.8.3 Have the organic programmers assist on some easier tasks to become familiar.

5.8.4 Address programmer questions.

5.8.5 Assist Navy resources on troubleshooting and debugging problems.

5.8.6 Provide source code instructional tools.

5.9 Transition Support.

5.9.1 Transition - Phase Out. At the end of the period of performance, as the incumbent, the contractor shall provide a designated point of contact at least 60 days prior to the end of the period of performance, and provide advice, knowledge transfer and support in the timeline and transition plans of government data, functions and services to the new awardee and/or the Government.

Performance Standard: All work associated with the tasks described in Section 5.3, 5.4, 5.5, 5.6, 5.7 and 5.9 above will be consistent with industry best practices and following Enterprise and Project specific standards including software development and version control. All software released will follow the government Configuration Management process and management controls.

Assessment Method: All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

6.0 Deliverables: All deliverables must meet the format requirements specified by the

Contracting Officer’s Representative (COR) and/or Technical Assistant (TA).

Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

Deliverable Delivery Timing

5.3 Product Backlog Items As required

5.3.3. Lifecycle System Documentation As required

5.3.11 Team Performance Metrics As required

5.4.14 Training As required

5.4.15 Functional/Software Engineering Documentation – Agile and

NAVSUP BSC SDM

As required

5.4.17 Release Packages As required

5.4.21 Program executables As required

5.5.3 Test Plans/Results As required

5.6 Cyber Security Workforce Baseline Certification Proof at Time of Award

5.7 Mentoring/Knowledge Transfer Services As required

5.8 Transition Plan Transition –

Phase out

6.1 Post-Sprint Status Reports. Major accomplishments of the contractor team, and planned activities for the next sprint. Specific status report format to be provided as GFI. Status reports shall be provided via email to the TA within 5 days after the completion of the sprint.

6.2 Ongoing Status Reporting. Developer shall use the government’s tasking/status tool, Microsoft Azure DevOps (ADO), to track milestones, issues/trouble tickets daily.

6.3 Monthly Status Report. The contractor shall send status reports electronically to the Technical Assistant (TA) and Contracting Officer’s Representative (COR) on a monthly basis (due by 1700 on the 10th day of every month) documenting the performance on the task order. The monthly status report shall include the following elements:

Resources by name

Date project/task received Status of work with accomplishments documented, including mentoring accomplished Team metrics Any issues/problems encountered or possible and recommended solutions Changes to roles and responsibilities and schedule changes Identify any Government dependencies that are overdue which impact schedule or performance Evaluate performance and determine adequacy of staffing Staffing changes and onboarding status of resources

6.4 Monthly (if applicable) Travel Reports. No travel is planned for this task order.

Travel reports shall be sent electronically to the TA and COR. Travel reports shall include: destination, dates of travel, subjects discussed, and any issues/problems encountered and recommended solutions.

6.5 Source Code. Developer shall use the government’s repository tool, Microsoft

Azure DevOps or Appian BPM Suite. All code shall be pushed/merged at the end of each day, according to the project standards.

6.6 Mentoring/Knowledge Transfer documentation, lesson plans, and mentoring reports. Developer will create weekly log containing knowledge transfer tasks in MS Excel. Cumulative log will be delivered to TA every 2 weeks from beginning of period of performance. The mentoring report shall include:

Trainer Name Trainee Name Date Knowledge Transfer began Date Knowledge Transfer completed Description of skill/knowledge area

6.7 Transition Documentation. The developer shall provide system flows, program specifications, system test results, technical programming specification documentation, implementation instructions, code audit results and release procedures. Combine the results from the manual and automated code analysis into a comprehensive report, providing a summary and listing the found issues and recommendations. This documentation shall be stored in Microsoft Azure DevOps and provided the last day of the period of performance.

6.8 Monthly Payment Request. The contractor shall submit a monthly payment request (invoice) electronically using Wide Area Workflow (WAWF) by the 10th day of each month. WAWF is available on the internet at https://piee.eb.mil.

The Period of Performance (POP) for each invoice shall be for one month.

Included with the invoice shall be support documentation such as, but not limited to, travel authorizations (if applicable) and a monthly status report. Invoices received without the support documentation (in the correct format) will be rejected.

The contractor shall submit a final invoice or zero cost invoice to properly close out the contract.

6.9 Mandatory Annual Training: The contractor shall participate in DoD/DoN mandatory annual training when announced by the Government.

Contractors are required to complete the following mandatory training and any updated/future training as released: 1) Personally Identifiable Information (PII); 2) DoN Records Management: Everyone's Responsibility; 3) Anti-Terrorism/Force Protection Awareness; 4) Combating Trafficking in Person; 5) Operations Security (OPSEC); 6) Training & Readiness – The Active Shooter. The contractor shall complete DoD Cyber Awareness Challenge v4 mandatory training two weeks after contract award. Cory Harvey 717-605-6872, or Antonio Arturet-Millan, 717-605-8192, are the POCs for the Cyber Awareness training. Training can be accessed at https://cyber.mil/training/cyber-awareness-challenge

Unless stated otherwise, the following instructions apply to all deliverables:

All versions of the deliverables required by the TO shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

Deliverable due dates shall consider the review periods described below:

Draft deliverables will be reviewed and feedback and/or requested changes provided within 5 business days (unless otherwise specified).

Government reserves the right to request a formal review session with the contractor during these timeframes and may request that the contractor make changes to any version of a deliverable.

Government will review and approve or reject all final versions of all deliverables within 5 business days of receipt (unless otherwise specified).

If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 5 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR. If more than the specified number of calendar days is required for Government review and approval, the COR will inform the contractor of the need for an extension within the initial review period.

Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email. For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the Period of Performance, except the final Monthly Status Report.

Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance:

This contract will have a performance period of one (1) base year with two (2) option years.

8.0 Place of Performance:

The following location is the primary site for performance:

Naval Support Activity, Naval Supply Systems Command, 5450 Carlisle Pike, Building 409, Mechanicsburg PA 17050

No contractor services shall be performed on Saturdays, Sundays, Government Holidays or during base closures. The contractor shall follow appropriate local base policy for reporting to work during severe weather and base closure. The contractor is not authorized to begin work until both the Visit Authorization Request (VAR) and System Authorization Access Request - Navy (SAAR-N) forms have been successfully processed and base and system access have been granted. For some tasks and with TA approval, the contractor may work remotely from their facility or home. Overseas travel is not required.

9.0 Travel:

Travel (if applicable) shall be in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the TA and COR prior to the actual travel and all travel must be funded in the contract prior to any travel expenses being incurred. No travel shall occur outside of the period of performance dates of the contract. Travel 12 hours or less, per diem does not apply. Foreign (overseas) travel will not be required for this Task Order.

Travel Location Frequency of Travel Number of People Dates Mechanicsburg, PA Quarterly 5 TBD

If travel is required, the contractor is responsible for making all needed arrangements for their personnel.

9.1 Travel Policy. The Government will reimburse the contractor for allowable travel costs incurred by the contractor in performance of this PWS and determined to be in accordance with FAR subpart 31.2, subject to the following provisions:

Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

9.2 Travel other. Travel, subsistence, and associated labor charges for travel time are authorized whenever a task assignment requires work to be accomplished at a temporary alternate worksite. Travel performed for personal convenience will not be reimbursed.

9.3 Air/Rail Travel. In rendering the services, the contractor shall be reimbursed for the actual costs of transportation incurred by its personnel not to exceed the cost of economy class rail, or plane fare, to the extent that such transportation is necessary for the performance of the services hereunder and is authorized by the Contracting Officer’s Representative (COR).

Such authorization by the COR shall be indicated in the order or in some other suitable written form.

10.0 Security.

This clause does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The clause is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

SUPTXT204-9400(7-18) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

(JUN 2018)

Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, and Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this text will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

ONBOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of “productive”:

a. Visit Authorization Request (VAR)

b. Contractor Information Request Form (CIRF)

c. FD-258 fingerprint card/ Contractor Responsibility

d. Completed EQIP (Electronic Investigation)/Contractor Responsibility

e. All contractor resource(s) must have an active Defense Information System for Security (DISS

– formerly JPAS) profile

f. Common Access Card (CAC)

g. Facility Clearance Level per DD Form 254

h. Individual Contractors adjudicated at the appropriate level

i. System Authorization Access Request – Navy (SAAR-N)

j. Cyber Awareness Training Certification

k. Information Assurance (IA) certification (if applicable)

l. Derivative Classification Training Certification (if classified contract)

m. SIPRNET and NATO training acknowledgement (if classified contract)

n. User Access Request (UAR) only applies when contractor requires access to ERP/SAP

Note (1): No reimbursements will be paid by the Government for efforts during the “On- Boarding Process”. When applicable, invoicing by the contractor may begin at the performance period start date.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include PHI. All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

TEMPORARY ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and temporary access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under temporary access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor's Security Representative.

Within three work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor's Security Representative. The Contractor's Security Representative shall be the primary point of contact on any security matter. The Contractor's Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS

OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

- SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

- Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

- Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 5 years) throughout the contract performance period.