Attachment B - PWS v1 Equipment PWS 01 05 12 ITS Modernization - 10 APR.pdf

Performance Work Statement

ITS- Modernization (WHS/ITS)

January 25, 2012

1. General Information

1.1 Introduction: The requirement is to modernize the existing manual package/parcel processes with automated hardware and software and to integrate the software systems with the existing legacy systems. The government requires increased tracking, accountability and metrics reporting of individual deliveries to include packages, parcels, cargo, and official correspondence. This initiative shall be carried out in two stages:

1.1.1 Modernize the existing manual processing functions and capabilities

1.1.2 Integrate the software systems with the existing legacy systems

1.1.3 Background of Requirement: Package, Parcel, Freight, Food, Special Events and

Services are received weekdays at the Pentagon Remote Delivery Facility (PRDF). The Pentagon

Force Protection Agency (PFPA) verifies screens and approves entry to the PRDF for deliveries to be processed by the Pentagon Dockmaster Office (PDO). The Pentagon Dockmaster Office

(PDO) is the official WHS/FSD tracking, receiving and accountability arm for the Pentagon.

1.1.4 Scope: The general nature of the work is for the contractor to provide management, labor, tools, supplies, and material required to modernize the manual package/parcel receiving and tracking processes, functionality and capabilities. Integrate the software solution with the existing Washington Headquarters Services (WHS) enterprise family systems,‖ WHS legacy systems; Integrated Tracking System (ITS), Star Receiver Material Tracking System (SRMTS), Bear Tracks Material Tracking System (BT), and the Digital Delivery Mail Program (DDMP).

Analyze and establish business rules, processing procedures, timelines and human capital requirements. Establish, evaluate, and understand the requirements necessary to modernize and integrate systems and processes on a larger regional scale.

The areas of emphasis are:

Hardware and Software Modernization, Integration and Implementation

Systems Deployment

Systems Integrations

Systems Testing

Systems Platform Development

Documentation and Guides (manuals)

Training

Performance Work Statement: ITS-Modernization (WHS/ITS)

1.2 Government Furnished. At the discretion of and approval by the government, provide to the contractor:

GFE Description

Workspace and

Office Equipment

On-site office space for contractor personnel at various operating locations, subject to requirements and space availability. Contractor personnel may be provided a standard workspace, which includes computer desktop, network and printer access, office supplies, phone, facsimile and access to a copier.

Personal Devices Personal communication devices (e.g., BlackBerry, pager, cell phone, etc.) for critical contractor personnel.

Technical Data and

Software Licenses

Applicable and relevant technical data and software licensing currently in existence will be provided to the contractor.

1.3 Contractor Furnished. The contractor shall provide all labor, software, and other materials required to meet performance requirements.

Fully Functional Modernization Solution: The contractor shall procure, on behalf of the

WHS/FSD/PDO, a complete, useable and fully functional system consisting of all hardware, and software. The contractor shall integrate the modernization solution software with the existing

(WHS) enterprise family systems, and customize the hardware solution to conform to environment specifications; (see Environment Document). The modernization solution must integrate and function with existing legacy systems; Integrated Tracking System (ITS), Star

Receiver (SRMTS), Bear Tracks (BT), Digital Delivery Mail Program (DDMP) / Digital Mail

Modernization (DMM). Washington Headquarters Service (WHS) must be the licensee of any software, not the contractor and all hardware will be government owned, not leased.

Follow-on Operations and Maintenance for ITS-Modernization The contractor shall provide support services to WHS/FSD/PDO to 1) operate, maintain, and sustain the WHS/ITS hardware and software.

1.4 Major Functional Area Required Outputs and Performance Levels. The contractor shall meet or exceed the performance levels for the required outputs listed below. Required outputs and performance levels of high interest are summarized in paragraph 1.5, Performance-based Matrix. Contents of the Performance-based Matrix may be modified during contract performance to reflect changing priorities and performance requirements.

1.4.1 Hardware and Software Integration and Implementation: In accordance with provided salient characteristics, the contractor shall/the system shall be able to/have/provide the:

1.4.1.1 Integrate software and hardware into the (WHS) enterprise family systems, designed to enhance the tracking, accountability and identification functionalities to allow increased support to the Secretary of Defense and Deputy Secretary of Defense along with other top-level executives, Pentagon population and supported lease facilities. The system will facilitate performance matrix reporting and key real time identification. It takes advantage of "Green initiatives" by reducing the paper trails associated with the tracking and accountability of incoming material deliveries, services and correspondence. Enable digital routing, management and POC identification of inbound packages, parcels and correspondence. Increase tracking and accountability of individual deliveries and correspondence. Increase verifiers for security identification and investigations. Identify plan for implementation throughout the National

Capital Region (NCR)

1.4.1.2 Implement Fully Functional Modernization Solution;

1.4.1.3 ensure all documentation and security controls (patching, etc.) for Defense Information

Assurance (IA) Certification Accreditation Program (DIACAP) is completed on time to allow system to be placed in production and operational by expected project delivery date;

1.4.1.3.1 The contractor shall possess hands-on experience and technical expertise in the use and analysis of a variety of IA guides, tools, and products to include the associated output results and reports, such as:

Security Technical Implementation Guides, or STIG, (NSA, DISA, and vendor equivalent)

Host- and network-based audit tools

FSO Gold and Platinum Disks Project System Requirement Specification

DISA FSO SRR Scripts (Windows and Unix)

1.4.1.3.2 The contractor shall comply with the appropriate WHS, DoD, and NIST-approved IA architecture, policies, programs, standards and guidelines, such as:

IA policies DoD Directive 8500.1, Information Assurance

DoD Instruction 8500.2, Information Assurance (IA) Implementation

Security Technical Implementation Guides (STIGs)

Global Information Grid (GIG) IA Technical Framework

DII Common Operating Environment (COE)

WHS Computer Incident Response Guide

NIST Special Publication 800-53

Department of Defense (DOD) Information Operations Condition (INFOCON) System

Procedures SD 527-1

DoD Information Assurance Certification and Accreditation Policy (DIACAP) 8510.01, or other DoD accreditation directives/guidance/instructions

IEEE 802.11 Wireless Standards

1.4.1.3.3 The contractor shall complete security checklists, ensuring that each reflects the corresponding STIG to ensure all key security requirements of the STIG are covered during the security readiness review (SRR).

1.4.1.3.4 Report Results of scans in the Vulnerability Management System.

1.4.1.4 comply with Section 508 Standards, and the Privacy Act. If system is to be implemented in the Defense Continuity Integrated Network (DCIN), process for implementation must be followed;

1.4.1.5 provide full requirements gathering review and documentation;

1.4.1.6 initial configuration and install on QA servers;

1.4.1.7 configure integrations between modernization solution software and (WHS) enterprise family systems

1.4.1.8 analysis, documentation and configuration of control data. Some data will be brought over from Star Receiver while other data will be newly created;

1.4.1.9 develop reporting tools for workflow particulars;

1.4.1.10 QA all work and provide issues document;

1.4.1.11 provide user guides, deployment guides, configuration guides;

1.4.1.12 supply documents for C & A Package and authorization to operate;

1.4.1.13 move software from QA to Production;

1.4.1.14 provide admin, staff, user training for all updated and or enhanced software, hardware, processes, workflows

1.4.1.15 Deliverables:

Section 508 Compliance Report

IA Documentation for Certification and Accreditation

Defense Continuity Information Network (DCIN) Request Form

Privacy Impact Assessment

Design and Architecture Document

Change Management Document

Operations Manual

Issues Control Document

1.4.2 System Testing

1.4.2.1 Implement in QA/Test Environment: Ensure QA/Test environment is setup and

Implement Fully Functional Modernization Solution in this environment prior to production deployment; continue to support production, and post-production stages.

1.4.2.2 User Acceptance Testing: Coordinate with WHS/FSD and WHS/ESD management to develop user acceptance test (UAT) scenarios. Assist customer in conducting UAT scenarios in

QA/Test environment (to include test data creation, system functions and interfaces, and reporting, etc).

1.4.2.3 Deliverables:

System Test Cases & Scripts

System Test Results

User Acceptance Test Cases

User Acceptance Test Report

1.4.3 System Deployment

1.4.3.1 Authority To Operate (ATO): All Information Assurance requirements and documentation are completed and vetted and IA scan findings are mitigated and documented in accordance with the DoD FISMA POA&M for DAA Authorization to Operate (ATO).

1.4.3.1.1 Coordinate deployment with Operations and Maintenance contractor team (applies to pilot, production, and post-production stages).

1.4.3.1.2 Comply with the WHS Enterprise Information Technology Services Directorate (EITSD) methodologies and Software Development Life Cycle process.

1.4.3.2 Implement Fully Functional Hardware and Software Modernization Solution in

Production Environment: Ensure production environment is set up and implement through coordination with Operations and Maintenance (O&M), in this environment.

1.4.3.3 Deliverables:

Production Implementation Plan

System Deployment Instructions

Authorization to Operate

1.4.4 Package/Parcel Sorter Software 1: Provide Package/Parcel sorter software with the following salient characteristics which shall/provide/have/be able to:

1.4.4.1 creation of business rules and templates to modify business processes at the user level;

1.4.4.2 integrate package/parcel sorter software with (WHS) enterprise family systems;

1.4.4.3 visually monitor image display of package/parcel labels;

1.4.4.4 push identified data, required to create automated accountability records, to the existing (WHS) enterprise family systems;

1.4.4.5 push captured images to the designated (WHS) enterprise family systems;

1.4.4.6 push captured data to the designated (WHS) enterprise family systems;

1.4.4.7 identify, record and push sender and recipient data – name, address, zip code, company, etc. to the designated package/parcel record creation software;

1.4.4.8 programmable business rules and template creation ability at the user level;

1.4.4.9 manual identification process for package/parcels that are difficult to identify automatically;

1.4.4.10 integrate multiple stand alone work stations for manual visual processing of package/parcels unreadable by the system;

1.4.4.11 high-speed image processer - captures and decode minimum of 160 MB per second;

1.4.4.12 support and provide multiple criteria format reporting features;

1.4.4.13 receive Customer Base Tables data input from (WHS) enterprise family systems;

1.4.4.14 on-line help and support;

1.4.4.15 Directional Optical Character Recognition (OCR);

1.4.4.16 handprint and print recognition (OCR);

1.4.4.17 duplex color imaging at 300dpi;

1.4.4.18 high resolution Omni;

1.4.4.19 audit reporting traceable to end user activities;

1.4.4.20 operator-selected image format; default is Portable Document Format (PDF) and

Tagged Image File Format (TIFF) or JPEG - Joint Photographic Experts Group format at 300 dpi color

1.4.4.21 barcode recognition– UPS, Federal Express, DHL, USPS certified, overnight, Intelligent Mail Barcode (IMB), Postnet (4 – state), legacy system bar code, etc.;

1.4.4.22 allow the sorter to be controllable by user-specific sort programs;

1.4.4.23 allow user-specific sort programs and allow for selection by: Recipient Name -address, zip code, organization, building, floor, PO Box Sender Name-address, zip code, organization, building, and floor, PO Box Generic Mail Forwarded Mail or Returned Mail;

1.4.4.24 landscape and portrait scanning up to 11 x 17 inches.

1.4.4.25 include software in the service contract – System upgrades, enhancements, repair, and replacement;

1.4.4.26 alert user/operator of unidentifiable recipient and or unreadable carrier labels;

1.4.4.27 systems and hardware training and support for all user levels – administration, management, supervisor, staff, user, customer etc.;

1.4.4.28 read, identify and image hand written labels at 75 % accuracy rate;

1.4.4.29 read, identify and image printed labels at 95 % accuracy rate (all font styles);

1.4.5 Package/Parcel Hardware 1: Provide Package/Parcel Hardware with the following salient characteristics which shall/provide/have/be able to:

1.4.5.1 custom build package parcel sorter hardware to conform to and operate within facility environment specifications; (refer to environment document)

1.4.5.2 multiple bin separation capability;

1.4.5.3 process package/parcels up to 70 lbs;

1.4.5.4 process package/parcels up to 32‖wide x 32‖height x 48‖length;

1.4.5.5 locate, identify and image courier shipping labels from multiple views/angles, minimum 5 side reading with redundant coverage;

1.4.5.6 process package/parcels without manual presort;

1.4.5.7 process UPS, Federal Express, DHL overnight envelopes;

1.4.5.8 identify, capture and image barcodes and shipping labels from various carriers at

300dpi color;

1.4.5.9 maximum read rate with minimal package/parcel spacing

1.4.5.10 capture and identification of sender block, recipient block;

1.4.5.11 automatically recognizes both sender and recipient address blocks regardless of their orientation with respect to the sorter;

1.4.5.12 emergency shut off features - automatic and manual functionality;

1.4.5.13 Provide Sorter safety covers – Safety covers to encompass all moving machine parts, see through in nature with heat and dust venting design, lift cover access points to each portion of sorter, cover designed with automatic machine shut off when accessed, ability to remove/separate the entire cover from sorter ;

1.4.5.14 automatic bar code labeling applied at 98% accuracy rate;

1.4.5.15 date and time stamp identification for each package/parcel processed;

1.4.5.16 read, identify and image printed labels at 95 % accuracy rate (all font styles);

1.4.5.17 read, identify and image hand written labels at 75 % accuracy rate;

1.4.5.18 package imaging capabilities

1.4.5.19 combined identification system; image capture, bar code reading, weight and volume;

1.4.5.20 omni directional code reading independent of product position;

1.4.5.21 volume and weight measurement data capture;

1.4.5.22 inbound and outbound processing;

1.4.5.23 camera system focuses in conjunction with measurement system;

1.4.5.24 integrated weight scale up to 150lbs measurement

1.4.5.25 systems and hardware training and support for all user levels – administration,

1.4.5.26 include equipment in a service contract–scheduled maintenance, upkeep, repair, replacement and parts; four-hour technical hardware response time for parts and labor;

1.4.6 Package/Parcel Hardware & Software 2: Provide Package/Parcel Hardware with the following salient characteristics which shall/provide/have/be able to:

1.4.6.1 automatic feed roller type package/parcel processing equipment;

1.4.6.2 barcode recognition– UPS, Federal Express, DHL, USPS certified, overnight, Intelligent Mail Barcode (IMB), Postnet (4 – state), WHS legacy system bar codes, etc;

1.4.6.3 integrate package/parcel sorter software with (WHS) enterprise family systems;

1.4.6.4 verify and identify package record creation for each piece

1.4.6.5 identify and alert operator/user when package/parcel has no legacy system existing package record

1.4.6.6 push specified package record accountability status to legacy system for record status documentation

1.4.6.7 locate, identify and scan courier shipping label bar code and legacy system bar code from multiple views/angles, minimum 5 side reading with redundant coverage;

1.4.6.8 maximum read rate with minimal package/parcel spacing

1.4.6.9 process package/parcels up to 70 lbs;

1.4.6.10 process package/parcels up to 32‖wide x 32‖height x 48‖length;

1.4.6.11 process package/parcels without manual presort;

1.4.6.12 process UPS, Federal Express, DHL overnight envelopes;

1.4.6.13 emergency shut off features - automatic and manual functionality;

1.4.6.14 Provide Sorter safety covers – Safety covers to encompass all moving machine parts, see through in nature with heat and dust venting design, lift cover access points to each portion of sorter, cover designed with automatic machine shut off when accessed, ability to remove/separate the entire cover from sorter ;

1.4.6.15 date and time stamp identification for each package/parcel processed;

1.4.6.16 inbound and outbound processing;

1.4.6.17 systems and hardware training and support for all user levels – administration,

1.4.6.18 include equipment in a service contract–scheduled maintenance, upkeep, repair, replacement and parts; four-hour technical hardware response time for parts and labor;

1.4.7 Personnel Digital Assistant (PDA): Provide PDA handheld devices and hardware with the following salient characteristics which shall/provide/have/be able to:

1.4.7.1 reference hardware /equipment document for specification requirements

(Version 1.0);

1.4.7.2 include hardware /equipment in a service contract–scheduled maintenance, upkeep, repair, replacement and parts; four-hour technical hardware response time for parts and labor;

1.4.7.3 systems software and hardware training and support for all user levels – administration, management, supervisor, staff, user, etc.;

1.4.7.4 operating system (OS) must be compatible and operate with WHS legacy system mobile software;

1.4.7.5 provide 70 each PDA Bundles - Bundles to include: Sync/Charge cradles, connection cables, batteries, holsters, etc.; reference PWS Item # 1.4.7.1 and (Spec Doc Version

1.0);

1.4.7.6 Installed and fully operational WHS legacy system mobile software;

1.4.7.7 designated functions / options removed or deactivated from PDA;

1.4.7.8 extended service and replacement agreement on all hardware;

1.4.7.9 server based synchronization (PDA);

1.4.7.10 1D barcode laser scanner and 2D barcode imager / camera support

1.4.8 WHS legacy system mobile software installs and systems modernization hardware and software integrations are to be conducted and supported in conjunction with the current legacy system support contractor.

1.4.9 Travel. All travel within the NCR is included in the price of this task order. The contractor shall NOT bill the government for travel related expenses within the NCR under this task order. The government will reimburse the contractor for all travel outside the NCR that was authorized in advance by the contracting officer, for reasonable travel related expenses in accordance with FAR 31.205-46, Travel Costs. Such direction will be made by the contracting officer via issuance of bilateral modification(s), on a cost reimbursement basis (with no burdens/mark-ups applied to the actual cost) to the task order against the government specified not-to-exceed amount.

1.5 Performance-Based Matrix

Performance Management

Desired End

Result

Area to be surveilled

Performance Standard Quality

Assurance

Incentives

Fully integrated

Performance

Management

Program

Overarching

Performance

Management

Briefing slides will be delivered to the

Executives at least two full business days prior to the monthly meeting at least ninety percent

(90%) of the time.

QASP CPARS interim and final for input into the

Past Performance

Information Retrieval

(PPIRS) Database.

Data &

Presentation

Accuracy

Final monthly briefing presentations will contain accurate data with no more than one data error per month and no more than two administrative

(presentation, grammar, spelling, etc.) errors per month.

QASP CPARS interim and final for input into the

Past Performance

Information Retrieval

(PPIRS) Database.

Data Model

Completion

Complete Data Model within 60 days of contract award. Final

Data model will be submitted and accepted by Government Task monitor/COR within 90 days of contract award.

QASP CPARS interim and final for input into the

Past Performance

Information Retrieval

(PPIRS) Database.

Performance Work Statement: Digital Delivery of Mail Program

1.6 Administrative Requirements

1.6.1 Contractor Inspection System (as required by FAR 52.246-4). The contractor required inspection system will be a major focus of the Government Quality Assurance Surveillance Plan

(QASP). This system will be used as a window to monitor contract performance in lieu of Government detailed inspection of actual contractor work. The contractor shall ensure the inspection system provides for quality control elements such as a reporting system, corrective action procedures, trend analysis, and a process for externally auditing the system to ensure reliability. The contractor shall also ensure the inspection system contains continual risk management that addresses both contractor and

Government risk areas, e.g., personnel turnover and the link between past problems and potential problems.

1.6.1.1 The contractor is responsible for the overall quality of contract performance and for the management of its own workforce. The contractor off-site manager with responsibility for the successful performance of this contract must arrange with the COR for the conduct of a weekly telephonic conference with the COR to review contract performance.

1.6.1.2 The COR for this contract may clarify contractor responsibilities within the requirements of the contract as specified by the Contracting Officer appointment memorandum.

1.6.1.3 The Government will also designate task monitors to conduct quality assurance surveillance of their respective areas.

1.6.1.4 All work to be performed under this contract is subject to Government surveillance at any time either on-site or virtual. That surveillance may be performed as in-process inspection, preliminary inspection, and/or final inspection. The method of inspection may include visual inspection of the work products and/or impromptu status discussion with the contractor. The

Government Officials will:

Conduct surveillance of the activities and deliverables under their purview;

Provide in-process clarification of the tasks that that they have previously identified;

Review the monthly reports relative to paragraph 1.10 and submit a concise assessment of the monthly report to the COR, clearly indicating any work products found to be unacceptable;

Report any performance problems (e.g. non-compliance with contract requirements, failing to meet acceptable quality levels) that they observe or discover to the COR immediately;

Accept conforming work products.

1.6.1.5 Government employees will not:

supervise contractor employees;

accept non-conforming work products without the express written approval of the Contracting

Officer.

1.6.2 Security. All networks are designated as sensitive but unclassified / For Official Use Only.

The contractor must provide adequate personnel with completed favorable background investigations at the appropriate level to support IT systems for Limited Privileged IT-II, Non- Privileged IT-III, noncritical- Sensitive ADP-II and Nonsensitive ADP-III. The background checks shall be in place prior to individuals reporting for duty at the required government location. Evidence of the completed background check shall be provided to the government customer. Further, the DODI 8500.2, IA

Implementation, which can be obtained at http://www.dtic.mil/whs/directives/index.html, requires that all personnel (this includes DoD military personnel, civilian personnel, consultants, and contractors) who perform work on sensitive automated information systems be assigned to duties that are designated at one of three (3) Sensitivity Levels: IT-I, IT-II, or IT-III (see Table 1). These designations equate to privileged, limited privileged and non-privileged access to network and information systems, and/or resources. Depending on the contractor's assigned Sensitivity Level (IT-I, IT-II, or IT-III), the corresponding investigation will be required (i.e. NACLC, SSBI). Any and all personnel replacing existing contractor staff shall comply with security requirements.

Table 1

Access Categories Sensitivity Level Minimum Required Investigation

Privileged IT-I Single Scope Background Investigation

(SSBI); also supports granting of a TOP

SECRET security clearance

Limited Privileged IT-II National Agency Check with Local

Agency Checks (NACLC) (contractors);

also supports granting of a SECRET security clearance

Non- Privileged IT-III National Agency Check with Local

Agency Checks (NACLC) (contractors);

also supports granting of a SECRET security clearance

The following IT Sensitivity Levels will apply:

Table 2

Position IT LEVEL

Project Leaders, System Analysts, System

Architects, Senior Technicians with admin privileges to the servers.

IT-II

Contractor personnel will comply with contractor identification procedures including identification of contractor status or company in signature blocks, wearing an appropriately colored Pentagon or NCR badge while in the Pentagon or other Government buildings, and identification of contractor status at meetings. The Government will provide authorized contractor personnel with the necessary Pentagon or NCR badge. The contractor shall comply with Government specified in-processing and out-processing guidelines.

1.6.3 Contingency Operations

1.6.3.1 DODI 3020.37. In accordance with DODI 3020.37, Continuation of Essential DoD

Contractor Services during Crises, mission essential contractors are required to provide a contingency plan and designate mission essential personnel. The contractor is required to maintain updates to this plan as necessary and ensure that coverage is provided during real-world and exercise scenarios.

http://www.dtic.mil/whs/directives/index.html,

1.6.3.2 COOP. Should a crisis be declared, the Contracting Officer will verbally advise the contractor of the revised requirements, followed by a written notification. Written notification will be sent as soon as practicable. The contractor will ensure contingency support is available for the continuation of essential DoD contractor services during a crisis situation. This support will be detailed in a contingency plan. In the event of mission essential system failure, which requires immediate attention, the contractor shall remedy the situation(s) in accordance with the performance standards outlined in Section 1.5, Performance-based Matrix. In the event of non-mission essential system failure not requiring immediate attention but requiring short turn-around time due to another exercise, the system must be repaired in a timely manner. See SS Section 2.0 for defined repair times. Any price changes resulting from this crisis will be negotiated in accordance with FAR clauses for "Changes."

Relocation of persons providing services on this task order to a designated alternate site may be required during a Continuity of Operations situation. Each person providing services on this task order that are designated as essential is expected to use all means at their disposal to continue to provide such services during periods of crisis until appropriately released or evacuated by the proper civilian or military authority.

1.6.4 Government Oversight of Contractor Employees

1.6.4.1 The contractor shall be responsible for maintaining satisfactory standards of employee competency, conduct, and integrity and shall be responsible for taking such disciplinary action with respect to its employees as may be necessary to ensure satisfactory contract performance. In the event the contractor fails to remove any employee from the contract work whom the Contracting Officer or the Contracting Officer's designated representative deems incompetent, careless, insubordinate, unfit, objectionable or whose continued employment on the work is deemed by the Government to be inimical to the Government's mission, the Contracting Officer or the Contracting Officer's designated representative may require, in writing, the contractor to remove the employee from work under this contract and any other contract awarded to contractor by the Government.

1.6.4.2 This contract incorporates 32 CFR 234, Conduct on the Pentagon Reservation. Any contractor employee that violates the standards of conduct prescribed by 32 CFR 234 shall be deemed unfit and otherwise objectionable under part § 234.7, Disorderly Conduct, and may be subject to removal from the contract work.

1.6.4.3 This provision applies to all subcontractors or vendors of any tier utilized by contractor to perform the work. The contractor is responsible for incorporating this provision in all subcontracts or other contracts awarded by contractor to perform the work. For purposes of this provision, the terms "employee" or "contractor employee" includes all contractor, subcontractor or vendor employees of any tier utilized by contractor to perform the work.

1.6.5 Data Rights. The Government and contractor have agreed to data rights as defined in DFARs

252.227-7013, Rights in technical data—Noncommercial Items and 252.227-7014, Rights in noncommercial computer software and noncommercial computer software documentation.

1.6.6 Technical Data and Software Licenses. At the discretion and approval of the Government, applicable and relevant technical data and software licensing currently in existence will be provided to the contractor during initial transition.

1.6.7 Non-Disclosure Agreements. The contractor is responsible for obtaining all non-disclosure agreements with all applicable corporate, supplier and sub-tier vendors with proprietary, restricted, competition sensitive, or any other restricted (e.g., non-foreign disclosure due to public law) data that will be used or accessed during the duration of this contract.

1.6.8 Place of Performance. The primary place of performance will be at the Pentagon and other

Government facilities within the NCR. In addition, the contractor may be required to provide support at other locations within the NCR, and occasionally at alternate sites outside the NCR.

1.6.9 Hours of Operation and Performance

Normal Working Hours (NWHs):

Sections Hours of Operations

Overarching Performance Management 8:30 am to 5:00 pm (EST)

Extended Working Hours (EWHs) are all hours outside of NWHs (including weekends and holidays). No overtime compensation shall be paid in support of this Performance Work Statement

(PWS).

1.6.9.1 The contractor shall perform support services on-site (in Government work spaces) during

NWHs for the purposes of supporting customers and the infrastructure. The contractor shall also provide limited on-site support during EWHs at no additional cost to the Government provided that the

COR provides written notice to the contractor at least two (2) business days in advance, and specifies the task areas that require support; and, the total hours shift from NWHs to EWHs do not exceed a total of eighty (80) hours per month.

1.6.9.2 The Government and contractor shall coordinate closely to ensure the best combinations of staff are available to meet operational requirements. The contractor is encouraged to propose work schedules for selected personnel during Normal and Extended Working Hours that optimize coverage for technical support services.

1.6.9.3 In providing support during EWHs, the contractor shall be capable of providing at least remote support within one (1) hour of receiving notification by the COR; however, depending on the nature of the activity/event, on-site support may be required. This type of support may occur on a scheduled or unscheduled basis. For scheduled on-site support activities, the contractor shall report for work at the time and place pre-arranged with the COR. For unscheduled on-site support activities, the contractor shall arrive on-site (ready to work) at the Government facility within one (1) hour after efforts at remote resolution have been discontinued or otherwise receiving notification that on-site support is required.

1.6.10 Information Assurance Training Requirements. Contractor personnel assigned to perform

IA functions and responsibilities shall comply with DoD Directive 8570.1 ―Information Assurance

Training, Certification, and Workforce Management‖ and its implementing Manual, DoD 8570.1-M.

Contractor personnel shall complete applicable certification requirements not later than six months of being assigned to the IA function. The Contracting Officer, in conjunction with the COR will ensure that Contractor personnel are appropriately certified and provide verification to the Defense Eligibility

Enrollment System (DEERs). The Government will provide the appropriate security form(s) (DD Form

254) and/or other documents required for the contractor to provide support on the contract.

1.6.11 Section 508 Compliance. The contractor shall ensure that all electronic and information technology (EIT) procured through this task order meet the applicable accessibility standards at 365

CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. This standard is viewable at http://www.section508.gov.

1.7 Definitions

ADP-I Positions – Those positions in which the incumbent is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain.

ADP-II Positions – Those positions in which the incumbent is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the ADP-I category to insure the integrity of the system. This is a critical sensitive position.

Business Engineering – The actions required to analyze existing business processes and workflows in order to develop improvements and efficiencies when moving to digital processing.

COR – Contracting Officer’s Representative

CPARS – Contractor Performance Assessment Reporting System

Critical Contractor Personnel – Those contractor personnel identified by the Government as

COOP deployers.

Data Spillage Incidents (DSI) – Defined in this document as a ―Classified Message Incident‖ that occurs when someone transmits classified information over e-mail server(s) or any other information system that has a lower security classification than the classification of the information (i.e. a secret document gets uploaded into a NIPR system). As a result, recovery from a DSI incident can be time consuming, expensive, and will result in the loss of productivity because e-mail server(s) or any other information system will be shutdown until recovery actions are completed.

External IT Organization – those Information Technology support organizations outside of the Washington Headquarters Services Information Technology Management Directorate.

Logical – is a graphical representation of the business requirements. They describe the things of importance to an organization and how they relate to one another, as well as business definitions and examples.

FISMA – Federal Information Security Management Act (of 2002)

NACLC – National Agency Check with Local Agency and Credit Check

QASP – Quality Assurance Surveillance Plan

Requirements Engineering – The actions required of capturing, structuring, and accurately representing the user's requirements so that they can be correctly embodied in systems which meet those requirements (i.e. are of good quality).

Software Testing – is an empirical investigation conducted to provide stakeholders with information about the quality of the product or service under test, with respect to the context in which it is intended to operate. This includes, but is not limited to, Unit testing, Regression Testing, and Performance testing, Security testing the process of executing a program or application with the intent of finding software bugs. It can also be stated as the process of validating and verifying that a software program/application/product meets the business and technical requirements that guided its design and development, so that it works as expected and can be implemented with the same characteristics.

SSBI – Single Scope Background Investigation

STIG – Security Technical Implementation Guidelines

Technical Services – Actions that include, but not limited to programming, system designing, system analysis, workflow and dataflow analysis, database analysis, and data migration.

1.8 Applicable Documents. The contractor shall ensure continuing adherence to generally accepted

Government information technology policies and guidance applicable to the task order. This includes, but is not limited to, public laws, executive orders, directives, regulations, manuals, standards, memorandums, and instructions. The contractor shall comply with the appropriate DoD-approved architectures, programs, standards and guidelines, such as the Global Information Grid (GIG), Defense

Information Infrastructure (DII) Strategic Technical Guidance (STG), DII Common Operating

Environment (COE), Defense Information Systems Network (DISN) and Shared Data Environment

(SHADE). The following listed references include documents released by federal, DoD, and governance agencies:

1.8.1 Federal Regulations. Office of Management and Budget Circular A-130, "Management of

Federal Resources," November 30, 2000

1.8.2 Laws, Statutes, Codes and Rules

Public Law 100-235, "Computer Security Act of 1987," January 8, 1988

Public Law 106-344, 10 USCS § 2224, "Defense Information Assurance Program,"

October 20, 2000 United States Code, 29 U.S.C.794d, " Rehabilitation Act" of 1998

(http://www.section508.gov/index.cfm?FuseAction=Content&ID=13)

United Stated Code, 5 U.S.C. § 552a, As Amended "The Federal Privacy Act,‖ of 1974

(http://www.usdoj.gov/oip/privstat.htm)

Department of Health and Human Services, 42 CFR Part 3, (HIPAA) Privacy Rule, "The Health

Insurance Portability and Accountability Act of 1996" (http://www.hhs.gov/ocr/privacy/index.html)

Department of Health and Human Services, 42 CFR Part 3, (Patient Safety Act) "The Patient Safety and Quality Improvement Act of 2005," November 21, 2008

1.8.3 DoD Policies, Procedures, Directives, Instructions and Manuals

Deputy Secretary of Defense Memorandum, "Department of Defense (DoD)

Information Assurance Vulnerability Alert (IAVA)," December 30, 1999.

DoD IA policies, procedures, directives, instructions, and manuals are listed at http://iase.disa.mil/policy-guidance/index.html#cnd

1.8.4 DoD-Approved Architectures

Deputy Secretary of Defense Memorandum, "Department of Defense Chief Information Officer

Guidance and Policy Memorandum No. 6-8510 'Department of Defense Global Information Grid

Information Assurance'," June 16, 2000

1.8.5 DoD Information Assurance Governance and Guidance

DoD CIO - various policy

DISA Security Technical Guidelines- http://www.iase.disa.mil

JTF GNO-https://www.jtfgno.mil

Vulnerability Management System- https://www.vms.disa.mil

1.8.6 Deliverables

PWS

Paragraph#

Title Due Date Frequency

& Remarks

Format

1.4.1.14 - Section 508 Compliance Report

- IA Documentation for Certification and Accreditation

- Defense Continuity Information

Network (DCIN) Request Form

- Privacy Impact Assessment

- Design and Architecture Document

- Change Management Document

- Operations Manual

13 weeks after project initiation once MS Word

1.4.2.3 - System Test Cases & Scripts

- System Test Results

- User Acceptance Test Cases

- User Acceptance Test Report

13 weeks after project initiation;

12 weeks after production project start twice MS Word

1.4.3.3 - Production Implementation Plan

- System Deployment Instructions

- Authorization to Operate

6 weeks after production project initiation once MS Word

PWS

Paragraph#

Title Due Date Frequency

& Remarks

Format

1.4.9.10 - Training Manuals and Quick Guides

- Systems user manuals

- Equipment and hardware and systems troubleshooting guides

13 weeks after project initiation once MS Word