DRAFT PWS_MSD IDIQ 16 August.pdf

PERFORMANCE WORK STATEMENT (PWS) 1

Modern Software Development 3 25 June 2024 4

PART 1 BACKGROUND 6

1. General: The Multiple Award Indefinite Delivery, Indefinite Quantity (MA IDIQ) for Modern 9 Software Development is designed to provide a vehicle to award task orders in a streamlined 10 manner in support of United States Army Modern Software Enablement Requirements. 11

1.1 Description of Services/Introduction: This is MA IDIQ is for modern software 13 development services to the Army and its operating agencies to enable the creation of 14 software that will aid in completion their objectives and supported activities. This contract will 15 provide support Software Enablement activities that encompasses the 16

1.2 Background: 18

This MA IDIQ contract will be utilized for the issuance of Task Orders for Modern Software 19 Development, achieved via Software Enablement Efforts that incorporate agile methods, 20 software metrics, modernizing testing, DevSecOps, CI/CD, use of digital engineering practices 21 and achieving Data Centricity through adherence to data mesh principles. 22

1.3 Scope: The Modern Software Development Contract is designed to provide the U.S. 25 Army with software solutions that comply with the guidelines established in Army Directive AD 26 2024-02 for Enabling Modern Software Development and Acquisition Practices. The directive 27 highlights the importance for software contracts and programs to use modern principles 28 including employing agile methods, software metrics, modernizing testing, DevSecOps, CI/CD, 29 use of digital engineering practices and achieving Data Centricity through adherence to data 30 mesh principles. 31

1.4 Objectives: The objective of this MA IDIQ is to: 33

1.4.1 Enable rapid access to pool of vendors that embody of the values and principles 35 described in the Agile Manifesto https://agilemanifesto.org. 36

1.4.2 Establish rates that enable the Army to attract top contractual tal.ent 38

1.4.3 Incentivize quality performance 40

1.4.4 Address emerging and new software, data, digital engineering, AI, and cyber best 42 practices in both the Federal and Private Industries. 43

1.5 General Information: 45

https://agilemanifesto.org/

1.5.1 Quality Assurance: The Government will evaluate the Contractor’s performance under 47 this contract IAW the Quality Assurance Surveillance Plan (QASP) established in the individual 48 task orders. This plan is primarily focused on what the Government must do to ensure that the 49 Contractor has performed IAW the performance standards. It defines how the performance 50 standards will be applied, the frequency of surveillance, and the acceptable quality levels 51 (performance thresholds). 52

1.5.2 Recognized Holidays: The following provides information on recognized holidays for the 54 purpose of this PWS. If submittal of any documentation (e.g. deliverables, submittals, etc.) 55 deadlines fall on a holiday, the closest work day prior to the holiday will apply as the deadline 56 for submittal. 57

1.5.3 Place of Performance: The place of performance will be defined at the Task Order level. 59 The Government contemplates that the primary place of performance across all Task Orders 60 will be the Contractor’s facility. Mission requirements of certain Task Orders may require 61 performance at the Government’s facility. Remote work may be authorized to the extent that 62 mission requirements and Contractor policies permit. 63

1.5.4 Hours of Operations: The hours of operation will be defined at the Task Order level when 65 necessary. 66

1.6 Security Requirements: The following information is provided on security related 68 matters as they concern this task order. These requirements reflect the maximum 69 requirements for the task order and further requirements regarding security will be defined 70 within individual Task Orders 71

1.6.1 Security Program: If the TO states work in a classified environment, then Contractor 73 personnel performing work under this task order must have a SECRET at time of the proposal 74 submission and must maintain the level of security required for the life of the contract. The 75 security requirements are IAW with the DoD Contract Security Classification Specification (DD 76 Form 254), which is currently accessible at the following link: 77 http://www.dtic.mil/whs/directives/forms/eforms/dd0254.pdf 78

1.6.2 Personnel Security Clearance Requirements: If the TO states work in a classified 80 environment, then Contractor personnel performing work under this contract must have an 81 active personnel security clearance at the SECRET level in the Defense Information System 82 for Security (DISS) at time of the proposal submission and must maintain the level of security 83 required for the life of the contract. The security requirements are IAW the DoD Contract 84 Security Classification Specification DD Form 254. The Contractor shall ensure that Contractor 85 employees and subcontractor employees performing services under this contract comply with 86 FAR 52.204-2 Security Requirements when the employee has access to information classified 87 “Confidential,” “Secret,” or “Top Secret.” The Contractor shall ensure the employee complies 88 with the DoD Security Agreement (DD Form 441), and the NISPOM rule at 32 Code of Federal 89 Regulation (CFR) Part 117, effective 24 Feb 2021. The NISPOM is the National Industrial 90 Security Program Operating Manual to which contractors must implement and comply. 91 http://www.dtic.mil/whs/directives/forms/eforms/dd0254.pdf

1.6.3 Installation Access: If the TO states work requires government installation access to 93 U.S. installations, buildings and controlled areas is limited to personnel who meet security 94 criteria and are authorized. Failure to submit required information/data and obtain required 95 documentation or clearances will be grounds for denying access to U.S. installations, buildings 96 and controlled areas. The Contractor shall ensure that any subcontractors used in 97 performance of this contract complies with these requirements and that all employees, of both 98 the Contractor and any subcontractor utilized by the Contractor, are made aware of and 99 comply with these requirements. The Contractor shall be aware of and comply with the 100 requirements associated with Installation Access Control. The Government is not liable for any 101 costs associated with performance delays due solely to a firm’s failure to comply with 102 Installation Access Control System (IACS) processing requirements. The Contractor shall 103 return installation passes to the issuing IACS office when the contract is completed or when a 104 Contractor employee no longer requires access. 105

1.6.3.1 Individual Termination or Expiration of Employment: The Contractor shall collect the 107 installation access passes and Government credentials and, if applicable, Government 108 Furnished Property (GFP) the same day employment of an individual has expired or has been 109 terminated and shall return them to the issuing office within one (1) day. 110

1.6.3.2 Contract Termination or Cancellation: Upon termination or cancellation of this task 112 order, the Contractor shall collect all outstanding installation access passes and return them to 113 the issuing office within ten (10) days. 114

1.6.3.3 Common Access Cards (CAC) and CAC Log: The Contractor shall provide the 116 following information: Last, First and Middle Names, Social Security Number, date of birth, 117 primary email address (this email address will be used to contact the individual) and any other 118 necessary information required to obtain a CAC or installation access card, to the COR via 119 email within five (5) days after award. The contractor will not be issued a CAC if their time on 120 this effort is less than 50%. If the contractor possesses a non-Army CAC from another 121 contract effort, the contractor must surrender that CAC before an Army CAC will be issued for 122 this contract effort. The Contractor shall ensure safeguarding of Personally Identifiable 123 Information (PII) and comply with requirements under 1.22.5. 124

1.6.4 Background Checks: Applicable to Continental United States (CONUS) and Outside 126 Continental United States (OCONUS) (includes Alaska and Hawaii) requirements, the RA shall 127 consult with the responsible Security Office and Activity Manager applicable to location(s) 128 associated with this PWS and identify the level of background check, supported by the 129 applicable regulation(s). 130

1.6.4.1 U.S. Citizen: The Requiring Activity (RA) Manager will determine the extent of 132 background checks required. The Contractor employee may begin performance of the contract 133 after receiving a favorable local background check. The Contractor agrees to replace the 134 employee should results of the background check, if required, be unfavorable as determined 135 by the RA Manager. The Contractor’s replacement of the employee with the unfavorable 136 background check shall be within a timeframe provided by the RA Manager. The Contractor 137 shall also replace employees whose background check, during their tenure of employment, 138 renders them with an unfavorable local or stateside background check, as determined by the 139 RA Manager. The Contractor shall forward a copy to the KO via the COR and the RA Manager 140 of each favorable background check within five (5) days of receipt by the Contractor, 141 identifying such with the appropriate contract number. The Contractor shall forward a copy to 142 the KO via the COR and the RA Manager of each unfavorable background check within two (2) 143 days of receipt by the Contractor, identifying such with the appropriate contract number. When 144 the Government awards a non-personal services contract directly to an individual, the failure of 145 the individual to provide a favorable background check would be grounds for termination. 146

1.6.5 Physical Security: The Contractor shall safeguard all Government equipment, 148 information, and property provided for Contractor use. If performing work in a Government 149 facility, at the close of each work period, Government facilities, equipment, and materials shall 150 be secured IAW the Army Physical Security Program (AR 190-13.”) 151

1.6.6 Operations Security (OPSEC) Requirements: Contractor personnel shall adhere to 153 facility security policies and restrictions. The Contractor shall immediately report suspicious 154 activities to security personnel. 155

1.7 Key Control: Contractor shall establish and implement methods of making sure all keys 157 and/or CAC Cards issued to the Contractor by the Government are not lost or misplaced and 158 are not used by unauthorized persons. NOTE: All references to keys include CAC and key 159 cards. No keys issued to the Contractor by the Government shall be duplicated. The 160 Contractor shall develop procedures covering key control that shall be included in the 161 Contractor’s Security Plan with DI-ADMIN-81373 and the QCP. Such procedures shall include 162 turn-in of any issued keys by personnel who no longer require access to locked areas. The 163 Contractor shall immediately report any incidents of lost or duplicate keys to the KO. The 164 Contractor shall prohibit the use of Government issued keys and/or CAC cards by any persons 165 other than the Contractor’s employees. The Contractor shall prohibit the opening of locked 166 areas by Contractor employees to permit entrance of persons other than Contractor 167 employees engaged in the performance of assigned work in those areas, or personnel 168 authorized entrance by the KO. The Contractor shall establish and implement methods of 169 ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor 170 shall ensure that lock combinations are changed when personnel having access to the 171 combinations no longer have a need to know such combinations. These procedures shall be 172 included in the QCP. (DI-ADMIN-81373) 173

1.8 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend any 175 post award conference convened by the contracting activity or contract administration office 176 IAW FAR Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may 177 meet periodically with the Contractor to review the Contractor's performance. At these 178 meetings the KO will apprise the Contractor of how the Government views the Contractor's 179 performance and the Contractor shall apprise the Government of problems, if any, being 180 experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings 181 shall be at no additional cost to the Government. (DI-ADMN-81505) 182

1.8.1 The Contractor shall attend, participate in, and furnish input to scheduled and 184 unscheduled meetings, conferences, and briefings that relate to the functions and services 185 herein as required by the Government to provide effective communication and impart 186 necessary information. The Contract Manager or designated representative shall attend 187 meetings as requested by the Government. Meeting attendees shall at times include 188 Contractor managerial, supervisory, and other personnel knowledgeable of the subject matter. 189 Meetings may start or end outside of regular duty hours. 190

1.9 Contracting Officer’s Representative (COR): Refer to Part 2 of this PWS for the 192 definition of a COR. As determined by the KO, a COR will be appointed at the Task Order 193 Level and identified by letter of designation, a copy of which will be provided to the Contractor 194 by the KO. The designation letter states the responsibilities and limitations of the COR, 195 especially with regard to changes in cost or price, estimates, or changes in delivery dates. The 196 COR is not authorized to change any of the terms and conditions of the resulting order. The 197 COR monitors all technical aspects of the contract and assists in contract administration. The 198 COR is not authorized to obligate the Government. If the work is not written in the contract, the 199 COR is not authorized to request new work. The COR is authorized to perform the following 200 functions: assure that the Contractor performs the technical requirements of the contract, 201 perform inspections necessary in connection with contract performance, maintain written and 202 oral communications with the Contractor concerning technical aspects of the contract, issue 203 written interpretations of technical requirements, including Government drawings, designs, 204 specifications, monitor Contractor's performance and notifies both the KO and Contractor of 205 any deficiencies, coordinate availability of Government property, and coordinate site entry of 206 Contractor personnel. 207

1.10 Identification of Contractor Employees: All Contractor personnel attending meetings, 209 answering Government telephones, and working in other situations where their contractor 210 status is not obvious to third parties must identify themselves, to include proper marking of 211 signature blocks in correspondence, to avoid creating an impression in the minds of members 212 of the public that they are Government officials. The Contractor shall ensure that all documents 213 or reports, produced by Contractors are suitably marked as Contractor products or that 214 Contractor participation is appropriately disclosed. 215

1.11 Contractor Travel: The Contractor may be required to travel to an alternate place of 217 business, CONUS or OCONUS as stated at paragraph 1.5.6 of this PWS to attend meetings, 218 conferences, or support mission requirements. The Contractor may be authorized travel 219 expenses at rates no higher than the substantive provisions of the Joint Travel Regulation 220 (JTR), IAW FAR Part 31.205-46, and the limitation of funds specified in this contract. All travel 221 requires Government approval and authorization within ten (10) days prior to scheduled travel. 222

(DI-ADMN-81308A) 223

1.12 Other Direct Costs (ODCs): Approved Purchasing System means a Contractors 225 purchasing system that has been reviewed and approved IAW FAR Part 44. If a Contractor 226 verifies that they have an Approved Purchasing System, they will be authorized to purchase up 227 to $10,000 without prior KO consent. Any purchases exceeding $10,000 will require Contractor 228 submittal of competitive purchase results to the KO prior to purchase. If a Contractor does not 229 have an approved purchasing system, all Material/Other Direct Costs (ODC) purchases of 230 $4,000 and above shall be evaluated by the COR and KO for fairness and reasonableness and 231 approved prior to purchase. 232 In order for charges to be invoiced, deliverable services must have been performed in direct 234 support of a requirement. There may be occasions when contractor personnel are invited to 235 participate in Government morale and recreational activities, such as holiday parties, golf 236 outings, sports days, and other various events. The Government does not have an 237 employer/employee relationship with contractor employees and therefore is not authorized to 238 grant administrative leave or expend Government resources to compensate contractor 239 employees for hours expended on activities not within scope of the task order. Under these 240 circumstances, contractor employees must comply with individual company policy that is IAW 241 that company’s compensation system. Submission of an invoice for payment of non-billable 242 charges is not authorized and constitutes a false claim, which may lead to criminal sanctions, 243 fines, suspension, and debarment. 244

1.13 Data Rights: The Government has unlimited rights to all documents and materials 246 produced under this contract. All documents and materials, to include the source codes of 247 software, produced under this contract shall be Government owned and are the property of the 248 Government with all rights and privileges of ownership and copyright belonging exclusively to 249 the Government. These documents and materials may not be used or sold by the Contractor 250 without written permission from the KO. All materials supplied to the Government shall be the 251 sole property of the Government and may not be used for any other purpose. This right does 252 not abrogate any other Government rights. 253

1.14 Non-Disclosure Requirements: Performance under this Contract may require the 255 Contractor to access data and information proprietary to a government agency, another 256 Government Contractor, or of such nature that its dissemination or use other than as specified 257 in this work statement would be averse to the interests of the Government or others. The 258 Contractor and Contractor personnel shall not divulge, or release data or information 259 developed, or obtained under performance of this PWS, except to authorized Government 260 personnel or upon written approval of the KO. The Contractor shall not use, disclose, or 261 reproduce proprietary data, which bears a restrictive legend, other than as specified in this 262 PWS. All documentation showing individual names or other personal information shall be 263 controlled and protected under the provisions of the Privacy Act of 1974, Public Law 93-579, 5 264 United States Code (U.S.C.) Section 552a. (TACOM Clause 52.215-4405) 265

1.15 Protection of Government and Contract Information: Per Public Use Notice of 267 Limitations stated by Defense imagery Management operations Center and contained at 268 www.dimoc.mil/resources/limitations/, the Contractor shall not cite any information (e.g., 269 contract information, pictures, locations, etc.) obtained through this contract on any hard copy 270 or digital marketing tools to include its company website. 271

1.16 Non-Disclosure Statements: The Contractor shall provide signed non-disclosure 273 agreements to the Government no later than seven (7) days prior to commencement of work 274 http://www.dimoc.mil/resources/limitations/ under a Task Order issued under the contract. Disclosure of information by Contractor 275 personnel may result in removal of Contractor personnel from performance under this contract. 276

1.17 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel 278 performing work under this contract may receive, have access to or participate in the 279 development of proprietary or source selection information (e.g., cost or pricing information, 280 budget information or analyses, specifications or work statements, etc.) or perform evaluation 281 services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The 282 Contractor shall notify the KO immediately whenever it becomes aware that such access or 283 participation may result in any actual or potential OCI and shall promptly submit a plan to the 284 KO to avoid or mitigate any such OCI. The Contractor’s OCI Mitigation Plan will be determined 285 to be acceptable solely at the discretion of the KO. In the event the KO unilaterally determines 286 that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other 287 remedies as he or she deems necessary, including prohibiting the Contractor from participation 288 in subsequent contracted requirements which may be affected by the OCI. 289

1.18 Required Training: The following provides information on training requirements. 291 All Contractor employees, including subcontractors, shall complete Level I OPSEC 1.23.1 293 OPSEC Training: training within one (1) day of employment under this contract. Verification of 294 the training shall be provided to the COR within one (1) day after completion of the training. 295 OPSEC Level I training is available at 296 https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=EUC&course_number=-ECJ6-110-N. 297

1.18.1 Information Security Program (INFOSEC) Training: If applicable, Contractor 299 employees, including subcontractors, shall complete INFOSEC training within one (1) day of 300 employment under this contract. Verification of the training shall be provided to the COR within 301 one (1) day after completion of the training. INFOSEC training is available at 302 https://securityawareness.usalearning.gov/. 303

1.18.2 Information Assurance (IA) Training 305

1.18.2.1 All Contractor employees, including subcontractors, requiring access to Government 307 information systems shall complete the DoD IA Cyber Awareness Training prior to issuance of 308 CAC. Verification of the training shall be provided as part of the request for CAC package. 309

1.18.2.2 All Contractor employees, including subcontractors, working information technology 311 (IT)/IA functions shall comply with DoD and Army training requirements per Information 312 Assurance Training Certification and Workforce Management DoD Directive (DoDD) 8570.01, 313 Information Assurance Workforce Improvement Program DoD 8570.01-M, and Information 314 Assurance AR 25-2 within one (1) day of employment. Training is available at 315 https://public.cyber.mil/training/cyber-awareness-challenge/ . 316

1.18.2.3 All Contractor employees, including subcontractors, performing services under this 318 contract with access to a Government information system must be registered in the Army 319 Training Certification Tracking System (ATCTS). Contractor personnel must complete 320 https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=EUC&course_number=-ECJ6-110-N https://securityawareness.usalearning.gov/ https://public.cyber.mil/training/cyber-awareness-challenge/ refresher training every twelve (12) months. Verification of the training shall be provided to the 321 COR within fifteen (15) days prior to expiration of current training. 322

1.19 Government Furnished Property (GFP) and Services: If requires GFP, then refer to 324 Part 3 of this PWS for GFP for this task order. For all issued GFP for this task order, the 325 Contractor shall submit a Property Management Plan to the KO and the Property Administrator 326 via the COR within ten (10) days after date of contract award (DI-MISC-80508B) 327

PART 2 DEFINITIONS & ACRONYMS 329

2. Definitions and Acronyms 331

2.1 Definitions: Although not inclusive of every term used within this PWS, the following 333 provides a list of definitions used throughout this PWS and commonly used in the acquisition 334 field. 335 Contracting Officer (KO) – means a person with the authority to enter into, administer, and/or 337 terminate contracts and make related determinations and findings on behalf of the 338 Government. Note: The only individual who can legally bind the Government. 339 Contracting Officer's Representative (COR) – As defined in DFARS 202.101, means an 341 individual designated and authorized in writing by the KO to perform specific technical or 342 administrative functions. DoD Instruction (DoDI) 5000.72, Part II Definitions states the following 343 when defining a COR: “Defined in subpart 202.101 of Reference (f). Any individual delegated 344 responsibilities pursuant to subpart 1.602-2 of Reference (e), regardless of local terminology, 345 must be certified IAW this instruction. For example, local terminology can be COR, KO’s 346 technical representative, technical point of contact (POC), technical representative, alternate 347 COR, administrative COR, assistant COR, line item manager, task order manager, quality 348 assurance personnel, quality assurance evaluator, or COR management.” In addition, Army 349 Regulation 70-13, Chapter 2, paragraph 2-2g, states, in part, the following when providing 350 other surveillance support personnel to assist the COR when needed, “…These other 351 surveillance support personnel may serve as on-site representatives of the COR in 352 performance of actual contract surveillance if they meet all COR requirements and have been 353 appointed by the KO as alternate CORs.” 354 Contractor – means a supplier or vendor awarded a contract to provide specific supplies or 356 service to the Government. The term used in this contract refers to the prime. 357 Contractor-acquired Property - means property acquired, fabricated, or otherwise provided by 359 the Contractor for performing a contract and to which the Government has title. 360 Day – means business day 362 Defective Service – means a service output that does not meet the standard of performance 364 associated with the PWS. 365 Deliverable – means anything that can be physically delivered, but may include non-367 manufactured things such as meeting minutes or reports. 368 Government-furnished Property (GFP) – As reflected in FAR 52.245-1, GFP 370 “means property in the possession of, or directly acquired by, the Government and 371 subsequently furnished to the Contractor for performance of a contract. Government-furnished 372 property includes, but is not limited to, spares and property furnished for repair, maintenance, 373 overhaul, or modification. Government-furnished property also includes contractor-acquired 374 property if the contractor-acquired property is a deliverable under a cost contract when 375 accepted by the Government for continued use under the contract. 376 Government Property - means all property owned or leased by the Government. Government 378 property includes both Government-furnished and Contractor-acquired property. Government 379 property includes material, equipment, special tooling, special test equipment, and real 380 property. Government property does not include intellectual property and software. 381 Property Administrator - means an authorized representative of the KO appointed IAW agency 383 procedures, responsible for administering the contract requirements and obligations relating to 384 Government property in the possession of a Contractor. 385 High Level Objective (HLO) – means a key overarching result-based objective for a project 387 necessary to achieve the project’s vision. HLOs are similar to Level 2 in a Work Breakdown 388 Structure. Each HLO may contain several statements to flesh out the areas necessary to meet 389 the objective. 390 Physical Security – means that part of security concerned with physical measures designed to 392 safeguard personnel; to prevent unauthorized access to equipment, installations, material, and 393 documents; and to safeguard against espionage, sabotage, damage, and theft. 394 Quality Assurance – (or Government contract quality assurance) means the various functions, 396 including, inspection, performed by the Government to determine whether a Contractor has 397 fulfilled the contract obligations pertaining to quality and quantity. 398 Quality Assurance Surveillance Plan (QASP) – means the key Government-developed 400 surveillance process document, and is applied to Performance-Based Service Contracting 401 (PBSC). The QASP is used for managing Contractor performance assessment by ensuring 402 that systematic quality assurance methods validate that Contractor quality control efforts are 403 timely, effective, and are delivering the results specified in the contract or task order. The 404 QASP directly corresponds to the performance objectives and standards (i.e., quality, quantity, 405 timeliness) specified in the PWS. It provides specific details on how the Government will 406 survey, observe, test, sample, evaluate, and document Contractor performance results to 407 determine if the Contractor has met the required standards for each objective in the PWS. The 408 QASP, with very few if any exceptions, is an internal to Government document. 409 Quality Control – means all necessary measures taken by the Contractor to assure that the 411 quality of an end product or service shall meet contract requirements. 412 Statement – means the specific results-based activities required to satisfy HLOs. A statement 414 contains a result, the context of the statement, and the required action(s). Statements focus on 415 “what” is to be accomplished; however they are not prescriptive in describing “how” the 416 outcome is to be achieved. Each HLO may have several statements to flesh out the areas 417 necessary to meet the objective. Statements are similar to Level 3 in a Work Breakdown 418 Structure. 419

Subcontractor – means one that enters into a contract with a prime Contractor. The 420 Government does not have privity of contract with the subcontractor. 421 Work Day - The number of hours per day the Contractor provides services IAW the contract. 423 Work Week - Monday through Friday, unless otherwise specified. 425

2.2 Acronyms: Although not inclusive of every term used within this PWS, or that may be 427 included in an acquisition, the following provides a list of acronyms commonly used in the 428 acquisition field. 429 ACOR Alternate Contracting Officer's Representative 431 AFARS Army Federal Acquisition Regulation Supplement 432 AOR Area of Responsibility 433 AR Army Regulation 434 AT Anti-terrorism 435 ATCTS Army Training Certification Tracking System 436 CAC Common Access Card 437 CCE Contracting Center of Excellence 438 CFR Code of Federal Regulations 439 CONUS Continental United States (excludes Alaska and Hawaii) 440 COR Contracting Officer’s Representative 441 DA Department of the Army 442 DD250 Department of Defense Form 250 (Receiving Report) 443 DD254 Department of Defense Contract Security Requirement List 444 DFARS Defense Federal Acquisition Regulation Supplement 445 DMDC Defense Manpower Data Center 446 DoD Department of Defense 447 FAR Federal Acquisition Regulation 448 GFP Government Furnished Property 449 HLO High Level Objective 450 HIPAA Health Insurance Portability and Accountability Act of 1996 451 IA Information Awareness 452 IAC Installation Access Control 453 IACO Installation Access Control Office 454 ID Identification 455 IGCE Independent Government Cost Estimate 456 IT Information Technology 457 JTR Joint Travel Regulation 458 JPAS Joint Personnel Adjudication System 459 KO Contracting Officer 460 OCI Organizational Conflict of Interest 461 OCONUS Outside Continental United States (includes Alaska and Hawaii) 462 ODC Other Direct Costs 463 OPSEC Operations Security 464 PA Property Administrator 465

PII Personally Identifiable Information 466 PIPO Phase In/Phase Out 467 POC Point of Contact 468 PRS Performance Requirements Summary 469 PWS Performance Work Statement 470 QA Quality Assurance 471 QAP Quality Assurance Program 472 QASP Quality Assurance Surveillance Plan 473 QC Quality Control 474 QCP Quality Control Program 475 RA Requiring Activity 476 RCO Regional Contracting Office 477 SIGE Safety and Health Protection Plan 478 TE Technical Exhibit 479 USAG United States Army Garrison 480 UOM Unit of Measure 481

PART 3 GOVERNMENT PROPERTY (GP) AND SERVICES 483

3. Government Property and Services 485

3.1 Services: The Government will provide the contractor with the following items required to 487 perform the work described in this PWS: 488

3.2 Facilities: The Government will provide the contractor access to the necessary 490 workspace for the contract staff to provide the support outlined in this PWS. These facilities 491 include desk space, telephones, computers, and other items that constitute an office 492 environment. The COR will maintain serial number accountability for all equipment issued to 493 contract personnel. The Contractor shall use reasonable care to avoid damaging existing 494 buildings, equipment, and vegetation on the Government installation. If the Contractor’s failure 495 to use reasonable care causes damage to any of this property, the Contractor shall replace or 496 repair the damage at no expense to the Government as the KO directs. If the Contractor fails 497 or refuses to make such repair or replacement, the Contractor shall be liable for the cost, 498 which may be deducted from the contract price. 499

3.3 Utilities: The Government will provide utilities within Government facilities for the 501 contractors use in performance of duties outlines in this PWS. The Contractor shall instruct 502 employees in utilities conservation practices. The Contractor shall operate under conditions 503 that preclude the waste of utilities, which include turning off the water faucets or valves, light 504 switches, etc. after using the required amount to accomplish tasks requiring the use of the 505 utilities. 506

3.4 Equipment: The Government will provide the contractor with access to, and use of office 508 equipment needed to perform the services described in this PWS. Examples of equipment 509 include scanners, fax machines, printers, lights, chairs, desks, computers, and office supplies 510 needed to perform assigned work. When the Government determines a personal digital 511 assistant (e.g., BlackBerry) is required to perform the requirements of the contract, one will be 512 provided by the Government. The contractor shall safeguard any such issued equipment and 513 be responsible for replacement should the equipment be lost or damaged due to negligence on 514 the part of contractor personnel. The contractor shall follow standard GFP guidelines provided 515 in FAR 52.245-1 and clause 252.245-7002 516

3.5 Materials: The Government will provide the contractor with the following materials and 518 information: Organizational Standard Operating Procedures (SOPs), administrative policies 519 and procedures (including document templates), and security policies and procedures. 520 The contractor shall return to the Government all GFP, furnished to the contractor for 521 performance of this task order at the end of the task order period of performance IAW FAR 522 52.245-1. 523 The contractor shall not assume that additional GFE/M/I, not included in this PWS, will be 525 provided by the Government. 526

3.6 Common Access Cards (CAC): The Government will assist the vendor with obtaining 528 provide CACs via the Trusted Associate Sponsorship System (TASS) (Web site 529 https://www.dmdc.osd.mil/tass/ ). 530 https://www.dmdc.osd.mil/tass/

PART 4 CONTRACTOR FURNISHED ITEMS AND SERVICES 531

4. Contractor Furnished Property and Services 533

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services 535 required to perform work under this task order that are not listed under Part 3 of this PWS. 536

4.2 Secret Facility Clearance: The Contractor shall possess and maintain a Secret facility 538 clearance from the Defense Counterintelligence and Security Agency IAW DoD 5220.22-M, 539 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49, Industrial 540 Security Program. The Contractor’s employees, performing work in support of this contract 541 shall have been granted a Secret from the Defense Industrial Security Clearance Office. The 542 Facility Security Clearance must match the highest security clearance required for personnel. 543 The DoD Contract Security Classification Specification (DD 254) is provided as an attachment 544 in the basic contract. 545

PART 5 SPECIFIC TASKS 547

5.1 Scope of Work Objective 548

The Modern Software Development Contract is designed to provide the U.S. Army with 549 software solutions that comply with the guidelines established in Army Directive AD 2024-02 550 for Enabling Modern Software Development and Acquisition Practices. The directive highlights 551 the importance for software contracts and programs to use modern principles including 552 employing agile methods, software metrics, modernizing testing, DevSecOps, CI/CD, use of 553 digital engineering practices and achieving Data Centricity through adherence to data mesh 554 principles. 555

5.2 Agile 556

Adherence to the Agile manifesto and agile principles have proven to create the best software 557 products and architectures. The key importance is whatever agile framework employed 558 integrates well with the government’s agile implementation. While the exact methods and 559 cycles will continue to evolve over time as we have seen with the emergence of DevOps taking 560 iterations from weeks to days, the ability for vendors and the government to be agile remains a 561 constant key for successful contracts. Agile frameworks including but not limited to: 562

• Scaled Agile Framework 563

• Scrum 564

• Kanban 565

• Extreme Programming 566

• Large Scale Scrum 567

Efforts on this contract will require collaboration between the government and contractor to 568 regularly refine the backlog and reach agreement on the definition of done for each of the work 569 elements. 570

5.3 Software Metrics 571

Software Metrics are the measurements of software characteristics to provide insights into the 572 development effort to guide technical and programmatic decision-making, continuous 573 improvement efforts, and remediation of blockers. Software teams will regularly review metrics 574 as part of their retrospectives and leverage metrics both for continuous improvement and 575 measure performance. The MSD IDIQ will leverage the metrics in the required section of the 576 ASA(ALT) Software Metrics and additional MSD specific metrics that include but are not limited 577 to: 578

• Test Automation Percentage 579

• NPS 580

• Lead Time for Changes 581

• Progress Against Roadmap 582

Individual Task orders will also include TO specific metrics. Metrics for individual task orders 583 will be submitted and aggregated to create metrics dashboards detailing the overarching 584 performance of the contractor across their portfolio of efforts on MSD, 585

5.4 Testing 586

Software testing is a crucial stage of the software lifecycle. It is imperative to integrate testing 587 design early in the life cycle and for testing to occur throughout the duration of a project 588 instead of waiting till the end. Automation of tests is the most effective way software solutions 589 can perform adequate amounts testing required to gain confidence in the solution at an 590 acceptable cost and timeline. Proper testing ensures the delivery of secure, quality software 591 that meets needs of target audience. There are many different types of testing that occur at 592 differing stages of the deployment cycle that include but are not limited to: 593

• Automated Testing 594

• Unit Testing 595

• DOT&E 596

• Operational Testing 597

• Interoperability Testing 598

• Joint Testing 599

• Functional Testing 600

• Load Testing 601

• Chaos Testing 602

5.5 CI/CD 603

For the scope of this contract the acronym CI/CD is broken into two differing software 604 engineering patterns: Continuous Integration / Continuous Delivery, and Continuous 605 Integration Continuous / Continuous Deployment. Continuous Delivery is the act of integration 606 testing and delivery of code via artifacts to the end user where the use then elects when to 607 install or employ the solution. Continuous Deployment takes this a step further and refers to 608 the integration testing, delivery and deployment of the code into a production environment. 609 These CI/CD patterns accomplished through the linking together of tool chains to automate 610 integration, testing delivery, and when operating in a Continuous Delivery pattern, deployment 611 of solution solutions. Task orders on this contract will utilize either of these patterns depending 612 on the scope of work. 613

5.6 DevSecOps 614

DevSecOps is a framework, and organizational culture that integrates developers, security, 615 and operations, including business operations, staff together, instead of in separate siloes. 616 Collaboration by these groups allow for the identification and clearing of barriers that 617 unnecessarily delay release of software, and increased security of software releases. 618 Characteristics of organizations that operate include an increase focus on automation and 619 standardization of tasks. Software releases in a DevSecOps organization tend to be smaller, 620 more frequent, and higher quality segments of functionality where work on a features and user 621 stories is not considered complete until it is releasable to the end user. Use of the automations, 622 and increased focus on security are necessary to obtain Continuous Authority to Operate 623 (cATO) which is a key enabler to delivery capability at the speed and quality necessary for 624 future fights. 625

5.7 UI/UX 626

User Interface and User Experience (UI/UX) creates user-centered designs for digital products, 627 such as websites, mobile apps, and software interfaces. The primary focus is on enhancing 628 user satisfaction and usability by improving the accessibility, efficiency, and aesthetics of the 629 product. Intuitive and easy to use software is critical to the successful employment of new 630 technology especially for software that will be used by the warfighter in high stress combat 631 environment. 632

5.8 Data Centricity 633

The Army aims to introduce data mesh principles to flatten and simplify its data architecture, 634 streamline data product sharing across mission partners, and support data-driven decision 635 making at greater speed and scale. To achieve these data strategy goals, we have defined the 636 Unified Data Reference Architecture (UDRA) to provide implementation guidance for the 637 creation of data-centric software solutions for the Army. Data from software solutions 638 developed under the MSD contract shall implement the relevant concepts found in the UDRA 639 to achieve the Army’s data centricity objectives. 640

5.9 Performance Work Statement 641

This Indefinite Delivery, Indefinite Quantity (IDIQ) contract will be utilized for the issuance of 642 Task Orders for Modern Software Development, achieved via Software Enablement Efforts 643 that incorporate agile, DevSecOps, CI/CD, testing, UI/UX and data centric practices where 644 applicable. 645

By nature of the alignment to Modern Software Development Requirements, the IDIQ includes 646 any and all emerging Software Enablement Efforts as they arise as required to successfully 647 achieve the agency’s mission. Therefore, because technological advances over the term of 648 this IDIQ Contract are inevitable, the scope of this Contract takes into consideration that Task 649 Order Requirements are permitted to include any future emerging technologies with their 650 integral and necessary ancillary MSD components and services as they arise during the entire 651 term of this contract. The scope of the IDIQ Contract includes every conceivable aspect of 652 MSD including but not limited to: 653

5.9.1 Custom Software Development 655

Custom software development is creation of a software solution that addresses bespoke army 657 requirements utilizing writing of new code. Custom software development may also include use 658 and integration of open-source software. It is expected efforts in this task area will incorporate 659 the appropriate agile, CI/CD, DevSecOps, Data, and Digital Engineering practices where 660 appropriate. Custom software development activities encapsulate all aspects of the software 661 development lifecycle including but not limited to: 662

• Requirements Elaboration, Analysis, and Decomposition 663

• Design 664

• Implementation 665

• Test 666

• Delivery 667

• Deployment 668

5.9.2 Adapting a software solution 670

Activities in this task area encompass taking an existing solution, whether government or 672 commercial solutions, including software as a service, and adapting them to meet Army needs. 673 It is expected efforts in this task area will incorporate the appropriate agile, CI/CD, 674 DevSecOps, data, testing, and Digital Engineering practices to deliver modern so. Activities 675 involved in adapting software solutions include but are not limited to 676

• Integration 677

• Orchestration 678

• Configuration 679

• Modification of an existing solution 680

• Use of a No-code, low code environment 681

• Creation of an application that augments existing solution 682

Modification of software involves changing the source code of the solution to perform the 685 desired task. Creation of an application that augments an existing solution means execution of 686 code outside of an existing software solution that extends or tailors the functionality of the 687 existing software solution for new tasks and workflows. 688

5.9.3 Software Security 690

Software security are the practices designed to protect solution solutions from attackers. It is 692 expected efforts in this task area will incorporate the appropriate agile, CI/CD, DevSecOps, 693 testing, data, and Digital Engineering practices where appropriate. This encompasses many 694 activities throughout the software lifecycle including but not limited to: 695

• Application of the Risk Management Framework 696

• Obtaining an ATO or cATO 697

• Software Assurance activities 698

• Penetration Testing 699

• Software Composition Analysis 700

• Use of Intrusion detection and prevention systems 701

• Remediation of Software vulnerabilities 702

• Encryption 703

• Software Patching 704

• Cyber Incident response and management 705

5.9.4 Modernization and Automation of Software Hosting and Operations 707

Software hosting and operations includes activities for deploying, maintaining, and optimizing 708 software applications. Modernization and automation includes scripting, implementation of “-709 as-code” solutions, and the use of emergent technologies such as artificial intelligence to 710 realize efficiencies in tasks including but not limited to: 711

• Infrastructure Management 713

• Monitoring and Alerting 714

• Incident Management 715

• Deployment and Release Management 716

• Configuration Management 717

• Performance Tuning 718

• Backup and Recovery 719

• Capacity Planning 720

• Documentation and Reporting 721

• Compliance and Auditing 722

• Service Management 723

• Change Management 724

5.9.5 Digital Engineering 726

Digital engineering is using and integrating digital models and the underlying data to support 727 the development, test and evaluation, and maintenance of a system. It expands on 728 engineering practices to take full advantage of computation, visualization, and collaboration 729 to enable faster, smarter, data-driven decisions throughout the system life cycle. Proper use 730 of digital engineering digital engineering practices enables faster, higher-quality decision 731 making during design, development, testing, fielding, and maintenance. Model Based 732 System/Software Engineering (MBSE) is a key enabling factor for success software 733 development practices. The Army is standardizing digital engineering practices through use 734 of the Unified Architecture Framework (UAF) and SysML. Key digital engineering products 735 and activities include but are not limited to: 736

• System Architecture 737

• Process Flow Diagrams 738

• Software Architecture Diagrams 739

• Interface Models 740

• Data Models 741

• Data Architecture 742

• Enterprise Architecture 743

5.9.6 Data 745

Efforts in this task area focus on the collection, architecting, use, analyzing, sharing, storage, 747 manipulation, and transformation of data to produce value for the Army. Task orders in this 748 task area will produce solutions that in alignment with the Armies data centricity goals. 749 Expected activities include but are not limited to: 750

• Data Pipeline Engineering 751

• Creation of Data Visualization 752

• Data Analytics Design, implementation, validation 753

• AI/ML Model Creation, Model Development, Training, Deployment, Validation 754

• Hyper Parameter Optimization 755

• Novel Application of existing models 756

• Creation of AI integrated workflows 757

• Design and Creation of novel Data Architectures 758

• Creating Data Transforms 759

• Performing data analysis 760

5.10 Service Contract Reporting 762

5.10.1 System for Award Management (SAM) Service Contract Report (SCR): The Contractor 764 shall report ALL Contractor labor hours (including subcontractor labor hours) required for 765 performance of services provided under this contract for the Army via a secure data collection 766 site.