A03 PWS Updated 1.30.24.pdf

PERFORMANCE WORK STATEMENT

ELECTRONIC DOCUMENT MANAGEMENT (EDM) PROGRAM

1.0 BACKGROUND

Since 1995, DFAS has used the Electronic Document Management System (EDM) and maintained 24/7 availability. The equipment operates to support the Department of Defense customer needs worldwide and has the capability to be modified in order to adhere to the governments changing business processes. In order to maintain these expectations tasks outlined in this PWS are required.

The Defense Finance and Accounting Service (DFAS) provides finance and accounting services to the Military and other Department of Defense (DoD) activities. These services include military and civilian payroll, contract payment processing, travel reimbursement, travel payments, and other services directly related to the financial management of the Department of Defense. DFAS and Electronic Data System (EDS) developed two electronic document systems Contract Payment and Vendor Payment). There are three separate divisions of Contract Payment located in Columbus, OH. Multiple divisions of Vendor Payment are in operation at DFAS sites in the United States, Europe and Japan locations.

The EDM system is a document imaging and workflow system hosted on a suite of UNIX systems running an Oracle 19 database platform. EDM is composed of the two primary solution architectures mentioned earlier (Order/contract Pay and Vendor Pay). EDM includes a client-server solution that makes use of Pix Tools to view and annotate images as well as process workflow requests, index incoming documents, and administer user access. The client solution is currently supported on Windows 10 operating systems. EDM also includes a web-based electronic file- room that operates on Windows 2016 Servers. The web-based solution allows for document viewing, document uploading, and workflow case research. Also, part of the web-based solution are two components utilizing LeadTools OCR software to provide Pre-Acceptance and Verification of all incoming documents and a component to perform automated redaction of Personal Identification Information (PII). A separate web solution, Multi-System Search Tool (MSST), provides a Federated search engine tying together three separate systems into one database used by Audit Readiness and other EDM customers. The MSST system also provides document viewing and download capability.

Though the EDM server solution is currently located in DISA-DECC Mechanicsburg, PA and DISA-DECC Montgomery, AL - EDM operations are worldwide. DFAS includes a large business processing staff of finance and accounting specialists located primarily at DFAS sites listed below:

Columbus, OH Texarkana, TX Cleveland, OH Indianapolis, IN Japan (Yokota AFB) Rome, NY Europe (Kaiserslautern, Germany) Limestone, ME

2.0 OBJECTIVE

The objective specific of this PWS is to provide the services required to support the EDM system. Services shall include but are not limited to application upgrades, system analysis and development, testing, training, application maintenance, application security maintenance, system documentation and consultation support.

The contractor shall complete the tasks identified within Section 4 and provide all key personnel to support this effort:

a. Task 1 - Production Support as identified within Task 1 (Section 4.1) (Firm-Fixed Price)

b. Task 2 – EDM Hardware/Software Maintenance Support identified within Task 2 (Section 4.2) (Firm-

Fixed Price)

c. Task 3 - Analysis and Development as identified within Task 3 (Section 4.3) (Labor Categories/Hours)

d. Key Personnel (Section 8.0)

3.0 SCOPE

The contractor shall support operations and perform services for all EDM application system environments (Development, Testing, and Production) that are required for the application upgrades, analysis and development, system maintenance, application security maintenance, system interface setup and maintenance, and consultation support of EDM and its suite of applications. This This support includes:

a. Professional technical support services process workflows support document management engineering.

b. Development testing

c. All required packaging

d. All implementation

e. Post Implementation Support

f. Progress Reports

g. Updated Architectural design.

h. System documentation

i. Configuration Management

j. Information Assurance support to include continual validation of the EDM system and documentation.

k. Network topology

l. All pertinent documentation and technical management support in order to maintain functionality of the transfer of information between systems either through routine maintenance or through new approved interfaces.

Due to continuous changes, new releases, and updates, the DFAS Business requirements often fluctuate.

Therefore, the scope of the work to be performed includes system analysis/design, development (coding), testing, knowledge transfer, and system documentation to address any EDM system Change Requests (SCR), DoD or DISA regulated changes, and required system software updates.

3.1 PLACE OF PERFORMANCE: The work to be performed under this task order may be performed from a remote location as agreed to by the parties.

4.0 TASKS

The contractor shall perform in the following task areas:

a. Task 1 - Production Support and Maintenance

b. Task 2 - EDM Hardware and Software Maintenance

c. Task 3 - Analysis and Development

DISA/DFAS will provide the required hardware, software components and networking at the DISA System hosted locations. The contractor shall maintain all custom coded software components and maintain all software configurations integrated with the application to operational capability.

4.1 TASK 1: PRODUCTION SUPPORT AND MAINTENANCE (Firm Fixed Price)

4.1.1 GENERAL REQUIREMENTS: The contractor shall provide production support 24 hours, 7 days a week, 365 days per year support with the following details:

a. Core hours: 5 days (Monday - Friday) a week production support at the

CONUS/OCONUS DFAS locations in support of EDM Contract Payment and Vendor Payment systems, (during normal business hours, 0600-1800 M-F, local time).

b. In conjunction with the 24/7/365 production support, at time of award the contractor shall provide a central contact point for the purpose of receiving and responding to system trouble reports. The contractor is responsible for the distribution and synchronization of support services with DFAS’s daily operations.

4.1.2 SYSTEM AVAILABILITY AND ADMINISTRATION: The contractor shall monitor the software within the current EDM environment as described in the Equipment List and Past History/Information & EDM Documents. The technical support services shall provide monitoring on approximately 8 Windows servers across the NIPRNET network as well as provide support to all automation equipment. This includes the following:

a. Identify, diagnose and assist in resolving all latent faults (bugs), incompatibilities or performance problems on or with the (Commercial-off-the-Shelf and the DFAS EDM custom applications). The contractor shall identify, diagnose and provide feedback on resolving issues with infrastructure or the related technical environment components such as networks, web servers, switches, routers, bundling software, release packages, SFTP servers, FTP servers, storage devices, operating systems, COTS software and scanners that EDM relies upon for input, output or for successful operation. Monitor interface files and coordinate resolution System issues that require fail over to another server or an ISCP (Information Security Contingency Plan) situation must be remediated within a 2-hour period during normal work hours for the affected site.

b. The contractor shall provide production support to include setup of new interfaces and updates to existing interfaces, testing and provide test support, to all current system-to-system interfaces to maintain Full Operational Capability of all incoming and outgoing data transfer(s).

c. User’s access issues, document retrieval issues and display issues are to be resolved within 2 hours from 0600 – 1800 Monday-Friday as a part of the Tier III helpdesk function. If issues are not resolvable within the 2hour timeframe order/contractor will report resolution status to COR and PM every 2 hours until resolved. System issues that require fail over to another server or an ISCP (Information Security Contingency Plan) situation must be remediated within a two-hour period during normal work hours for the affected site.

d. The contractor shall monitor performance of hardware and ensure it does not disrupt file access services to workstation clients (Government personnel).

e. The contractor shall monitor to ensure that the EDM system is available 24 hours per day, 7 days per week (including holidays) and 52 weeks per year for all DFAS locations. The contractor shall report on this performance objective on the 10th day of the following month.

f. The following shall be coordinated with and approved by the PM.

1. Monitor overnight and daily batch job cycles to ensure timely receipt and processing of ‘feeder’ files.

2. Investigating and resolving data loss situations

3. Investigating and resolving data integrity situations

4. Maintaining all system tables, e.g., IP addresses, security tables, usernames and passwords

5. Running management reports and ad hoc queries in the format requested by the

P.M.

6. Provide detailed summary of activities accomplished during downtime.

4.1.3 MAINTENANCE REPORTING: The contractor is responsible for the following:

a. DISA Global Service Desk: The contractor shall create network tickets for network changes and waivers. The contractor shall follow the established Standard Operating Procedure (SOP) to submit trouble tickets to provide notification to the appropriate DISA network administration personnel of the problem. The contractor shall monitor all submitted tickets and actions are taken to escalate all High to Critical tickets.

b. Downtime Reporting: The contractor shall provide notification of a downtime situation within 15 minutes of discovery by email and telephone to the PM and to those individuals in the Pyramid Alert Notification Roster provided by the PM. After initial notification is made, the contractor shall take corrective action and report the status of the repair to the PM every 30 minutes during CONUS core hours and every two hours or alternate reporting timeframes as directed by the COR during non-CONUS core hours until the system is determined productive and able to support the DFAS mission.

c. Monthly Maintenance Summary Report: The contractor shall provide the COR a monthly maintenance summary report for the contractor-controlled systems including the computed system availability percentage using minutes as the unit of measure. The monthly report shall have a summary list of incident malfunction reports that affect the system availability percentage. The monthly report shall be submitted no later than the 10th calendar day of the following month. The monthly report shall be discussed with the project office during a monthly meeting.

d. System Examination: The contractor shall monitor hardware and software for end-of-life situations for impact to EDM. The contractor shall notify the government of these events in writing. The report may include a comparison of the existing environment and the recommended potential solutions. In instances where the contractor finds a potential need to upgrade, the COR and the Program Manager must be notified prior to expanding the effort.

e. Management Reports: The contractor shall provide ad hoc system queries when requested by the COR.

f. Customer Change Request List (CCR(s): The contractor shall be responsible for managing the customer change request list, which identifies technical deficiencies reported within the system. The DFAS system office will provide the baseline list and the contractor will manage the list thereafter in DFAS approved tracking tool such as MyIT. Regarding each item on the list, the contractor shall review, categorize with a status on remediation, and provide recommendation to resolve on a quarterly basis.

4.1.4 TEST SUPPORT: The contractor shall provide test support, participate in testing efforts and on demand data migration support performed by DFAS processing partners for payment support systems, entitlement systems, and other processing partner systems which touch or rely on EDM to provide data manipulation and feedback. Each time a partner enhances their system EDM participates in the system test processes to ensure no negative impact on the EDM system or the EDM user base.

Requirements include:

a. Set up and configuration of a test database for DFAS customer use.

b. Participation in the testing process to include processing test data, verifying workflows, processing test cycles, and providing and verifying input/output products.

c. Identifying business process deficiencies found during test process and recommending solutions.

d. Ensuring no negative impact to current EDM processes is created from partner systems’ enhancements.

e. Ensuring no negative impact to current EDM processes is created from Desktop

Management Initiatives that are mandated enterprise-wide changes.

4.1.5 ON DEMAND DATA MIGRATION: Organize DFAS workload by specific databases located across several servers. Reorganize workload to another existing database or establish a new database at the request of the Government to meet the changing workload needs of the DFAS mission or our processing partners.

Frequency estimate:

a. Monthly for the Contract Payment system – transferring workload between existing databases.

b. Quarterly for the Vendor Payment system or as requested. The Vendor Payment system does not have an established schedule for workload transfer.

a. A plan and schedule detailing the migration of data to another database.

b. Conducting a post migration test to verify functionality of the EDM system is maintained.

c. Support to customer post migration, advising government of problems as discovered and providing a plan to correct problems.

4.1.6 SECURITY UPDATES: Integrate security directives into the EDM suite of applications in the timeframe established by the government.

Frequency estimate:

a. Quarterly for security patches and vendor upgrades

b. As requested for DoD-wide or DFAS-wide emergency security upgrades

a. Respond to government mandates to meet domain and namespace requirements and adhere to the requirements of the domain and namespace mandates for system and software.

b. Perform Oracle security upgrades on all EDM software as required.

c. Monitor, at a minimum of every 14 days, all identified Information Assurance Vulnerabilities (IAV) audit findings relevant to the EDM suite of applications by the government to ensure that all scans have been reviewed and any required remediation is documented and completed within 21 days.

d. Perform continual monitoring and testing of all non-application Security Technical

Implementation Guides (STIGs) relevant to the EDM system and provide documented testing artifacts for all STIGs.

1. The contractor shall integrate vulnerability fixes/patches/remediation for all EDM application.

2. Software(s) and application Security Technical Implementation Guides (STIG) for the application.

3. Software baseline. All STIGs are required to be recorded in the latest Defense

Information System.

4. Agency (DISA) STIG Checklist.

5. The contractor shall integrate, validate all application baseline code, backups and executable software.

6. Recommend best possible technological solution that meets government requirements directive.

7. Recognize and ensure the security posture as defined by the government is maintained for all EDM hardware and software.

8. Update, monitor and enforce security controls for user access and STIG (Security

Technical Information Guides) remediation.

4.1.7 CONFIGURATION MANAGEMENT:

a. The contractor shall perform all configuration management activities utilized DFAS or

DISA hosted, DFAS approved configuration and document management tools.

b. The contractor shall utilize a DFAS-approved, DFAS or DISA hosted Configuration Management tool and provide a detailed Configuration Management Plan (CMP). The contractor shall ensure that EDM remains operational with new hardware and software releases. When the COR requests, or the contractor identifies a potential need to update system configurations, the contractor shall identify the existing environment and recommend solutions. Additionally, the contractor shall maintain up-to-date records and documentation of the systems configuration including versions, systems schematics for workflows and other functional processes and interfaces.

c. The contractor shall maintain all documentation required for Life Cycle Management utilizing current DFAS guidance and templates as applicable in support of Information Assurance activities/tasks such as Risk Management Framework (RMF), Federal Information Security Management Act (FISMA), Federal Information System Controls Audit Manual (FISCAM), Federal Financial Management Improvement Act (FFMIA), or other government compliancy activities.

d. The contractor shall provide copies of this documentation annually and upon deploying system modifications to the COR in a mutually agreed electronic format.

Documentation includes but is not limited to the following: Configuration Management Plan, Incident Response Plan, Information System Contingency Plan, System Security Plan (SSP) and SSP inventory. Updated Life Cycle Management Documents must be readily available and retrievable. Requests to meet Audit Readiness requirements/exercises require up-to-date documents be provided within 2 hours of request from the COR. Manage and maintain EDM CCR production database, EDM workflow designs, definitions and documentation, master Tier2 field rules, indexes, and document type configuration.

4.1.8 APPLICATION SYSTEM KNOWLEDGE TRANSFER, COMMUNICATION,

COLLABORATION

a. The contractor shall provide knowledge transfer and transitional support to government employee(s) and end users after a new application release or upon request by DFAS.

The contractor shall provide all documentation of the application system design, operating procedures, installation, configuration, test documentation, and training material for transfer of knowledge.

b. System information and knowledge for transfer related to the following:

1. System Overviews (system and data flows)

2. System Installation Procedures

3. System Configuration Procedures

4. Testing Procedures

5. Common Error Code Definitions and Resolutions

6. Support Files and Documentation

7. Database Design

8. Database Dictionary

4.1.9 COMMUNICATIONS/COLLABORATION SUPPORT

The contractor shall provide the following:

a. Weekly Status Meeting (PM/COR)

b. Weekly System Ticket Report Review

The contractor shall support the following:

c. Annual Continuity of Operations / Incident Response Plan (IRP) exercises and training events

d. Quarterly Risk Management Framework / System Change Request Meeting

4.1.10 APPLICATION SOFTWARE LIFE CYCLE; APPLICATION SYSTEM

DOCUMENTATION

a. The contractor shall gain access to the identified DFAS Configuration Management

Software and deliver all COTS Software Code, Software Licensing, Release Notes, Test Results, Security Impact Assessment Form and Executable Code to the COR and

PM.

b. The contractor shall integrate vulnerability fixes/patches/remediation for all vendor application software utilized and application Security Technical Implementation Guides (STIG) for the application software baseline. All STIGs are required to be recorded in the latest Defense Information System Agency (DISA) STIG Checklist.

c. The contractor shall integrate and validate all application baseline code, backups, and executable software. All application code configurations shall be managed under a DFAS-approved DFAS Configuration Management Software Control System.

d. The contractor shall perform the required application troubleshooting and technical efforts required to complete tasks to maintain the system in a full operational state. The contractor shall maintain all supporting application(s) and integrated software not related to the operating and database software.

4.1.11 INFORMATION SYSTEM CONTINGENCY PLAN (ISCP) The contractor shall support DFAS requirement for annual Information System Contingency Plan (ISCP) testing. The ISCP testing requirement is a Tabletop Exercise or a Live Simulation Exercise performed. The Tabletop Exercise consists of a meeting between DFAS Program Management staff, DISA liaison POC’s, DISA Contingency Planning staff and the contractor staff to review the existing ISCP plan as it would be executed in a potential ISCP scenario. The simulation exercise consists of verifying continued functional operations of the system in a simulated ISCP incident. The simulation exercise can include verifying successful failover to ISCP/standby hardware and software databases to include EDM client applications and web applications. In addition to monitoring hardware and database platform integrity, simulation testing shall also verify successful DFAS end user ability to use the system under the ISCP scenario. Simulated ISCP tests shall be performed in a timeframe and a manner that ensures no negative impact to normal DFAS operations.

4.1.12 PROGRAM MANAGEMENT PLAN (FINAL) The Contractor shall develop and submit a draft Program Management Plan outlining their approach for the on-going management of all tasks for the EDM system with their quote. The final version of this Program Management Plan shall be submitted 45 days after award.

4.1.13 SYSTEM OPTIMIZATION

a. The contractor shall prepare quarterly System Analysis Report during the month of January, April, July, October of each year for review and approval by the COR.

b. The report shall include:

1. Recommendations regarding optimizing the EDM system.

2. Advice regarding how to continually improve EDM to align with DFAS' evolving business processes.

c. The DFAS EDM system office will review advice and make determinations regarding implementation.

4.2 TASK 2: EDM HARDWARE/SOFTWARE MAINTENANCE (Firm Fixed Price) The Contractor shall maintain the equipment as identified on the Government Furnished Equipment List in proper operating condition. Maintenance and Support includes the cost of labor, parts and such other expenses necessary to keep the equipment in operating condition. The Contractor is responsible to price all necessary expenses to maintain the OEM specifications, for a complete listing of the hardware, software, and equipment list see Exhibit 3. The contractor shall document their maintenance support plan for all hardware and software. In addition, equipment support includes the following:

a. Hardware Repair and Servicing: The Contractor shall provide repair services for all hardware equivalents to the original manufacturer’s specifications. Repair services must provide coverage as follows: 24 hours, 7 days a week (including holidays) with a 2-hour response time for all production servers and RAID (Request and Inspection of Documents) equipment that could stop production or batch cycle processing. Repair services for all other hardware is the next business day. All replacement/spare parts and supplies furnished by the Contractor shall be guaranteed to be equal in all respects (including performance, interchangeability, durability and quality) to parts specified by the Original Equipment Manufacturer (OEM). Non-operational, obsolete or damaged parts shall be returned for core charges unless prohibited by security concerns. This shall require COR approval on all OEM equipment. Classified hardware shall be marked and safeguarded in accordance with DoDM 5200.01, Volume 3, DoD Information Security Program: Protection of Classified Information, and DFAS 5200.1-I, Information Security Program.

b. Software Repair and Servicing: The Contractor shall provide repair services for all EDM applications and operating system software. Repair services must provide coverage as follows:

24 hours, 7 days a week (including holidays) with a 2-hour response time for all software problems that could stop production or batch cycle processing. Repair services for all other software problems are the next business day. Non-operational, obsolete or damaged software shall be disposed of IAW DoD Instruction 5000.64, Accountability and Management of DoD-owned Equipment and Other Accountable Property, and DFAS 5335.1-I, Property Management.

Classified software shall be marked and safeguarded in accordance with DoDM 5200.01, Volume 3, and DFAS 5200.1-I.

c. Equipment Tracking. The Contractor shall maintain equipment lists as part of the overall configuration management of the system. In addition, the Contractor shall coordinate with the COR to ensure all equipment (hardware and software) is registered into the Defense Property Accountability System (DPAS) and all documentation is complete and accurate.

d. Discontinuance Notice: When discontinuing equipment support, the Government will give the

Contractor 30 days prior written notice of its intent to discontinue equipment support of one piece or entire systems, or a shorter notice when agreed to by the Contractor.

e. Excess Equipment: Upon determination by the COR that equipment is obsolete; the contractor shall help with the proper disposal of equipment determined to be excess IAW DoD Instruction 5000.64, Accountability and Management of DoD-owned Equipment and Other Accountable Property, and DFAS 5335.1-I, Property Management. Help is defined as pull hard drives from equipment; identify excess equipment; help move equipment to storage location, updating inventory lists and completing documentation. This includes ensuring the erasure of all data by authorized and certified personnel and performing all associated documentation tasks necessary for the complete and proper disposal of excess equipment. The scope of this requirement includes all active DFAS sites. (The contractor will coordinate with the COR, the local Security Office of that particular DFAS Center and/or Office of Force Protection Antiterrorism Officer/Information Security Program Manager.)

f. Movement of Equipment: In the event the equipment being supported under the terms and conditions of this BPA Call is moved within the same building, relocated within the continental United States, is discontinued for usage or required service - the Contractor shall help in de-installing, packing, unpacking, and re-installing the equipment. Help is defined as ensure equipment is prepared for de-install, packing for shipment, unpacking and re-installing at new locations. The COR will provide the Contractor written notification of the move at least 30 calendar days in advance, except in an emergency situation. In the event of an emergency, the Contractor shall respond within the response time specified. Emergencies may include flooding, fire, similar Acts of God, and mobilization. Shipment to the new installation(s) shall be at the Government’s expense.

The contractor shall support and maintain the following EDM application hardware/ software:

a. Development hardware/software

b. Configuration Management hardware/software

c. Leadtools Imaging & OCR COTS software

d. DFAS scanners located at the DFAS scanning locations.

4.3 TASK 3: ANALYSIS AND DEVELOPMENT (Labor Hour)

a. The contractor shall perform all aspects of application system analysis to include:

1. Designing, development, and coding

2. Creating innovative new product(s) based on customer requirements.

3. Integrating new security mandates or COTS software upgrades supporting the applications for operational maintenance

4. SCRs that will require coding changes which occur due to but not all inclusive:

Workflow enhancements.

Implementation of new software in the EDM suite of applications.

Compliance to DOD requirements.

Findings from analysis of current EDM environment to evaluate system changes for major migration.

b. The contractor shall provide a Rough Order of Magnitude (ROM) to include labor hours, software costs, plan of action, and milestones, upon completion of all estimates as defined in the deliverable schedule.

c. Analysis or Development will need to be approved by the Program Manager.

4.3.1 SYSTEM ENHANCEMENTS DFAS’s support needs will change as the IT environment changes. The DFAS EDM system office will determine the system enhancements to deploy. The DFAS Desktop Management Initiative (DMI) Configuration Control Board (CCB) has approval authority for the configuration of the desktop PCs, including packaging, installation and permissions of EDM software on desktop PCs. Any action (implementation, upgrade, update, patch, etc.) that results in change to the desktop PCs will be coordinated through the DMI CCB by the DFAS EDM system office.

a. The contractor shall, integrate, test, and support the installation of the solution within required schedules and requirements.

b. The contractor shall monitor software programming, system integration, system testing and installation services for all hardware and software required.

c. The contractor shall develop and maintain a Software Quality Assurance Plan (SQAP) or Quality Assurance Plan (QAP), utilizing the current DFAS Quality Assurance Plan Manual for specific guidance. The plan shall be delivered to the PM for review and approval 30 days prior to the start of development.

d. The contractor shall complete all necessary programming to support the recommended solution. All software authorized, approved, developed and paid for by the Government shall become the property of the Government upon delivery and acceptance. The contractor shall provide detailed test plans to the PM for approval 30 days prior to the start of testing for all new initiatives or system improvements. The contractor’s test plans shall address the various areas of testing including unit testing, integration testing, interface testing, support for Government quality, and user acceptance testing and post deployment support.

e. The contractor shall participate in testing with DFAS interface partners. Products tested may be DFAS systems that interface with EDM or processing partner systems that interface with EDM. The Contractor when requested by the COR, shall prepare, review and update implementation material as a result of EDM changes in related or interfacing systems.

f. The contractor shall update design documents to reflect the approved design. All existing life cycle documentation shall be updated to include illustrated representations, flowcharts, path names, links, connections and references to all applicable standards incorporated into the system. The contractor shall furnish all documentation for review and approval by the PM.

g. The contractor shall monitor deliverance and installation of all software products necessary to meet the recommended solution on the EDM maintained equipment including OEM provided rights, licenses, documentation and warranties. In addition, the contractor shall provide all related manuals and program descriptions. The contractor shall notify the Government when updated versions of software components become available.

h. The contractor shall deliver system change release packages and installation requirements for all software products to be installed on equipment not maintained under this IDIQ (e.g., client PCs). Notifications of change to client PCs shall be provided at least 45 days in advance of software delivery. The contractor shall work jointly with the DFAS Information and Technology (IT) Directorate to ensure all release packages are ready for distribution are provided to the office responsible for their distribution. Installation package shall provide for automated installation without Government intervention or adjustments to the package. Installation instructions, procedures, and release content shall be included with all packages delivered. The contractor shall work with IT personnel, system managers, operations representatives, and designated service providers to ensure scheduling and distribution minimally impact production. The contractor shall notify the Government when updated versions of the equipment components become available. The contractor shall record and maintain the architecture diagrams of all installed hardware and software in accordance with the Configuration Management Plan. The records shall include version numbers of each distinct software package, model numbers, serial numbers, maintenance, and warranty information and all other information required by the Government. The report and architecture diagrams shall be updated within 30 days of system changes and provided to the government.

i. The contractor shall provide documented guidance material for all system improvements and initiatives. The contractor shall prepare and provide new guidance materials for review and update existing guidance materials to reflect changes to the installed systems. The contractor shall provide all new or revised material to the PM for review and approval. The contractor shall be responsible for the development, reproduction and delivery of all guidance materials. The contractor shall provide release notes describing the current process and the new improved process to include EDM core functionality:

1. Document Capture

2. Tier 2 Indexing

3. Electronic Folder(ing)

4. Document viewing and search.

5. Workflow

6. Management Reports

7. Productivity Reports

8. Status Reports

9. Business process flows

10. eFileRoom

11. eUpload

12. Pre-Acceptance VERification (PAVER)

13. PII Redaction Engine (PuRE)

14. Multi-System Search Tool (MSST)

4.3.2 USERS MANUAL: As the EDM system changes, the contractor shall update manuals within 30 days of change.

5.0 GENERAL REQUIREMENTS

5.1 DATA RIGHTS The DFAS EDM PMO requires unlimited rights IAW FAR 52.227-14, Rights in Data General (Dec 2007), to any effort that modifies the system.

5.2 HOURS OF OPERATION The contractor shall monitor the EDM system 24 hours a day, 7 days a week, 365 days per year (regardless of any national holidays). The contractor shall at all times maintain an adequate workforce for uninterrupted performance of all tasks defined within this

PWS.

5.3 QUALITY CONTROL (QC) The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which it assures itself that the work complies with the requirement of the order/contract. The contractor shall deliver its proposed quality control plan with their quote. When changes are made, the contractor shall submit a revised plan within 5 working days thereafter.

5.4 INTERACTION WITH CONTRACTOR PERSONNEL The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel. The contractor personnel shall direct their questions or concerns to their contractor management chain and/or company representative.

5.5 PRIMARY POINT OF CONTACT FOR THE CONTRACTOR The COR shall interface with

DFAS IT Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page at:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/ForceProtection.aspx

Follow the link titled “Site Specific Force Protection/Security Services” in the “Additional Points of Contact” section near the top right side of the order/contract.

PM duties include:

1. Monitoring all technical aspects of the contract and ensuring contractor performs the technical requirements of the contract.

2. Maintaining written and oral communications with the contractor concerning technical aspects of the contract.

COR duties include:

1. Perform inspections necessary in connection with contract performance

2. Assists in contract administration.

3. Monitor contractor's performance and notifies both the Contracting Officer (CO) and contractor of any deficiencies.

4. Coordinate availability of Government furnished property and site entry of contractor personnel.

a. A letter of designation issued to the COR, states the responsibilities and limitations of the

COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

5.6 POST AWARD CONFERENCE/PERIODIC PROGRESS MEETINGS The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO may apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

5.7 IDENTIFICATION OF CONTRACTOR EMPLOYEES All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties shall identify themselves as contractors to avoid creating an impression they are Government officials. Contractor personnel shall ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The Common Access Card (CAC) used for building entrance, computer access, and other situations will identify the individual as a contractor.

5.8 INTERACTION WITH CONTRACTOR PERSONNEL

a. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

b. The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to order/contract performance.

c. The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after order/contract award/exercise of an option, a written report identifying:

1. Contractor employees required to take the training.

2. Contractor employees who have completed the training.

3. Contractor employees who are delinquent.

d. Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

e. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual SPIRIT training status of all contractor personnel.

6.0 TRANSITION

6.1 TRANSITION PLAN The contractor shall develop and submit, with their quote, a draft Transition Plan for the first 30-120 days of the order/contract which presents a clear understanding of all efforts involved in the transition from the prior service provider. The draft plan shall present economical, effective and workable solutions to accomplish the transition. The final plan shall be submitted 21 days after order/contract award. The draft and final transition plans shall include the following items:

a. Interface/coordination with the Government

b. Contractor supervision of the transition process

c. Employee recruitment

d. Transition of key personnel

e. Initial training, indoctrination and orientation of all contractor employees

f. Transfer and control of Government furnished property

g. Transfer, custody, control, safeguard process and turnover procedures for system operation

h. A risk management plan for the phase in process

i. A Work Break Down Structure (WBS) outlining detailed tasks and schedules for the phase in process

6.2 TRANSITION PERIOD The contractor shall have the opportunity to begin work on a phased in basis to avoid an interruption of service when transitioning from the prior service provider. At the conclusion of the transition period, the new service provider must be totally capable of performing the required tasks as stated in the Performance Work Statement (PWS)without further assistance from the prior service provider.

6.3 TRANSITION OUT ACTIVITIES The contractor shall exercise its best efforts to effect an orderly and efficient transition with the successor contractor to ensure that the required services are performed without interruption. The contractor shall implement their Transition Plan presented in their quote within 1-business day of the performance start date of any follow-on requirement.

However, the Government may require changes to the plan after award of the contract. Compliance of all Government requested changes or revisions to the plan are due within 30 calendar days of the request or sooner. As part of final completion of this order/contract the Government shall require products and support, including the following:

a. SOFTWARE - The contractor shall provide all current Commercial-Off-The-Shelf (COTS) media and documentation. This shall include all licenses assigned to DFAS. The Contractor shall also provide a copy of all software created as a part of this program on compact disks (CDs). This includes tools, diagnostics, applications, and data used for administrative purposes.

The CD(s) shall be structured so that the software can be reloaded onto a similar (identical hardware) system and be operational immediately. This product shall be free of license requirements.

b. ACCOMPANYING COTS MATERIALS - The contractor shall provide copies of all current documentation (in hard copy and electronic format).

c. DATA - The contractor shall provide all active and historical files identifying purchase agreements, identification and ownership documentation along with current inventory location for each item.

d. TRANSITION PLAN - The contractor shall work with the new service provider for up to 180 calendar days in developing a transition of responsibilities plan.

7.0 TRAVEL – is not anticipated at this time.

8.0 KEY PERSONNEL

8.1 CONTRACTOR OVERSIGHT The contractor shall have the personnel, organization, and administrative control necessary to ensure that the services performed meet all requirements specified within this contract. The work history of each contractor employee shall contain experience directly related to the tasks and functions to be assigned and all employee certifications shall be valid and current. The contractor shall provide key personnel to manage the overall performance of the contract.

8.2 KEY PERSONNEL QUALIFICATIONS

a. The contractor shall provide key personnel that permit the full performance of the contract requirements as described in this PWS for the following work categories:

1. Business Service Analyst

2. Database Administrator

3. Enterprise Architect / Staff Engineer - Senior

4. Information Specialist - Senior

5. Project Manager - Senior / Program Manager

6. System Architect / Staff Engineer

7. System Administrator - Advanced

8. System Administrator – Senior

b. All key personnel must be available to support the work outlined above or be substituted with individuals of equal experience, education, and other background qualifications. All replacement personnel must be approved by the COR and PM.

c. Skills/knowledge level for key contractor personnel include but are not limited to:

1. Business Service Analyst:

Under general direction, formulates and defines systems scope and objectives using information technology and industry knowledge/requirements.

Acts as a liaison between customer and technical solutions/support groups to identify business processes, systems, and product requirements.

Researches, identifies and develops solutions to problems.

Analyzes business and user needs, and documents customer specifications.

Supports aspects of the business cycle including proposals, feasibility studies, and implementations.

Considers the business implications of the application of technology to the current business environment.

Certification Requirements: IAT-I

2. Database Administrator:

Extensive experience designing and developing Oracle data structures and stored procedures; extensive knowledge of Oracle stored procedures for production.

Ability to monitor 28 primary and standby production databases on a daily basis; ability to monitor 29 development and testing databases; ability to manage 14 Oracle Data Guard standby databases.

In depth knowledge of the Multi-System Search Tool (MSST) database or similar to manage the “context” database technology for the MSST system.

Extensive experience managing methodology and scripts to incorporate Data Guard databases into an Information System Contingency Plan (ISCP).

Knowledge and ability to provide database infrastructure support for development.

In depth knowledge of EDM or similar system to provide ‘SQL’ creation and analysis support for developers.

In depth knowledge of EDM or similar system to develop database stored procedures support of the EDM system applications.

In depth knowledge of Oracle scheduler jobs for all databases in support of the EDM system.

In depth knowledge of EDM or similar system to develop Script database updates in support of EDM applications updates.

In depth knowledge of Oracle to support and install new Oracle databases.

Ability to develop, install and manage database security triggers and audit database logins.

Ability to manage database password encryption procedures in support of application encryption efforts.

Ability and knowledge to review and revise database privileges to support least privilege concept.

Ability and knowledge to create full sized, coordinated testing database for System

Integration Testing (SIT) and User Acceptance Testing (UAT).

Ability to maintain updated documentation of the database specifications through an

HTML site.

Ability and knowledge to research, plan, develop, test and implement scripts for Oracle database upgrades to support new versions of COTS software.

EDM or similar system experience to research, plan, develop, test and implement scripts for Oracle quarterly Critical Patch Updates and one-off database patches as they affect

EDM.

Provide Tier II support in trouble shooting and resolving production database issues.

3. Enterprise Architect/Staff Engineer – Senior:

In depth knowledge of the EDM system or similar system and related components, Pre- Acceptance Verification (PAVER), PII Redaction Engine (PuRE), Multi-System Search Tool (MSST), Oracle Database Management System, Electronic Data Interchange (EDI), HP/UX and Win 10 Operating Systems, DFAS entitlement systems, Wide Area Workflow (WAWF), Electronic Document Access (EDA), Global Exchange (GEX), Optical Character Recognition (OCR) technology, networks and network infrastructure including routers and firewalls, encryption, DFAS Desktop Management Initiative, Security Technical Implementation Guides (STIGS).

Ability to establish basic structure of systems and subsystems, defining core design and building blocks that provide the basic framework of the systems.

Ability to identify the effects on and define/design mitigation techniques for effects on controlled systems caused by changes in uncontrolled systems, infrastructure, operating environment and/or policy.

Knowledge of EDM or similar system to assist developers with design modifications and enhancements to ensure continue EDM stability, compliance with regulations and information assurance initiatives.

Certification Requirements: CISSP-I, IASAE-I

4. Information Specialist – Senior: Extensive knowledge of EDM or similar system -

To recommend software configuration practices and maintain tools used to store software and documents. Create software release components and manage software versioning.

To administrator the Configuration Management System maintaining user accounts, roles and organization of development projects and software repositories.

To liaison with DFAS desktop management service provider by providing software components to be released to the DFAS EDM community.

To support desktop management group in release package creation process by installing and testing group’s packages.

To analyze impact of change requests to current EDM systems and provide estimates to DFAS leadership. Maintain and develop client and web applications in support of the EDM solution.

Expert knowledge of the following program languages: Visual Basic .Net, Visual C# .Net, Visual C++, HTML, XML, XSLT, VB Script, Java Script, JQuery, SOAP, AJAX.

Expert knowledge in the following tools: Visual Basic, SQL-Plus, SQL Developer, VB.NET, current DFAS standard of MS Office.

In depth knowledge of EDM or similar system recommending database table structures, developing SQL and PLSSQL database components and database tuning components such as table indexes, triggers and table views.

Knowledge of the industry to evaluate and recommend third party software components to enhance and support the EDM solution.

Serve as coach/mentor to team members in software coding practices, serve as liaison to DFAS testers during SQT and UAT efforts; ensure configuration management practices that result in successful development cycle.

Expert in C applications and UNIX script development.

Develop and update C applications and *NIX scripts used in EDM production programs.

In depth knowledge of Oracle and EDM or similar system for development and update of the many Oracle stored procedures used for production.

In depth knowledge of EDM or similar system to troubleshoot host and production issues.

In depth knowledge of EDM or similar system to write host installation instructions and build host package for production releases.

Assist DBA in building oracle scripts used to make database changes in production.

Write release notes for use by the customer.