Attachment_C_Draft_Performance_Work_Statement.docx

DOCX document 233 KB Posted

Attached to
Defense Enterprise Office Solution (DEOS)
Solicitation number
47QTCA-19-Q-0001
Issued by

About this file

Attachment C Draft Performance Work Statement

View the file

Other files

File Type Posted
DEOS_Question_and_Answer_IL6.docx DOCX document
Attachment_D_Draft_Key_Programs_Milestones_Deliverables.xlsx XLSX spreadsheet
Attachment_E_Draft_Price_Discount.xlsx XLSX spreadsheet
Attachment_B_Draft_DEOS_Statement_of_Objectives.docx DOCX document
Attachment_F_Draft_Quote_Sheet.xlsx XLSX spreadsheet
Draft_RFQ_Instructions_to_Quoters.pdf PDF
Attachment_A_Draft_Functional_Requirements_Document.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

PERFORMANCE WORK STATEMENT (PWS)

as of [DD-MMM-YYYY]

Contractor Name:
[Insert Company Name]
GSA Schedule Contract Number
[Insert Contract Number]
GSA BPA Number
[TBD]

[Fill-in guidance is presented in RED ITALIC with brackets borders. REMEMBER to delete all italicized text, contained within brackets herein when completing your PWS. It is shown here for instructional/informational purposes only and must not remain part of the final document/proposal submitted.]

1. Background The Department of Defense (DoD) requires an integrated enterprise cloud service offering (CSO) that provides common communication, collaboration, and productivity capabilities that are mission-effective, efficient, more widely accessible, and facilitate DoD operations worldwide. The Defense Information Systems Agency (DISA), in support of the DoD Deputy Secretary of Defense’s direction to accelerate the DoD’s adoption of cloud computing technology, plans to acquire and implement a seamlessly integrated, enterprise CSO as a replacement for disparate DoD legacy enterprise information technology (IT) services, such as voice, video, collaboration, email, content management, records management, and productivity suite.

2. Objectives DEOS will support the Department’s vision to move towards an integrated/interoperable communication, collaboration, and productivity service, by facilitating trusted information sharing between Combatant Commands, Services and Agencies (CC/S/As), and through the consolidation of multiple DoD enterprise services into a single environment. In addition, DEOS will unify and modernize legacy DISA IT enterprise services such as DoD Enterprise email (DEE), DoD Enterprise Portal Service (DEPS), Defense Collaboration Services (DCS), and other DoD-wide legacy capabilities.

The DEOS CSO will be acquired by DISA using an unrestricted, competitively awarded, single-award Firm-Fixed Price (FFP) Blanket Purchase Agreement (BPA) with a contractor who will provide a widely used/widely available, and non-developmental and fully integrated collaboration solution. The BPAperiod of performance will be a 5-year base ordering period and two 2 year option periods and one 1 year option period.. The BPAalso will include the 6-month extension of services authorized by FAR 52.217-8. The 10-year period of performance will provide the Department with the flexibility to transition users based on user demand, migration schedules, and legacy contracts or service end-of-life terms

3. Scope The DEOS CSO may scale to an anticipated 3.15 million DoD consumers, and over 4 million directory objects, which includes supporting DoD CC/S/As across many locations to include local base/post/camp/station (B/P/C/S), deployed and afloat organizations. DEOS is intended to be deployed on the Sensitive but Unclassified Internet Protocol (SBU IP) Data Network, also known as NIPRNet, and the Secret Internet Protocol (IP) Data, also known as SIPRNet, to include Denied, Disconnected, Intermittent, and Limited Bandwidth (D-DIL) environments.

The capabilities within the scope of the DEOS service are highlighted in Figure 1. The green boxes highlight the key DoD supporting infrastructure, services, and major integration points that will reside primarily on-premises as part of the Government’s responsibility. The Cloud Service Provider (CSP) will be responsible for ensuring interoperability and integration with these major service support functions and integration points. Additional requirements are outlined in section 6, and section 7 of the Functional Requirements Document (FRD) Attachment A.

Figure 1 – DEOS Service Requirements

The Government requires a multifaceted implementation and deployment approach for United States territories and possessions and locations outside of the United States territories and possessions for NIPRNet, SIPRNet, and D-DIL environments.

For NIPRNet and SIPRNet implementations in United States territories and possessions, the Government expects to leverage DoD approved commercially hosted facilities to meet the DEOS requirements. However, due to DoD data sovereignty requirements, the contractor must implement their NIPRNet and SIPRNet CSO within DoD data centers (e.g., Stuttgart, Wiesbaden, Capodichino) for locations outside of the United States territories and possessions.

For locations outside of the United States territories and possessions, the contractor must provide a standalone environment within a DoD data center. The solution must be self-contained and must include the required infrastructure, hardware, software, and auxiliary components required to implement, management, and maintain the CSO environment within the DoD data center. The Government expects the contractor to describe the details of their solution to include physical requirements (e.g., number of distributed DoD data centers), heating, ventilation, air condition (HVAC), per-rack power (e.g., single phase, 3-phase, amperage, voltage, etc.), floor space (e.g., rack and total square footage), bandwidth (in total Mbps/Gbps), physical security/separation, physical access, remote management, and networking (e.g., IP addressing, subnets, routing) requirements.

4. Performance Requirements The contractor shall propose performance tasks that fully adhere to the requirements of the solicitation and the DEOS FRD (Attachment A) so that DEOS is available to end users. The contractor will perform all necessary activities as well as provide the required documentation association to achieve and maintain the necessary DEOS Authorization to Operate (ATO) decisions as a national security system on the DoDIN, utilizing the Performance Work Statement (PWS) format (Attachment C) provided as part of this solicitation.

4.1 Task 1 – NIPRNet Environment

The contractor shall deliver a CSO that enables collaboration across the DoD enterprise. The NIPRNet CSO shall include System Wide, Core Services (i.e., email, IM/chat, web conferencing, native audio, native video, content management, and productivity suite), and DoD Information Network (DoDIN) Protection requirements in accordance with (IAW) the FRD sections 1, 2, and 3 having a network category of “Both” or “NIPR”.

Furthermore, the contractor shall be required to interface the CSO to the core integration points identified in the FRD section 6. Lastly, the contractor shall adhere to the performance objectives identified in the FRD section 8, and shall be required to perform testing activities/events (i.e., integration, acceptance, operational) IAW the FRD section 9, to verify the proper interoperability between the CSO and core integration points (FRD section 6).

4.1.1 Subtask 1 – United States Territories and Possessions

Provide a geographically dispersed off-premises CSO within a DoD private/community hybrid cloud that meets Impact Level 5 requirements IAW the DoD CCSRG and the FRD.

4.1.2 Subtask 2 – Locations outside of the United States Territories and Possessions Provide a geographically dispersed DoD private/community Cloud Service Offering (CSO) that is deployed in an DoD facility using an on-premises deployment model that meets Impact Level 5 in accordance with the DoD CC SRG and FRD.

5. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.

[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]

Deliverable Name
Format
Due Date

(Notional)

Distribution
Classification
Frequency
Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) *
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
System Design Document **
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Interfaces, Ports & Protocols Baseline **
Contractor Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Service Support Functions and Integration Plan *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Performance Monitoring Strategy *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Security Architecture Analysis *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D

Distribution F

CUI
One Time; updated as required
Communication Plan *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D

Distribution F

CUI
One Time; updated as required
Migration Schedule *
Contractor Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required

Service Management Plan ** (To Address: Access Management, Event Management, Incident Management, Request Fulfillment, Storefront Integration, Service Desk Support Network Operations (NetOps) Service Desk Integration (i.e., GSD and/or Mission Partner) OSS/JMN and Out of Band (OOB) management)

Contractor Determined / Government Approved Format
30 days after Acceptance of Preliminary Design Review
Distribution D
CUI
One Time; updated as required
Change Management Plan *
Contractor Determined / Government Approved Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
Incident Response Plan and Procedures *
Contractor Determined / Government Approved Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
Service Desk Strategy *
Contractor Determined Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
System Administrator Configuration Guides for NIPR *
Contractor Determined / Government Approved Format
15 days after Acceptance of Production Readiness Review
Distribution D

Distribution F

CUI
One Time; updated as required
Impact Assessment Report *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Implementation Status Report *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Implemented Cybersecurity Controls Checklist *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Cybersecurity Assessment Report *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Selected Security Control Assessment *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Issue Resolution/Remediation Report *
Contractor Determined / Government Approved Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Risk Acceptance Recommendation *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Continuous monitoring strategy/plan **/†
Government Determined Format
30 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
System Security Plan (SSP) **
Government Determined Format
30 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
Directory Replication Plan **
Contractor Determined Format
45 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
OCSP/CRL Integration Plan *
Contractor Determined Format
45 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
Provisioning / Authentication Assessment Documentation */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Privacy Impact Assessment */†
Government Determined Format
15 days after IdAM Integration
Distribution D
CUI
Yearly; as required
Privacy Threshold Analysis */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Residual Risk Statement */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Vulnerability Assessment */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Business Impact Analysis *
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Contingency Plan *
Contractor Determined / Government Approved Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Continuous Monitoring Test Plan */†
Contractor Determined / Government Approved Format
30 days after Acceptance of DoDIN Protection / Cybersecurity Assessment
Distribution D
CUI
One Time; updated as required
Cybersecurity Requirements Definition *
Government Determined Format
30 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Incident Response Plan and Procedures **
Contractor Determined / Government Approved Format
30 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Integration and Acceptance Testing(I/AT) *
Government Determined Format
60 days after Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Recommended Production Configuration Changes **
Contractor Determined Format
15 days after Integration & Acceptance Testing (I/AT)
Distribution D

Distribution F

CUI
One Time; updated as required
Limited Fielding Implementation Plan *
Government Determined Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
One Time; updated as required
System & Configuration Definition (i.e. – “As Built”) *
Contractor Determined / Government Approved Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
Monthly; as required
Defect Tracking List *
Contractor Determined Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
Weekly; as required
Evergreen Strategy *
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D

Distribution F

CUI
One Time; updated as required
Usage Reports (by feature capability) *
Contractor Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D

Distribution F

CUI
Monthly; as required
Incident Reports *
Contractor Determined / Government Approved Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Weekly; as required
FISMA Reporting and Updates */†
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Yearly; as required
FEDRAMP Reporting and Updates */†
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Yearly; as required

Add rows as needed

[Insert Deliverable Title & Indicate level of responsibility based on ------]

[Identify Format Type that w

[Insert distribution in accordance with DoDM 5200.01 Vol 4 and DoDM 5230.24]
[Insert classification marking in accordance with DoDM 5200.01 Vol4 DoDM 5230.24]
[
Symbol:
Definition:
*
50% Government responsibility and 50% contractor responsibility
**
100% Contractor responsibility
†
These artifacts are built upon the packages submitted as part of the vendor's DoD PA

5.1 Task 2 – SIPRNet Environment

The contractor shall deliver a CSO that enables collaboration across the DoD enterprise. The SIPRNet CSO shall include System Wide, Core Services (i.e., email, IM/chat, web conferencing, native audio, native video, content management, and productivity suite), and DoDIN Protection requirements IAW the FRD sections 1, 2, and 3, having a network category of “Both” or “SIPR”. Furthermore, the contractor shall be required to interface the CSO to the core integration points identified in the FRD section 6. Lastly, the contractor shall adhere to the performance objectives identified in the FRD section 8, and shall be required to perform testing activities/events (i.e., integration, acceptance, operational) IAW the FRD section 9, to verify the proper interoperability between the CSO and core integration points (FRD section 6).

5.1.1 Subtask 1 – United States Territories and Possessions

Provide geographically dispersed off-premises CSO within a DoD private/community cloud that meets Impact Level 6 requirements in accordance with the DoD CC SRG and the FRD.

5.1.2 Subtask 2 – Locations outside of the United States Territories and Possessions Provide a geographically dispersed DoD private/community CSO that is deployed in DoD facilities using an on-premises deployment model that meets Impact Level 6 in accordance with the DoD CC SRG and FRD.

6. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.

[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]

Deliverable Name
Format
Due Date

(Notional)

Distribution
Classification
Frequency
Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) *
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
System Design Document **
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Interfaces, Ports & Protocols Baseline **
Contractor Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Service Support Functions and Integration Plan *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Performance Monitoring Strategy *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Security Architecture Analysis *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D

Distribution F

CUI
One Time; updated as required
Communication Plan *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D

Distribution F

CUI
One Time; updated as required
Migration Schedule *
Contractor Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required

Service Management Plan ** (To Address: Access Management, Event Management, Incident Management, Request Fulfillment, Storefront Integration, Service Desk Support Network Operations (NetOps) Service Desk Integration (i.e., GSD and/or Mission Partner) OSS/JMN and Out of Band (OOB) management)

Contractor Determined / Government Approved Format
30 days after Acceptance of Preliminary Design Review
Distribution D
CUI
One Time; updated as required
Change Management Plan *
Contractor Determined / Government Approved Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
Incident Response Plan and Procedures *
Contractor Determined / Government Approved Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
Service Desk Strategy *
Contractor Determined Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
System Administrator Configuration Guides for SIPR *
Contractor Determined / Government Approved Format
15 days after Acceptance of Production Readiness Review
Distribution D

Distribution F

CUI
One Time; updated as required
Impact Assessment Report *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Implementation Status Report *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Implemented Cybersecurity Controls Checklist *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Cybersecurity Assessment Report *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Selected Security Control Assessment *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Issue Resolution/Remediation Report *
Contractor Determined / Government Approved Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Risk Acceptance Recommendation *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Continuous monitoring strategy/plan **/†
Government Determined Format
30 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
System Security Plan (SSP) **
Government Determined Format
30 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
Directory Replication Plan **
Contractor Determined Format
45 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
OCSP/CRL Integration Plan *
Contractor Determined Format
45 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
Provisioning / Authentication Assessment Documentation */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Privacy Impact Assessment */†
Government Determined Format
15 days after IdAM Integration
Distribution D
CUI
Yearly; as required
Privacy Threshold Analysis */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Residual Risk Statement */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Vulnerability Assessment */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Business Impact Analysis *
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Contingency Plan *
Contractor Determined / Government Approved Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Continuous Monitoring Test Plan */†
Contractor Determined / Government Approved Format
30 days after Acceptance of DoDIN Protection / Cybersecurity Assessment
Distribution D
CUI
One Time; updated as required
Cybersecurity Requirements Definition *
Government Determined Format
30 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Incident Response Plan and Procedures **
Contractor Determined / Government Approved Format
30 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Integration and Acceptance Testing(I/AT) *
Government Determined Format
60 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Recommended Production Configuration Changes **
Contractor Determined Format
15 days after Acceptance of Integration & Acceptance Testing (I/AT)
Distribution D

Distribution F

CUI
One Time; updated as required
Limited Fielding Implementation Plan *
Government Determined Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
One Time; updated as required
System & Configuration Definition (i.e. – “As Built”) *
Contractor Determined / Government Approved Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
Monthly; as required
Defect Tracking List *
Contractor Determined Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
Weekly; as required
Evergreen Strategy *
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D

Distribution F

CUI
One Time; updated as required
Usage Reports (by feature capability) *
Contractor Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D

Distribution F

CUI
Monthly; as required
Incident Reports *
Contractor Determined / Government Approved Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Weekly; as required
FISMA Reporting and Updates */†
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Yearly; as required
FEDRAMP Reporting and Updates */†
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Yearly; as required
[Insert Deliverable Title & Indicate level of responsibility based on ------]
[Identify Format Type that

Add rows as needed

Symbol:
Definition:
*
50% Government responsibility and 50% contractor responsibility
**
100% Contractor responsibility
†
These artifacts are built upon the packages submitted as part of the vendor's DoD PA

6.1 Task 3 – Denied, Disconnected, Intermittent, Limited Bandwidth (D-DIL) Environment The contractor shall provide a solution able to operate when disconnected from the main CSO that allows for continuity of operations while experiencing a Denied, Disconnected, Intermittent or Limited Bandwidth condition IAW section 5 and appendix A of the FRD.

In many cases, the full suite of DEOS services may not be required and in some cases the requirements may consist of a single function deployed as a standalone service (i.e., black-box, hardware, software, etc.) that may be the primary provider of the service for an extended period of time. The contractor shall plan for these variations in D-DIL service based on a per tenancy or standalone environments that are implemented.

6.1.1 Subtask 1 – D-DIL Prototype

Engineer, configure, and deploy a prototype for the D-DIL use cases in appendix A of the FRD for NIPRNet and SIPRNet environments. The prototype shall demonstrate the functionality and provide the ability to validate the technical feasibility for the D-DIL use cases. The prototype shall have all the functionality of the D-DIL product/solution and capable of supporting real-world scenarios.

6.1.2 Subtask 2 – NIPRNet D-DIL Environment

Engineer, configure and deploy a standalone, independently operable D-DIL solution that communicates with the NIPRNet CSO when connectivity is regained to synchronize data. D-DIL deployments may experience lower cloud service availability.

6.1.3 Subtask 3 – SIPRNet D-DIL Environment

Engineer, configure and deploy a standalone, independently operable D-DIL solution that communicates with the SIPRNet CSO when connectivity is regained to synchronize data. D-DIL deployments may experience lower cloud service availability.

6.1.4 Subtask 4 – D-DIL Software/Subscription Licenses

The contractor shall offer annual subscription licenses using a fixed fee for small, medium, and large user populations.

6.1.5 Subtask 5 – Infrastructure

The contractor shall offer a pricing model for the software, hardware and virtual infrastructure required to enable D-DIL instances for the following three scalability models: small D-DIL deployments consisting of less than 300 personnel; medium D-DIL deployments consisting of 300 -1,500 personnel; and large D-DIL deployments consisting of 1,500 - 6,000 personnel.

7. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.

[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]

Deliverable Name
Format
Due Date

(Notional)

Distribution
Classification
Frequency
Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) *
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
System Design Document **
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Interfaces, Ports & Protocols Baseline **
Contractor Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Service Support Functions and Integration Plan *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
D-DIL Architecture/ Integration Plan *
Government Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Performance Monitoring Strategy *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required
Security Architecture Analysis *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D

Distribution F

CUI
One Time; updated as required
Communication Plan *
Contractor Determined / Government Approved Format
30 days after Task Order Execution
Distribution D

Distribution F

CUI
One Time; updated as required
Migration Schedule *
Contractor Determined Format
30 days after Task Order Execution
Distribution D
CUI
One Time; updated as required

Service Management Plan ** (To Address: Access Management, Event Management, Incident Management, Request Fulfillment, Storefront Integration, Service Desk Support Network Operations (NetOps) Service Desk Integration (i.e., GSD and/or Mission Partner) OSS/JMN and Out of Band (OOB) management)

Contractor Determined / Government Approved Format
30 days after Acceptance of Preliminary Design Review
Distribution D
CUI
One Time; updated as required
Change Management Plan *
Contractor Determined / Government Approved Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
Incident Response Plan and Procedures *
Contractor Determined / Government Approved Format
30 days after Tenancy Review
Distribution D
CUI
One Time; updated as required
Service Desk Strategy *
Contractor Determined Format
30 days after Acceptance of Tenancy Review
Distribution D
CUI
One Time; updated as required
System Administrator Configuration Guides for NIPR/SIPR D-DIL Environments*
Contractor Determined / Government Approved Format
15 days after Acceptance of Production Readiness Review
Distribution D

Distribution F

CUI
One Time; updated as required
Impact Assessment Report *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Implementation Status Report *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Implemented Cybersecurity Controls Checklist *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Cybersecurity Assessment Report *
Government Determined Format
30 days after Production Readiness Review
Distribution D
CUI
One Time; updated as required
Selected Security Control Assessment *
Government Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Issue Resolution/Remediation Report *
Contractor Determined / Government Approved Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Risk Acceptance Recommendation *
Contractor Determined Format
30 days after Acceptance of Production Readiness Review
Distribution D
CUI
One Time; updated as required
Continuous monitoring strategy/plan **/†
Government Determined Format
30 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
System Security Plan (SSP) **
Government Determined Format
30 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
Directory Replication Plan **
Contractor Determined Format
45 days after Provisional Authorization
Distribution D
CUI
One Time; updated as required
OCSP/CRL Integration Plan *
Contractor Determined Format
45 days after Acceptance of Provisional Authorization
Distribution D
CUI
One Time; updated as required
Provisioning / Authentication Assessment Documentation */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Privacy Impact Assessment */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Privacy Threshold Analysis */†
Government Determined Format
15 days afte IdAM Integration
Distribution D
CUI
Yearly; as required
Residual Risk Statement */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Yearly; as required
Vulnerability Assessment */†
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Business Impact Analysis *
Government Determined Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Contingency Plan *
Contractor Determined / Government Approved Format
15 days after Acceptance of IdAM Integration
Distribution D
CUI
Monthly; as required
Continuous Monitoring Test Plan */†
Contractor Determined / Government Approved Format
30 days after Acceptance of DoDIN Protection / Cybersecurity Assessment
Distribution D
CUI
One Time; updated as required
Cybersecurity Requirements Definition *
Government Determined Format
30 days after Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Incident Response Plan and Procedures **
Contractor Determined / Government Approved Format
30 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Integration and Acceptance Testing (I/AT) *
Government Determined Format
60 days after Acceptance of Test Environment Planning and Assessment
Distribution D
CUI
One Time; updated as required
Recommended Production Configuration Changes **
Contractor Determined Format
15 days after Acceptance of Integration & Acceptance Testing (I/AT)
Distribution D

Distribution F

CUI
One Time; updated as required
Limited Fielding Implementation Plan *
Government Determined Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
One Time; updated as required
System & Configuration Definition (i.e. – “As Built”) *
Contractor Determined / Government Approved Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
Monthly; as required
Defect Tracking List *
Contractor Determined Format
45 days after Acceptance of Authority to Operate
Distribution D
CUI
Weekly; as required
Evergreen Strategy *
Government Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D

Distribution F

CUI
One Time; updated as required
Usage Reports (by feature capability) *
Contractor Determined Format
Ongoing after FOC Declaration until the end of the contract
Distribution D

Distribution F

CUI
Monthly; as required
Incident Reports *
Contractor Determined / Government Approved Format
Ongoing after FOC Declaration until the end of the contract
Distribution D
CUI
Weekly; as required
[Insert Deliverable Title & Indicate level of responsibility based on ------]
[Identify Format Type that

Add rows as needed

Symbol:
Definition:
*
50% Government responsibility and 50% contractor responsibility
**
100% Contractor responsibility
†
These artifacts are built upon the packages submitted as part of the vendor's DoD PA

7.1 Task 4 – User Tenancy Structure

The Government will allow flexibility and expects the contractor to propose a tenancy[footnoteRef:1] structure. As a result, the contractor shall propose an architecture, which meets the requirements of the FRD, and allows each Combatant Commands, Services and Agencies (CC/S/As) the ability to apply controls and restrictions for their users and data, site configuration, as well as user, feature, and functionality management to meet their mission needs. This includes the ability to grant/remove administrative privileges, user roles, and the ability to control license [1: A tenant is defined as a client or organization that owns and manages a specific instance of a cloud service. Each tenant is distinct and separate from other tenants in that it isolates customer data, prevents identity information from co-mingling (e.g., users and administrators of one tenant cannot accidentally or maliciously access data in another tenant) and has an account that provides unrestricted administrative access to features and functions of the instance.

assignment within the solution. The Government requires a tenancy structure to support approximately 3.15 million subscriber’s part of the DoD enterprise.

8. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.

[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]

Deliverable Title
Format
Due Date
Distribution
Classification Marking
Frequency
Tenancy Execution Plan **
Contractor Determined Format
30 days after Acceptance of Preliminary Design Review
Distribution D
CUI
One Time, updated as needed
Service Management Plan *
Contractor Determined Format
30 Calendar Days after Preliminary Design Review
Distribution D
CUI
One Time; Updated

annually as required

Multiple/Split Domain Management Approach *

Contractor Determined Format
30 Calendar Days after Preliminary Design Review
Distribution D
CUI
One Time; updated as required
Briefing Slides **
Government Determined Format
30 Calendar Days after TO Execution
Distribution D
CUI
Weekly, as required
[Insert Deliverable Title & Indicate level of responsibility based on ------]
[Identify Format Type that

Add rows as needed

Symbol:
Definition:
*
50% Government responsibility and 50% contractor responsibility
**
100% Contractor responsibility
†
These artifacts are built upon the packages submitted as part of the vendor's DoD PA

8.1 Task 5 – Subscription Licenses

The contractor shall propose a per-seat subscription-based pricing, and a corresponding licensing model in accordance with Table 9 – Notional Core Service User Tiers, which allows the Government to purchase or subscribe to the contractor CSO for a specific period and for a set price.

8.1.1 Subtask 1 – Core Services

The contractor shall provide a per subscription based licensing structure for the functionality outlined in Figure 1. The exact number of users within each licensing tier will be specified at the task order-level upon task order execution. In addition to Figure 1, the contractor shall reference the information presented in Table 9 – Notional Core Service User Tiers, to propose a licensing structure that maps to the CSO’s commercial licensing structure. Table 9 should be used as a reference only for the licensing structure the Government is requesting.

Table 9 – Notional Core Service User Tiers

Type of User
Features Breakdown
Types of Clients
Economy User
Messaging capabilities (i.e., email, calendar, contacts) to include required legal administrative functions associated with e-discovery and records retentions.
· Web Browser only
Basic User
All Economy User capabilities plus content management (i.e., web portal; file sharing storage and archive; index, search and filter; and workflows and orchestration) and productivity suite (i.e., word processor, spreadsheet, and presentation).
· Web Browser only
Business User
All Basic User capabilities plus collaboration (i.e., one-to-one instant message, presence, persistent group chat, web conferencing, white boarding, and desktop sharing) and native audio and video.
· Standalone/Thick

· Mobile App(s)

· Virtual Desktop

· Web Browser

Enterprise User
All Business User capabilities plus voice (i.e., business voice, business voice conferencing, voicemail, and unified messaging) and video (i.e., business video and business video conferencing).
· Standalone/Thick

· Mobile App (s)

· Virtual Desktop

· Web Browser

8.1.2 Subtask 2 – Drafting and Diagramming

The contractor shall provide a per user license for Drafting and Diagramming services that assist with the creation of diagrams, flow and organizational charts.

8.1.3 Subtask 3 – Project Management

The contractor shall provide a per user license for Project Management services that assist with assigning resources to tasks and tracking project progress.

8.1.4 Subtask 4 – Other Services/Add-Ons/Plug-Ins

In addition to the tiered user licensing structure identified for sub-task(s) 5.6.1, 5.6.2, and 5.6.3 the contractor shall independently indicate in Attachment 6 any additional service add-ons, plugins, licenses (e.g., Geographic information system) that can be purchased with the proposed CSO.

9. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.

[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]

Deliverable Title
Format
Due Date
Distribution
Classification Marking
Frequency
Software License Management Plan **
Contractor Determined Format
30 Calendar Days after TO Execution
Distribution D
CUI
One Time; Updated annually as required

Software License Reports **

Contractor Determined / Government Approved Format
Monthly, on 5th workday after TO

Execution

Distribution D
CUI
Monthly, or as required

Licensing & Subscription Structure **

Contractor Determined Format
30 Calendar Days after TO Execution
Distribution D

CUI

One Time; Updated annually as Required

Briefing Slides **
Contractor Determined Format
30 Calendar Days after TO Execution
Distribution D
CUI
Weekly, as required
[Insert Deliverable Title & Indicate level of responsibility based on ------]
[Identify Format Type that

Add rows as needed

Symbol:
Definition:
*
50% Government responsibility and 50% contractor responsibility
**
100% Contractor responsibility
†
These artifacts are built upon the packages submitted as part of the vendor's DoD PA

9.1 Task 6 – Additional Supporting Infrastructure, Integration Points, and Services The contractor shall be required to interoperate the proposed CSO with the following supporting infrastructure, integration points, and services based on user demand at the task order-level upon task order execution:

9.1.1 Subtask 1 – Enterprise Voice Over Internet Protocol (EVoIP)

The contractor shall leverage the SS backbone to interface the NIPRNet CSO to the DISA Enterprise Voice over IP (EVoIP) infrastructure, IAW the FRD section 7.1.3 and SOO section 5.6.7, Subtask 7 – Softswitch (SS) Backbone.

9.1.2 Subtask 2 – Enterprise Classified Voice over IP (ECVoIP) The contractor shall interoperate the SIPRNet CSO to ECVoIP Session Managers by establishing SIP trunks IAW the FRD section 7.1.4.

9.1.3 Subtask 3 – Mass Warning Notification

The contractor shall provide integration or interoperability with Service or Component mass warning notification systems IAW the FRD section 7.6.

9.1.4 Subtask 4 – Local Voice Survivability

The contractor shall provide continuity of voice services and local voice survivability when the B/P/C/S is severed from the DISN, IAW the FRD section 7.1.6

9.1.5 Subtask 5 – E-911

The contractor shall ensure E-911 calls originated from soft clients, can be routed to the Public Safety Answering Point (PSAP), or local B/P/C/S Emergency Response Centers (ERCs) IAW the FRD section 7.1.5.

Note: Specific E-911 services, such as national Private Switch-Automatic Location Information (PS ALI), local PS ALI (when offered), and location discovery capabilities, are expected to be provided through already established contract vehicles (e.g., Networx contract) outside of the DEOS contract.

9.1.6 Subtask 6 – Voice Over Secure IP (VoSIP)

The contractor shall interoperate the SIPRNet CSO to VoSIP Session Managers by establishing SIP trunks IAW the FRD section 7.1.7.

9.1.7 Subtask 7 – Softswitch (SS) Backbone

The contractor shall interoperate the NIPRNet CSO to the SS backbone by using one of the following methods:

· Configure a SIP Trunk to the Government provided SBCs, if the Government provided APL certified SBCs could translate DEOS CSO signaling traffic to AS-SIP.

· Provide an AS-SIP Gateway, to translate DEOS CSO proprietary based signaling traffic to AS-SIP.

In addition, the contractor shall support E.164 number routing, the DoD’s World-Wide Numbering & Dial Plan, and shall assign Defense Switched Network (DSN) and commercial phone numbers to subscribers/end instruments in accordance with the FRD section 7.1 and SOO section 5.6.7 Subtask 7 – Softswitch (SS) Backbone.

9.1.8 Subtask 8 – Voice Internet Service Provider (VISP) / Commercial Voice Networks (PSTN) The contractor shall leverage the SS backbone to interface the NIPRNet CSO to the DISA Voice Internet Service Provider (VISP), which provides Public Switched Telephone Network (PSTN) access to DoD IAW the FRD section 7.1.2 and SOO section 5.6.7 Subtask 7 – Softswitch (SS) Backbone.

9.1.9 Subtask 9 – Local Base/Post/Camp/Station Session Controllers The contractor shall interoperate the NIPRNet CSO to individual Local Session Controllers (LSCs) on an as needed basis per CC/S/A by establishing SIP trunks IAW the DEOS FRD section 7.1.8.

9.1.10 Subtask 10 – Unclassified Video Interoperability

The contractor shall interoperate the NIPRNet CSO to the SS backbone to enable video communications IAW the FRD section 7.2.1.

9.1.11 Subtask 11 – Classified Video Interoperability

The contractor shall interoperate the SIPRNet CSO to DISA ECVoIP Session Managers to enable video communications IAW the FRD section 7.2.2.

9.1.12 Subtask 12 – NIPR Local B/P/C/S Provided VTC Systems

The contractor shall interoperate the NIPRNet CSO to local base/post/camp/station provided VTC systems IAW the FRD section 7.2.3.

9.1.13 Subtask 13 – SIPR Local B/P/C/S Provided VTC Systems

The contractor shall interoperate the SIPRNet CSO to local base/post/camp/station provided VTC systems IAW the FRD section 7.2.3.

9.1.14 Subtask 14 – NIPR Global Content Directory Services (GCDS) The contractor shall leverage the GCDS to accelerate the delivery of NIPRNet CSO content and applications across the DoDIN IAW the FRD section 7.4.

9.1.15 Subtask 15 – SIPR Global Content Directory Services (GCDS) The contractor shall leverage the GCDS to accelerate the delivery of SIPRNet CSO content and applications across the DoDIN IAW the FRD section 7.4.

9.1.16 Subtask 16 – NIPR IM, Chat & Presence Federation

The contractor shall facilitate IM, Chat & Presence Federation of the NIPRNet CSO with external NIPR chat systems IAW the FRD section 7.5.

9.1.17 Subtask 17 – SIPR IM, Chat & Presence Federation

The contractor shall facilitate IM, Chat & Presence Federation of the SIPRNet CSO with external SIPRNet chat systems IAW the FRD section 7.5.

9.1.18 Subtask 18 – Records Management

Configure the CSO to support NARA requirements IAW DoDI 5015.02, and the FRD section 4.

9.1.19 Subtask 19 – Workflow

Configure the CSO to support declassification review, legal-related reviews, and approval processes IAW the FRD section 4.1.

9.1.20 Subtask 20 – Redaction

Configure the CSO to support Document Redaction IAW the FRD section 4.2.

9.1.21 Subtask 21 – Freedom of Information Act (FOIA)

Provide enhanced FOIA functionality as part of the enhanced Records Management capability provided by the CSO IAW the FRD section 4.3.

9.1.22 Subtask 22 – eDiscovery

Configure the CSO to support documentation-marking,…

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it.