The file's text, extracted by GovTribe without its formatting.
PERFORMANCE WORK STATEMENT (PWS)
as of [DD-MMM-YYYY]
| Contractor Name: |
| [Insert Company Name] |
| GSA Schedule Contract Number |
| [Insert Contract Number] |
[Fill-in guidance is presented in RED ITALIC with brackets borders. REMEMBER to delete all italicized text, contained within brackets herein when completing your PWS. It is shown here for instructional/informational purposes only and must not remain part of the final document/proposal submitted.]
1. Background The Department of Defense (DoD) requires an integrated enterprise cloud service offering (CSO) that provides common communication, collaboration, and productivity capabilities that are mission-effective, efficient, more widely accessible, and facilitate DoD operations worldwide. The Defense Information Systems Agency (DISA), in support of the DoD Deputy Secretary of Defense’s direction to accelerate the DoD’s adoption of cloud computing technology, plans to acquire and implement a seamlessly integrated, enterprise CSO as a replacement for disparate DoD legacy enterprise information technology (IT) services, such as voice, video, collaboration, email, content management, records management, and productivity suite.
2. Objectives DEOS will support the Department’s vision to move towards an integrated/interoperable communication, collaboration, and productivity service, by facilitating trusted information sharing between Combatant Commands, Services and Agencies (CC/S/As), and through the consolidation of multiple DoD enterprise services into a single environment. In addition, DEOS will unify and modernize legacy DISA IT enterprise services such as DoD Enterprise email (DEE), DoD Enterprise Portal Service (DEPS), Defense Collaboration Services (DCS), and other DoD-wide legacy capabilities.
The DEOS CSO will be acquired by DISA using an unrestricted, competitively awarded, single-award Firm-Fixed Price (FFP) Blanket Purchase Agreement (BPA) with a contractor who will provide a widely used/widely available, and non-developmental and fully integrated collaboration solution. The BPAperiod of performance will be a 5-year base ordering period and two 2 year option periods and one 1 year option period.. The BPAalso will include the 6-month extension of services authorized by FAR 52.217-8. The 10-year period of performance will provide the Department with the flexibility to transition users based on user demand, migration schedules, and legacy contracts or service end-of-life terms
3. Scope The DEOS CSO may scale to an anticipated 3.15 million DoD consumers, and over 4 million directory objects, which includes supporting DoD CC/S/As across many locations to include local base/post/camp/station (B/P/C/S), deployed and afloat organizations. DEOS is intended to be deployed on the Sensitive but Unclassified Internet Protocol (SBU IP) Data Network, also known as NIPRNet, and the Secret Internet Protocol (IP) Data, also known as SIPRNet, to include Denied, Disconnected, Intermittent, and Limited Bandwidth (D-DIL) environments.
The capabilities within the scope of the DEOS service are highlighted in Figure 1. The green boxes highlight the key DoD supporting infrastructure, services, and major integration points that will reside primarily on-premises as part of the Government’s responsibility. The Cloud Service Provider (CSP) will be responsible for ensuring interoperability and integration with these major service support functions and integration points. Additional requirements are outlined in section 6, and section 7 of the Functional Requirements Document (FRD) Attachment A.
Figure 1 – DEOS Service Requirements
The Government requires a multifaceted implementation and deployment approach for United States territories and possessions and locations outside of the United States territories and possessions for NIPRNet, SIPRNet, and D-DIL environments.
For NIPRNet and SIPRNet implementations in United States territories and possessions, the Government expects to leverage DoD approved commercially hosted facilities to meet the DEOS requirements. However, due to DoD data sovereignty requirements, the contractor must implement their NIPRNet and SIPRNet CSO within DoD data centers (e.g., Stuttgart, Wiesbaden, Capodichino) for locations outside of the United States territories and possessions.
For locations outside of the United States territories and possessions, the contractor must provide a standalone environment within a DoD data center. The solution must be self-contained and must include the required infrastructure, hardware, software, and auxiliary components required to implement, management, and maintain the CSO environment within the DoD data center. The Government expects the contractor to describe the details of their solution to include physical requirements (e.g., number of distributed DoD data centers), heating, ventilation, air condition (HVAC), per-rack power (e.g., single phase, 3-phase, amperage, voltage, etc.), floor space (e.g., rack and total square footage), bandwidth (in total Mbps/Gbps), physical security/separation, physical access, remote management, and networking (e.g., IP addressing, subnets, routing) requirements.
4. Performance Requirements The contractor shall propose performance tasks that fully adhere to the requirements of the solicitation and the DEOS FRD (Attachment A) so that DEOS is available to end users. The contractor will perform all necessary activities as well as provide the required documentation association to achieve and maintain the necessary DEOS Authorization to Operate (ATO) decisions as a national security system on the DoDIN, utilizing the Performance Work Statement (PWS) format (Attachment C) provided as part of this solicitation.
4.1 Task 1 – NIPRNet Environment
The contractor shall deliver a CSO that enables collaboration across the DoD enterprise. The NIPRNet CSO shall include System Wide, Core Services (i.e., email, IM/chat, web conferencing, native audio, native video, content management, and productivity suite), and DoD Information Network (DoDIN) Protection requirements in accordance with (IAW) the FRD sections 1, 2, and 3 having a network category of “Both” or “NIPR”.
Furthermore, the contractor shall be required to interface the CSO to the core integration points identified in the FRD section 6. Lastly, the contractor shall adhere to the performance objectives identified in the FRD section 8, and shall be required to perform testing activities/events (i.e., integration, acceptance, operational) IAW the FRD section 9, to verify the proper interoperability between the CSO and core integration points (FRD section 6).
4.1.1 Subtask 1 – United States Territories and Possessions
Provide a geographically dispersed off-premises CSO within a DoD private/community hybrid cloud that meets Impact Level 5 requirements IAW the DoD CCSRG and the FRD.
4.1.2 Subtask 2 – Locations outside of the United States Territories and Possessions Provide a geographically dispersed DoD private/community Cloud Service Offering (CSO) that is deployed in an DoD facility using an on-premises deployment model that meets Impact Level 5 in accordance with the DoD CC SRG and FRD.
5. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.
[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]
| Deliverable Name |
| Format |
| Due Date |
(Notional)
| Distribution |
| Classification |
| Frequency |
| Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) * |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Design Document ** |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Interfaces, Ports & Protocols Baseline ** |
| Contractor Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Service Support Functions and Integration Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Performance Monitoring Strategy * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Security Architecture Analysis * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Communication Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Migration Schedule * |
| Contractor Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
Service Management Plan ** (To Address: Access Management, Event Management, Incident Management, Request Fulfillment, Storefront Integration, Service Desk Support Network Operations (NetOps) Service Desk Integration (i.e., GSD and/or Mission Partner) OSS/JMN and Out of Band (OOB) management)
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Preliminary Design Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Change Management Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Incident Response Plan and Procedures * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Service Desk Strategy * |
| Contractor Determined Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Administrator Configuration Guides for NIPR * |
| Contractor Determined / Government Approved Format |
| 15 days after Acceptance of Production Readiness Review |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Impact Assessment Report * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Implementation Status Report * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Implemented Cybersecurity Controls Checklist * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Cybersecurity Assessment Report * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Selected Security Control Assessment * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Issue Resolution/Remediation Report * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Risk Acceptance Recommendation * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Continuous monitoring strategy/plan **/† |
| Government Determined Format |
| 30 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Security Plan (SSP) ** |
| Government Determined Format |
| 30 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| Directory Replication Plan ** |
| Contractor Determined Format |
| 45 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| OCSP/CRL Integration Plan * |
| Contractor Determined Format |
| 45 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| Provisioning / Authentication Assessment Documentation */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Privacy Impact Assessment */† |
| Government Determined Format |
| 15 days after IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Privacy Threshold Analysis */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Residual Risk Statement */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Vulnerability Assessment */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Business Impact Analysis * |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Contingency Plan * |
| Contractor Determined / Government Approved Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Continuous Monitoring Test Plan */† |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of DoDIN Protection / Cybersecurity Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Cybersecurity Requirements Definition * |
| Government Determined Format |
| 30 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Incident Response Plan and Procedures ** |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Integration and Acceptance Testing(I/AT) * |
| Government Determined Format |
| 60 days after Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Recommended Production Configuration Changes ** |
| Contractor Determined Format |
| 15 days after Integration & Acceptance Testing (I/AT) |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Limited Fielding Implementation Plan * |
| Government Determined Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| One Time; updated as required |
| System & Configuration Definition (i.e. – “As Built”) * |
| Contractor Determined / Government Approved Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| Monthly; as required |
| Defect Tracking List * |
| Contractor Determined Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| Weekly; as required |
| Evergreen Strategy * |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Usage Reports (by feature capability) * |
| Contractor Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
Distribution F
| Incident Reports * |
| Contractor Determined / Government Approved Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Weekly; as required |
| FISMA Reporting and Updates */† |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Yearly; as required |
| FEDRAMP Reporting and Updates */† |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Yearly; as required |
Add rows as needed
[Insert Deliverable Title & Indicate level of responsibility based on ------]
[Identify Format Type that w
| [Insert distribution in accordance with DoDM 5200.01 Vol 4 and DoDM 5230.24] |
| [Insert classification marking in accordance with DoDM 5200.01 Vol4 DoDM 5230.24] |
| [ |
| * |
| 50% Government responsibility and 50% contractor responsibility |
| ** |
| 100% Contractor responsibility |
| † |
| These artifacts are built upon the packages submitted as part of the vendor's DoD PA |
5.1 Task 2 – SIPRNet Environment
The contractor shall deliver a CSO that enables collaboration across the DoD enterprise. The SIPRNet CSO shall include System Wide, Core Services (i.e., email, IM/chat, web conferencing, native audio, native video, content management, and productivity suite), and DoDIN Protection requirements IAW the FRD sections 1, 2, and 3, having a network category of “Both” or “SIPR”. Furthermore, the contractor shall be required to interface the CSO to the core integration points identified in the FRD section 6. Lastly, the contractor shall adhere to the performance objectives identified in the FRD section 8, and shall be required to perform testing activities/events (i.e., integration, acceptance, operational) IAW the FRD section 9, to verify the proper interoperability between the CSO and core integration points (FRD section 6).
5.1.1 Subtask 1 – United States Territories and Possessions
Provide geographically dispersed off-premises CSO within a DoD private/community cloud that meets Impact Level 6 requirements in accordance with the DoD CC SRG and the FRD.
5.1.2 Subtask 2 – Locations outside of the United States Territories and Possessions Provide a geographically dispersed DoD private/community CSO that is deployed in DoD facilities using an on-premises deployment model that meets Impact Level 6 in accordance with the DoD CC SRG and FRD.
6. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.
[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]
| Deliverable Name |
| Format |
| Due Date |
(Notional)
| Distribution |
| Classification |
| Frequency |
| Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) * |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Design Document ** |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Interfaces, Ports & Protocols Baseline ** |
| Contractor Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Service Support Functions and Integration Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Performance Monitoring Strategy * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Security Architecture Analysis * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Communication Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Migration Schedule * |
| Contractor Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
Service Management Plan ** (To Address: Access Management, Event Management, Incident Management, Request Fulfillment, Storefront Integration, Service Desk Support Network Operations (NetOps) Service Desk Integration (i.e., GSD and/or Mission Partner) OSS/JMN and Out of Band (OOB) management)
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Preliminary Design Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Change Management Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Incident Response Plan and Procedures * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Service Desk Strategy * |
| Contractor Determined Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Administrator Configuration Guides for SIPR * |
| Contractor Determined / Government Approved Format |
| 15 days after Acceptance of Production Readiness Review |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Impact Assessment Report * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Implementation Status Report * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Implemented Cybersecurity Controls Checklist * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Cybersecurity Assessment Report * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Selected Security Control Assessment * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Issue Resolution/Remediation Report * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Risk Acceptance Recommendation * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Continuous monitoring strategy/plan **/† |
| Government Determined Format |
| 30 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Security Plan (SSP) ** |
| Government Determined Format |
| 30 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| Directory Replication Plan ** |
| Contractor Determined Format |
| 45 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| OCSP/CRL Integration Plan * |
| Contractor Determined Format |
| 45 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| Provisioning / Authentication Assessment Documentation */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Privacy Impact Assessment */† |
| Government Determined Format |
| 15 days after IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Privacy Threshold Analysis */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Residual Risk Statement */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Vulnerability Assessment */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Business Impact Analysis * |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Contingency Plan * |
| Contractor Determined / Government Approved Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Continuous Monitoring Test Plan */† |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of DoDIN Protection / Cybersecurity Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Cybersecurity Requirements Definition * |
| Government Determined Format |
| 30 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Incident Response Plan and Procedures ** |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Integration and Acceptance Testing(I/AT) * |
| Government Determined Format |
| 60 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Recommended Production Configuration Changes ** |
| Contractor Determined Format |
| 15 days after Acceptance of Integration & Acceptance Testing (I/AT) |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Limited Fielding Implementation Plan * |
| Government Determined Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| One Time; updated as required |
| System & Configuration Definition (i.e. – “As Built”) * |
| Contractor Determined / Government Approved Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| Monthly; as required |
| Defect Tracking List * |
| Contractor Determined Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| Weekly; as required |
| Evergreen Strategy * |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Usage Reports (by feature capability) * |
| Contractor Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
Distribution F
| Incident Reports * |
| Contractor Determined / Government Approved Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Weekly; as required |
| FISMA Reporting and Updates */† |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Yearly; as required |
| FEDRAMP Reporting and Updates */† |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Yearly; as required |
| [Insert Deliverable Title & Indicate level of responsibility based on ------] |
| [Identify Format Type that |
Add rows as needed
| * |
| 50% Government responsibility and 50% contractor responsibility |
| ** |
| 100% Contractor responsibility |
| † |
| These artifacts are built upon the packages submitted as part of the vendor's DoD PA |
6.1 Task 3 – Denied, Disconnected, Intermittent, Limited Bandwidth (D-DIL) Environment The contractor shall provide a solution able to operate when disconnected from the main CSO that allows for continuity of operations while experiencing a Denied, Disconnected, Intermittent or Limited Bandwidth condition IAW section 5 and appendix A of the FRD.
In many cases, the full suite of DEOS services may not be required and in some cases the requirements may consist of a single function deployed as a standalone service (i.e., black-box, hardware, software, etc.) that may be the primary provider of the service for an extended period of time. The contractor shall plan for these variations in D-DIL service based on a per tenancy or standalone environments that are implemented.
6.1.1 Subtask 1 – D-DIL Prototype
Engineer, configure, and deploy a prototype for the D-DIL use cases in appendix A of the FRD for NIPRNet and SIPRNet environments. The prototype shall demonstrate the functionality and provide the ability to validate the technical feasibility for the D-DIL use cases. The prototype shall have all the functionality of the D-DIL product/solution and capable of supporting real-world scenarios.
6.1.2 Subtask 2 – NIPRNet D-DIL Environment
Engineer, configure and deploy a standalone, independently operable D-DIL solution that communicates with the NIPRNet CSO when connectivity is regained to synchronize data. D-DIL deployments may experience lower cloud service availability.
6.1.3 Subtask 3 – SIPRNet D-DIL Environment
Engineer, configure and deploy a standalone, independently operable D-DIL solution that communicates with the SIPRNet CSO when connectivity is regained to synchronize data. D-DIL deployments may experience lower cloud service availability.
6.1.4 Subtask 4 – D-DIL Software/Subscription Licenses
The contractor shall offer annual subscription licenses using a fixed fee for small, medium, and large user populations.
6.1.5 Subtask 5 – Infrastructure
The contractor shall offer a pricing model for the software, hardware and virtual infrastructure required to enable D-DIL instances for the following three scalability models: small D-DIL deployments consisting of less than 300 personnel; medium D-DIL deployments consisting of 300 -1,500 personnel; and large D-DIL deployments consisting of 1,500 - 6,000 personnel.
7. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.
[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]
| Deliverable Name |
| Format |
| Due Date |
(Notional)
| Distribution |
| Classification |
| Frequency |
| Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) * |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Design Document ** |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Interfaces, Ports & Protocols Baseline ** |
| Contractor Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Service Support Functions and Integration Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| D-DIL Architecture/ Integration Plan * |
| Government Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Performance Monitoring Strategy * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
| Security Architecture Analysis * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Communication Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Task Order Execution |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Migration Schedule * |
| Contractor Determined Format |
| 30 days after Task Order Execution |
| Distribution D |
| CUI |
| One Time; updated as required |
Service Management Plan ** (To Address: Access Management, Event Management, Incident Management, Request Fulfillment, Storefront Integration, Service Desk Support Network Operations (NetOps) Service Desk Integration (i.e., GSD and/or Mission Partner) OSS/JMN and Out of Band (OOB) management)
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Preliminary Design Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Change Management Plan * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Incident Response Plan and Procedures * |
| Contractor Determined / Government Approved Format |
| 30 days after Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Service Desk Strategy * |
| Contractor Determined Format |
| 30 days after Acceptance of Tenancy Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Administrator Configuration Guides for NIPR/SIPR D-DIL Environments* |
| Contractor Determined / Government Approved Format |
| 15 days after Acceptance of Production Readiness Review |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Impact Assessment Report * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Implementation Status Report * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Implemented Cybersecurity Controls Checklist * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Cybersecurity Assessment Report * |
| Government Determined Format |
| 30 days after Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Selected Security Control Assessment * |
| Government Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Issue Resolution/Remediation Report * |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Risk Acceptance Recommendation * |
| Contractor Determined Format |
| 30 days after Acceptance of Production Readiness Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Continuous monitoring strategy/plan **/† |
| Government Determined Format |
| 30 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| System Security Plan (SSP) ** |
| Government Determined Format |
| 30 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| Directory Replication Plan ** |
| Contractor Determined Format |
| 45 days after Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| OCSP/CRL Integration Plan * |
| Contractor Determined Format |
| 45 days after Acceptance of Provisional Authorization |
| Distribution D |
| CUI |
| One Time; updated as required |
| Provisioning / Authentication Assessment Documentation */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Privacy Impact Assessment */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Privacy Threshold Analysis */† |
| Government Determined Format |
| 15 days afte IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Residual Risk Statement */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Yearly; as required |
| Vulnerability Assessment */† |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Business Impact Analysis * |
| Government Determined Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Contingency Plan * |
| Contractor Determined / Government Approved Format |
| 15 days after Acceptance of IdAM Integration |
| Distribution D |
| CUI |
| Monthly; as required |
| Continuous Monitoring Test Plan */† |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of DoDIN Protection / Cybersecurity Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Cybersecurity Requirements Definition * |
| Government Determined Format |
| 30 days after Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Incident Response Plan and Procedures ** |
| Contractor Determined / Government Approved Format |
| 30 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Integration and Acceptance Testing (I/AT) * |
| Government Determined Format |
| 60 days after Acceptance of Test Environment Planning and Assessment |
| Distribution D |
| CUI |
| One Time; updated as required |
| Recommended Production Configuration Changes ** |
| Contractor Determined Format |
| 15 days after Acceptance of Integration & Acceptance Testing (I/AT) |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Limited Fielding Implementation Plan * |
| Government Determined Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| One Time; updated as required |
| System & Configuration Definition (i.e. – “As Built”) * |
| Contractor Determined / Government Approved Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| Monthly; as required |
| Defect Tracking List * |
| Contractor Determined Format |
| 45 days after Acceptance of Authority to Operate |
| Distribution D |
| CUI |
| Weekly; as required |
| Evergreen Strategy * |
| Government Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
Distribution F
| CUI |
| One Time; updated as required |
| Usage Reports (by feature capability) * |
| Contractor Determined Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
Distribution F
| Incident Reports * |
| Contractor Determined / Government Approved Format |
| Ongoing after FOC Declaration until the end of the contract |
| Distribution D |
| CUI |
| Weekly; as required |
| [Insert Deliverable Title & Indicate level of responsibility based on ------] |
| [Identify Format Type that |
Add rows as needed
| * |
| 50% Government responsibility and 50% contractor responsibility |
| ** |
| 100% Contractor responsibility |
| † |
| These artifacts are built upon the packages submitted as part of the vendor's DoD PA |
7.1 Task 4 – User Tenancy Structure
The Government will allow flexibility and expects the contractor to propose a tenancy[footnoteRef:1] structure. As a result, the contractor shall propose an architecture, which meets the requirements of the FRD, and allows each Combatant Commands, Services and Agencies (CC/S/As) the ability to apply controls and restrictions for their users and data, site configuration, as well as user, feature, and functionality management to meet their mission needs. This includes the ability to grant/remove administrative privileges, user roles, and the ability to control license [1: A tenant is defined as a client or organization that owns and manages a specific instance of a cloud service. Each tenant is distinct and separate from other tenants in that it isolates customer data, prevents identity information from co-mingling (e.g., users and administrators of one tenant cannot accidentally or maliciously access data in another tenant) and has an account that provides unrestricted administrative access to features and functions of the instance.
assignment within the solution. The Government requires a tenancy structure to support approximately 3.15 million subscriber’s part of the DoD enterprise.
8. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.
[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]
| Deliverable Title |
| Format |
| Due Date |
| Distribution |
| Classification Marking |
| Frequency |
| Tenancy Execution Plan ** |
| Contractor Determined Format |
| 30 days after Acceptance of Preliminary Design Review |
| Distribution D |
| CUI |
| One Time, updated as needed |
| Service Management Plan * |
| Contractor Determined Format |
| 30 Calendar Days after Preliminary Design Review |
| Distribution D |
| CUI |
| One Time; Updated |
annually as required
Multiple/Split Domain Management Approach *
| Contractor Determined Format |
| 30 Calendar Days after Preliminary Design Review |
| Distribution D |
| CUI |
| One Time; updated as required |
| Briefing Slides ** |
| Government Determined Format |
| 30 Calendar Days after TO Execution |
| Distribution D |
| CUI |
| Weekly, as required |
| [Insert Deliverable Title & Indicate level of responsibility based on ------] |
| [Identify Format Type that |
Add rows as needed
| * |
| 50% Government responsibility and 50% contractor responsibility |
| ** |
| 100% Contractor responsibility |
| † |
| These artifacts are built upon the packages submitted as part of the vendor's DoD PA |
8.1 Task 5 – Subscription Licenses
The contractor shall propose a per-seat subscription-based pricing, and a corresponding licensing model in accordance with Table 9 – Notional Core Service User Tiers, which allows the Government to purchase or subscribe to the contractor CSO for a specific period and for a set price.
8.1.1 Subtask 1 – Core Services
The contractor shall provide a per subscription based licensing structure for the functionality outlined in Figure 1. The exact number of users within each licensing tier will be specified at the task order-level upon task order execution. In addition to Figure 1, the contractor shall reference the information presented in Table 9 – Notional Core Service User Tiers, to propose a licensing structure that maps to the CSO’s commercial licensing structure. Table 9 should be used as a reference only for the licensing structure the Government is requesting.
Table 9 – Notional Core Service User Tiers
| Type of User |
| Features Breakdown |
| Types of Clients |
| Economy User |
| Messaging capabilities (i.e., email, calendar, contacts) to include required legal administrative functions associated with e-discovery and records retentions. |
| · Web Browser only |
| Basic User |
| All Economy User capabilities plus content management (i.e., web portal; file sharing storage and archive; index, search and filter; and workflows and orchestration) and productivity suite (i.e., word processor, spreadsheet, and presentation). |
| · Web Browser only |
| Business User |
| All Basic User capabilities plus collaboration (i.e., one-to-one instant message, presence, persistent group chat, web conferencing, white boarding, and desktop sharing) and native audio and video. |
| · Standalone/Thick |
· Mobile App(s)
· Virtual Desktop
· Web Browser
| Enterprise User |
| All Business User capabilities plus voice (i.e., business voice, business voice conferencing, voicemail, and unified messaging) and video (i.e., business video and business video conferencing). |
| · Standalone/Thick |
· Mobile App (s)
· Virtual Desktop
· Web Browser
8.1.2 Subtask 2 – Drafting and Diagramming
The contractor shall provide a per user license for Drafting and Diagramming services that assist with the creation of diagrams, flow and organizational charts.
8.1.3 Subtask 3 – Project Management
The contractor shall provide a per user license for Project Management services that assist with assigning resources to tasks and tracking project progress.
8.1.4 Subtask 4 – Other Services/Add-Ons/Plug-Ins
In addition to the tiered user licensing structure identified for sub-task(s) 5.6.1, 5.6.2, and 5.6.3 the contractor shall independently indicate in Attachment 6 any additional service add-ons, plugins, licenses (e.g., Geographic information system) that can be purchased with the proposed CSO.
9. Deliverables The Government shall require the following documents as key deliverables for this task and sub-tasks. All deliverables listed below correspond with the key program milestones, activates, and deliverables listed in Attachment D. Any additional deliverables (i.e. not indicated below or in attachment D) maybe required by the Government based on the proposed technical/management approach and will be included at task order execution.
[The contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required for this task and sub-tasks as applicable. Any additional deliverables included within the table below should also be included in key program milestone, activities, and deliverables list Attachment D]
| Deliverable Title |
| Format |
| Due Date |
| Distribution |
| Classification Marking |
| Frequency |
| Software License Management Plan ** |
| Contractor Determined Format |
| 30 Calendar Days after TO Execution |
| Distribution D |
| CUI |
| One Time; Updated annually as required |
Software License Reports **
| Contractor Determined / Government Approved Format |
| Monthly, on 5th workday after TO |
Execution
| Distribution D |
| CUI |
| Monthly, or as required |
Licensing & Subscription Structure **
| Contractor Determined Format |
| 30 Calendar Days after TO Execution |
| Distribution D |
CUI
One Time; Updated annually as Required
| Briefing Slides ** |
| Contractor Determined Format |
| 30 Calendar Days after TO Execution |
| Distribution D |
| CUI |
| Weekly, as required |
| [Insert Deliverable Title & Indicate level of responsibility based on ------] |
| [Identify Format Type that |
Add rows as needed
| * |
| 50% Government responsibility and 50% contractor responsibility |
| ** |
| 100% Contractor responsibility |
| † |
| These artifacts are built upon the packages submitted as part of the vendor's DoD PA |
9.1 Task 6 – Additional Supporting Infrastructure, Integration Points, and Services The contractor shall be required to interoperate the proposed CSO with the following supporting infrastructure, integration points, and services based on user demand at the task order-level upon task order execution:
9.1.1 Subtask 1 – Enterprise Voice Over Internet Protocol (EVoIP)
The contractor shall leverage the SS backbone to interface the NIPRNet CSO to the DISA Enterprise Voice over IP (EVoIP) infrastructure, IAW the FRD section 7.1.3 and SOO section 5.6.7, Subtask 7 – Softswitch (SS) Backbone.
9.1.2 Subtask 2 – Enterprise Classified Voice over IP (ECVoIP) The contractor shall interoperate the SIPRNet CSO to ECVoIP Session Managers by establishing SIP trunks IAW the FRD section 7.1.4.
9.1.3 Subtask 3 – Mass Warning Notification
The contractor shall provide integration or interoperability with Service or Component mass warning notification systems IAW the FRD section 7.6.
9.1.4 Subtask 4 – Local Voice Survivability
The contractor shall provide continuity of voice services and local voice survivability when the B/P/C/S is severed from the DISN, IAW the FRD section 7.1.6
9.1.5 Subtask 5 – E-911
The contractor shall ensure E-911 calls originated from soft clients, can be routed to the Public Safety Answering Point (PSAP), or local B/P/C/S Emergency Response Centers (ERCs) IAW the FRD section 7.1.5.
Note: Specific E-911 services, such as national Private Switch-Automatic Location Information (PS ALI), local PS ALI (when offered), and location discovery capabilities, are expected to be provided through already established contract vehicles (e.g., Networx contract) outside of the DEOS contract.
9.1.6 Subtask 6 – Voice Over Secure IP (VoSIP)
The contractor shall interoperate the SIPRNet CSO to VoSIP Session Managers by establishing SIP trunks IAW the FRD section 7.1.7.
9.1.7 Subtask 7 – Softswitch (SS) Backbone
The contractor shall interoperate the NIPRNet CSO to the SS backbone by using one of the following methods:
· Configure a SIP Trunk to the Government provided SBCs, if the Government provided APL certified SBCs could translate DEOS CSO signaling traffic to AS-SIP.
· Provide an AS-SIP Gateway, to translate DEOS CSO proprietary based signaling traffic to AS-SIP.
In addition, the contractor shall support E.164 number routing, the DoD’s World-Wide Numbering & Dial Plan, and shall assign Defense Switched Network (DSN) and commercial phone numbers to subscribers/end instruments in accordance with the FRD section 7.1 and SOO section 5.6.7 Subtask 7 – Softswitch (SS) Backbone.
9.1.8 Subtask 8 – Voice Internet Service Provider (VISP) / Commercial Voice Networks (PSTN) The contractor shall leverage the SS backbone to interface the NIPRNet CSO to the DISA Voice Internet Service Provider (VISP), which provides Public Switched Telephone Network (PSTN) access to DoD IAW the FRD section 7.1.2 and SOO section 5.6.7 Subtask 7 – Softswitch (SS) Backbone.
9.1.9 Subtask 9 – Local Base/Post/Camp/Station Session Controllers The contractor shall interoperate the NIPRNet CSO to individual Local Session Controllers (LSCs) on an as needed basis per CC/S/A by establishing SIP trunks IAW the DEOS FRD section 7.1.8.
9.1.10 Subtask 10 – Unclassified Video Interoperability
The contractor shall interoperate the NIPRNet CSO to the SS backbone to enable video communications IAW the FRD section 7.2.1.
9.1.11 Subtask 11 – Classified Video Interoperability
The contractor shall interoperate the SIPRNet CSO to DISA ECVoIP Session Managers to enable video communications IAW the FRD section 7.2.2.
9.1.12 Subtask 12 – NIPR Local B/P/C/S Provided VTC Systems
The contractor shall interoperate the NIPRNet CSO to local base/post/camp/station provided VTC systems IAW the FRD section 7.2.3.
9.1.13 Subtask 13 – SIPR Local B/P/C/S Provided VTC Systems
The contractor shall interoperate the SIPRNet CSO to local base/post/camp/station provided VTC systems IAW the FRD section 7.2.3.
9.1.14 Subtask 14 – NIPR Global Content Directory Services (GCDS) The contractor shall leverage the GCDS to accelerate the delivery of NIPRNet CSO content and applications across the DoDIN IAW the FRD section 7.4.
9.1.15 Subtask 15 – SIPR Global Content Directory Services (GCDS) The contractor shall leverage the GCDS to accelerate the delivery of SIPRNet CSO content and applications across the DoDIN IAW the FRD section 7.4.
9.1.16 Subtask 16 – NIPR IM, Chat & Presence Federation
The contractor shall facilitate IM, Chat & Presence Federation of the NIPRNet CSO with external NIPR chat systems IAW the FRD section 7.5.
9.1.17 Subtask 17 – SIPR IM, Chat & Presence Federation
The contractor shall facilitate IM, Chat & Presence Federation of the SIPRNet CSO with external SIPRNet chat systems IAW the FRD section 7.5.
9.1.18 Subtask 18 – Records Management
Configure the CSO to support NARA requirements IAW DoDI 5015.02, and the FRD section 4.
9.1.19 Subtask 19 – Workflow
Configure the CSO to support declassification review, legal-related reviews, and approval processes IAW the FRD section 4.1.
9.1.20 Subtask 20 – Redaction
Configure the CSO to support Document Redaction IAW the FRD section 4.2.
9.1.21 Subtask 21 – Freedom of Information Act (FOIA)
Provide enhanced FOIA functionality as part of the enhanced Records Management capability provided by the CSO IAW the FRD section 4.3.
9.1.22 Subtask 22 – eDiscovery
Configure the CSO to support documentation-marking,…
This is the start of the file's text. The full file is on GovTribe.