Draft PWS Questions 11 March 2020.xlsx

XLSX spreadsheet 26 KB Posted Mar 11, 2020

Attached to: Global Force Management (GFM) Draft Performance Work Statement Questions & Answers Federal contract opportunity
Solicitation number: 621913301
Issued by: Defense Information Systems Agency

About this file

Written by GovTribe AI · Dec 30, 2023

This notice requests industry input on three draft performance work statements for the Global Force Management effort. The Defense Information Systems Agency intends to issue a solicitation during the second quarter of Fiscal Year 2020 for an Indefinite Delivery Indefinite Quantity contract with a $45 million ceiling. The requirement will be solicited under NAICS code 541512 for Computer Systems Design Services. Interested parties are encouraged to submit any questions or comments on the draft performance work statements by February 7, 2020 to improve the final version. Responses should reference notice number 621913301 and include "GFM" in the email subject line. The solicitation will include an industry day and code review opportunity.

View the file

Other files for this federal contract opportunity

Other files attached to Global Force Management (GFM) Draft Performance Work Statement Questions & Answers, newest first.
File	Type	Posted
JPES PWS TO1 23Jan2020.docx	DOCX document	Jan 24, 2020
JPES PWS Base 23Jan2020.docx	DOCX document	Jan 24, 2020
JPES PWS TO2 Development 23Jan2020.docx	DOCX document	Jan 24, 2020

On GovTribe

Work with this file on GovTribe

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1

#	Question/Comment/Suggestions	File	Page	Paragraph/Section	Answers
1	Can the Government provide the schedule of milestones/desired delivery dates for the final products for Task Order 001 (Develop the JPES Design and establish a DevSecOpns environment) and Task Order 002 (JPES Development)?	General			Looking for a Contractor provided solution and associated schedule. The Government estimates 3 months for TO1 Design and 9 months for TO2 Development. The Government anticipates an additional 9 month TO to complete the development and 3 month TO for Test and Evaluation to achieve Full Operational Capability.
2	We understand there are existing design documents and code from a previous effort that will be provided to the successful bidder. Can the Government affirm that this is usable data, or will the design and development efforts be a new start effort?	General			Yes, there is existing design documents and code from a previous effort. The usability of this shall be determined by the Contractor. Future design and development efforts may utilize existing code and/or design.
3	Will the Government consider an Industry Day and One-on-One meetings prior to the release of the final RFP?	General			The Government plans to hold an Industry Day and one-on-one code preview meetings, but they will occur after the release of final RFP.
4	Will the Government be releasing draft Section L an M prior to the release of the final RFP?				No, the Government will not be releasing a draft section L & M.
5	In regards to the upcoming DISA GFM contract, why is it not being released small business? At $45M over 5 years ($9M per year), that can easily be accomplished by a small business.	General			DISA conducted thorough market research and determined, in accordance with the governing regulation, that it is in the best interest of the Government to release the GFM requirement as full and open competition through Contract Opportunities. Small businesses will have the opportunity to participate as subcontractors for this requirement.
6	When will a Bidder’s Library containing the source code and GFI identified in Base PWS Para 12.2 be available for prospective offerors?	General			At Industry Day and Code Preview approximately 1-2 weeks after final RFP release.
7	Recommend the Govt consider structuring the task orders to perform the DevSecOps Standup under a single task order (TO1) and to perform the design and development of JPES under a separate task order (TO2). The DevSecOps standup work can be performed independently while the JPES design and development work is closely aligned.	General			TO1 and TO2 work was split based on severable tasks as well as schedule. Putting design in TO2 will require parallel execution of the TO's, this is not the Governments plan.
8	What’s the overarching schedule and schedule drivers? The JOPES sunset date is listed as Q1FY23 (Oct-Dec 2022) with the PoP for the two TOs as 12-months. When does the Govt anticipate award/start of performance?	General			Over-arching schedule driver is JOPES sunset date. Government anticipates award Q3FY20 and performance start Q4FY20.
9	Please clarify the Govt’s intent on the use of Waterfall or Agile software development methodologies. The design effort identifies Waterfall events such as PDR and CDR while also using Agile terms such as user story, sprints, and product owners. Is it the Govt’s intent that the JPES modernization be a hybrid of Waterfall and Agile methodologies?	General			The Government's intent is to utilize Agile software development methodologies. However, the Government needs confidence in the proposed design solution prior to committing to development efforts. TO1 which includes PDR and CDR is intended to provide that confidence and the foundational design, architecture and the agile execution approach.
10	What is the plan for sustainment of JOPES during the modernization (design and development) and transition to JPES? Is sustainment of JOPES within the scope of this effort during both TO1 and TO2?	General			The sustainment of JOPES is not within scope of this effort. The JPES modernization effort to include design, development, test and sustainment is separate from JOPES sustainment.
11	Regarding access to a SIPRNet test and integration environment, will the work require a SIPRNet connection at the contractor’s facility?	Base PWS	2	5	No, T&E work will NOT require a SIPRNet connection at the contractor's facility. All work requiring a SIPRNet connection will be performed at the Government's facility.
12	Recommend “Third-party software defects” clarify that the contractor is responsible for defects in third-party software provided by the contractor—and that the Govt is responsible for defects in any GFI/E provided software.	Base PWS	11	6.2.6	No. If there are any defects identified in GFI/E provided software the contractor will be responsible for correcting them.
13	Recommend deleting “immediate” from statement on notifying the Govt project owner of defects.	Base PWS	11	6.2.6	"Notification within 24 hours via automated DevSecOps tools." Will update PWS language.
14	Under “Modular Open Systems Approach” there is a requirement for components to “be of a size that supports competitive acquisition as well as reuse.” Is there further technical guidance on how to determine if this requirement is met?	Base PWS	20	6.4.1	To further elaborate, this requirement will not be met if a component is overly complex and unique, thus eliminating the possibility of re-use for another purpose.
15	Regarding Test Artifacts, is the Govt’s intent to have a TRR at the end of each Sprint?	Base PWS	22	6.5.1	Yes, but since we are doing DevSecOps this should be a very quick and short TRR based on the delta between the last sprint.
16	For unit test execution, there’s a requirement to demonstrate “sufficient” code and test coverage. Does the Govt have specific coverage requirements (e.g., XX% code coverage) to determine sufficiency?	Base PWS	22	6.5.2	While there is no hard number, generally industry does about 80% code coverage, this number should go down or up based on the quality of code being developed. For example, poor quality code may require 99% code coverage if there is not a lot of confidence in the actual code.
17	Response time testing across a network includes many variables that are beyond the software developer’s control. Please clarify if the contractor’s responsibilities for response time do not include network performance.	Base PWS	23	6.5.4	The developer will be responsible for response time within the network domain which the developer has control over. For example, the packet size and the ability to break up data and retransmit bad data is usually controlled by configurations that the developer has control over. This is the developer's responsibility.
18	Is the Gov’t intent to accept (i.e., verify requirements) software via a demonstration at the end of each Sprint?	Base PWS	24	6.5.5	No. The government will accept requirements during the government acceptance testing in the SIPR environment, this is part of the DevSecOps pipeline on the classified side.
19	Is it a requirement that all classified work must be done on-site in the DISA facilities on Ft Meade?	Base PWS	44	9	Yes
20	ID #9, the DevOps CONOPS is an important compliance document and will have significant bearing on the technical approach—when will this document be available?	Base PWS	50	12.2	DevSecOps CONOPS will be available at contract award. However, the Test & Evaluation Master Plan (TEMP) will be available at time of RFP and contains an overview of the DevSecOps CONOPS. Please reference section 2 of the TEMP for details regarding the DevSecOps CONOPS for use during proposal preparation.
21	ID #60, Is Confluence being used as a collaboration platform or portal (did not see it referenced elsewhere in the PWS)?	Base PWS	53	12.2	Currently confluence is being used. The government is open to changes and will require transition of information from the current confluence.
22	Recommend Govt consider changing the frequency of Status Reporting to every two weeks.	PWS TO1	3	6.1.3	It is important to have weekly status reporting, but the government is open to recommendations to reduce the scope.
23	Is the IMS developed and maintained in TO1 to include all work to sunset JOPES in Q1FY22? In other words, is the IMS is to include work beyond the scope of TO1?	PWS TO1	5	6.2.1	Yes
24	Given the Govt’s intent to use an Agile development methodology, recommend the Govt delete the requirement for EVMS. Specifically, the CPR submittals. If the Govt retains the EVMS requirement, recommend the submittal schedule be aligned with the end of Sprints rather than the calendar or accounting months.	PWS TO2	2	6.1.4	The government will retain EVMS requirements and will align to the end of sprints. The PWS will be updated.
25	Recommend Govt consider aligning the Status Report delivery with the end of each Sprint.	PWS TO2	3	6.1.5	See answer to question 22.
26	Will the government make the current code base available offline so we can thoroughly review it and analyze its current state? If the above is not possible, will the Government consider breaking the code review session into two events? In the first event, we request having five reviewers for four hours to investigate the code and architecture diagrams. We also request the Government to ensure that there are SMEs available for each component of the architecture to answer technical questions. We request the second event be scheduled a week later to provide adequate time to analyze findings and allow for follow-up questions to be asked about the JPES architecture design.	Draft PWS General			The current code base will be made available for in-person review. There will be two code review sessions lasting up to 8 hours each. The Government will not answer any questions during code review sessions. Code review sessions will be held after RFP release. Unsupervised access to code base will not be provided to any contractors prior to award.
27	To maximize the effectiveness of the upcoming code review, will it be possible for the government to provide us further architecture diagrams and a detailed listing of software components and their functions before the code review event?	Draft PWS General			Yes, during the pre-proposal conference after RFP release.
28	Will the Government consider providing a bidders library inclusive of: • architecture diagrams (Design materials, DoDAF views, IDD, etc.)

• detailed listing of software components and their functions

• current requirements backlog

• list of open defects

• list of open help desk tickets

• performance metrics and KPPs

• technical requirements (JC2 architecture, JIE implementation plan, etc.)

• existing incident management plan

Draft PWS General			Certain items will be provided in the bidder's library. Others will be available during the code review.
29	With GFM being a mission critical program, DISA will benefit from a partner that focuses upon quality processes, provide consistent quality monitoring, apply best practices and lessons-learned, and the development of frameworks for use across government client base. Will the government consider requiring CMMI Dev Level 5 certification from bidders to demonstrate the ability to provide high quality delivery for mission applications and systems.	Draft PWS General		The government will not require CMMI level 5 certification.
30	Because of the complex nature of the requirement and the criticality in executing the milestones with qualified resources, will the government consider adding key personnel: • Program Manager

• DevSecOps Engineering Lead

• Senior Information Security Engineer

• Senior Software Engineer

• Chief Architect

Draft PWS General			The government will provide key personnel requirements in the RFP.
31	To ensure that each offeror has demonstrated experience in successfully developing and sustaining a modernized software solution, will the Government consider requiring three past performance examples of similar size, scope, and complexity for the IDIQ, as a critical differentiator in modernized software solution, with one or more being IDIQ level enterprise software delivery management?	Draft PWS General			Past Performance will be considered as an evaluation factor for making an award determination. The importance and type of past performance that will be required will be detailed in sections L and M of the RFP.
32	The PWS specifies that all hosting environments will be provided by the government via milCloud or other government furnished facility. Is this referring to the milCloud 2 environment or the milCloud 1 environment?	Draft PWS General			This will be based on what is available and is in the best interest of the government at the time of award. It maybe a mix of milCloud or commercial cloud.
33	The latest DoD CIO memorandum for the fourth estate specifies that as all agencies should be moving to the cloud the first option is the General-Purpose JEDI environment. Is JEDI Microsoft Azure cloud environment one of the possible hosting environments?	Draft PWS General			Yes. Also, see answer to question number 32.
34	One of the DISA STIGs requires Role Based Access Control (RBAC) for any elevated privilege. milCloud 2 does not provide any RBAC and all users have full elevated privileges. Will this be a consideration in reviewing commercial cloud via JEDI as a possible hosting environment?	Draft PWS General			RBAC applies to the application not cloud access.
35	Will the government provided hosting environments also include the required security tools (i.e. HBSS, ACAS, Splunk, Firewalls, etc.) required by DISA STIGs? If utilizing a cloud environment, will it also provide the required Virtual Data Center Security Stack (VDSS) and Virtual Datacenter Managed Services (VDMS), required by the DISA Secure Cloud Computing Architecture (SCCA), or will the contractor be required to set that up?	Draft PWS General			The government will provide the required security tools (HBSS, ACAS, Firewalls, etc.) Details of additional tools will need to be worked between the government, the IA community and the vendor. The contractor will be required to configure and customize these tools to meet the government's needs.
36	Does the government intend to compete and award both TO’s at the same time?	Draft PWS General			Yes
37	Given the aggressive timelines associated with TO1 (approximately 3 months for approval of PDR, CDR, 60+ deliverables), we recommend that the evaluation criteria for the technical approach consider innovative techniques coupled with domain expertise as part of this solicitation.	Draft PWS General			Thank you for the recommendation. The government will take it under consideration. Final evaluation criteria will be documented in sections L & M of the final RFP.
38	Given the high complexity of developing a distributed system that meets the functional requirements and key performance parameters of JOPES and JCRM, will the evaluation criteria weight the technical approach as significantly more important than the cost factor?	Draft PWS General			The government plans to utilize best value trade off analysis. Details of evaluation criteria and their importance will be specified in section M of the RFP.
39	Will the government include Oral Presentations as part of this solicitation to ensure that offerors can explain and answer questions on our approach and solution?	Draft PWS General			No
40	The PWS specifies that it expects deliveries using Infrastructure as Code (IaC). Azure has Azure Resource Manager (ARM), which is the native IaC capability of JEDI but milCloud 2 does not have a native capability and other government furnished environments may only support certain tools. Is there a preferred IaC technology to integrate into the government provided hosting environment?	Draft PWS (Base)		6.1.7	The IaC technology utilized shall be portable across multiple cloud providers.
41	The PWS states that “the Contractor shall maintain a JPES First Look site”. Will the government provide the hardware and/or hosting for this environment or provide a plug ODC line for this?	Draft PWS (Base)		6.1.8	The Government will provide the hosting environment, the contractor will be responsible for installation, configuration and possibly licensing of the software. The government will provide a plug ODC number.
42	The PWS states "confirm the software solution can be installed, tested and sustained in the Government's unclassified and classified environment free of defects"…Is "free of defects" referring to complying with the standard of resolving Severity 1 and 2 defects with lower level defects moved to the backlog for potential assignment to a future release based on Government priority and team capacity consistent with standard Agile practices?	Draft PWS (Base)		6.2.6	The government understands that no software will ever be 100% defect free. In general, no severity 1 and 2 defects will be allowed, the lower severity defects shall be corrected based on the critically and needs that are negotiated between the government, the cybersecurity community, the test community, the user community and any other required stakeholders.
43	The PWS states "The test cases shall be completely written at the beginning of a sprint and the test scripts shall be delivered alongside source code. Both shall be submitted to the Government for verification."…. What is the timing and scope of the verification activities performed by the Government?	Draft PWS (Base)		6.5.5	Based on DevSecOps best practices validation will happen in multiple pipelines at least once after each sprint, in addition there will be third party test events to validate functionality and security.
44	The PWS states “Work hours for Tier 3 are 24x7. Could the government provide more specifics around this requirement, including: • historic volumes of Tier 3 support tickets

• is this 24x7 shift work? 24x7 on-call support?

Draft PWS (Base)		Section 9	Tier 3 is generally on call support only. There is no shift work required. Since this system is not yet operational, Tier 3 ticket history is not available. The frequency in general will be dependent on the quality of the software built and the accuracy and completeness of troubleshooting instructions provided to Tier 1 and Tier 2 support.
45	Does the government expect that the only instructor led training under Subtask 8 is the familiarization training described at the end of this section? (Note that there's more familiarization training in Subtask 9/6.1.9)?	Draft PWS (Base)		6.18	Familiarization training will be required under subtask 8 and 9. The training may include presentations, online videos, documents, etc. and is not limited to instructor led training only. In addition there might also be train the trainer training.
46	Will the government provide the referenced “DevSecOps CONOPS” so that we can ensure that our proposed pipeline meets the government requirements and expectations?	Draft PWS (TO 1)		6.2.6	Yes, at the time of RFP release.
47	Will the government clarify the difference in requirements for section 6.2.6 Operating in the Government DevSecOps Toolchain” between TO1 and TO2? The PWS text is largely duplicated, making it unclear what requirements are different across the task orders.	Draft PWS (TO 1 and TO 2)		6.2.6 Both TO's	In general for both task order 1 and 2 you will be operating in the same DevSecOps tool chain. The same rules and CONOPS will apply. Task order 1 is more focused on the initial stand-up of the DevSecOps tool chain and the pipeline while task order 2 is focused on further development of the pipeline to support the actual software development.
48	The PWS references “The Contractor shall document the resulting specific human factors design guidance in a UI/UX development guide”. However, the deliverables table at the end of the section does not contain a corresponding deliverable. Is this a contract deliverable, and what is the format/due date/frequency and remarks?	Draft PWS (TO 1)		6.3	This document is to ensure that UI/UX development is approved and standardized across the whole project even with different developers. This document will be utilized internally by the developer to standardize and guide UI/UX practices for the whole project.
49	The PWS references “As part of its Open System Management Plan...”. However, the deliverables table at the end of the section does not contain a corresponding deliverable. Is this a contract deliverable, and what is the format/due date/frequency and remarks?	Draft PWS (TO 1)		6.4.1	No separate deliverable is required. This shall be part of the software architecture and design documentation.
50	The list of deliverables has several that are due 30 days after award (RMF Security Control Report, System Security Plan, Security Control Required Documentation). Since key design decisions might not have yet been finalized, we recommend that the government modify the due date to be due at the CDR event.	Draft PWS (TO 1)		6.8	Draft version of these documents shall be due one week prior to the PDR event. These documents shall be updated accordingly for the CDR event. The due date will be updated in the TO1 PWS.
51	The “Due Date” in the deliverables table references “At CDR as scheduled in IMS”. Does the Government intend for the contractor to conduct additional CDR events as part of TO 2?	Draft PWS (TO 2)		6.3.1	Yes. Each Task Order will have PDR and CDR events that are to present the design of the follow-on task order.
52	“Location – The Contractor shall identify a specific methodology to facilitate scrum meetings (daily, planning and retrospectives) at the DISA headquarters complex in Fort Meade, MD, and other similar components of the agile methodology.” Does the Government expect to host the entire agile team at Ft Meade for the daily scrum, planning and retrospectives? Or is the Government expecting the contractor to be remote and provide a telecon/WebEx for participants to join remotely?	Draft PWS (TO 1 and TO 2)		6.4.1	Participation can be remote and does not require physical presence at Fort Meade, but the contractor shall ensure full participation in these meetings.
53	The PWS references “As part of its PDR/CDR/Delivery, the Contractor shall...”. Does the government expect the contractor to conduct PDR and CDR events as part of TO 2?	Draft PWS (TO 2)		6.4.1	See answer to question 51.
54	Is the Government open to using Commercial-Off-the-Shelf technologies (Components/Software) as part of the JPES system? An example would be adapting and integrating robust scheduling software components versus building scheduling software for JPES. This reduces the development and sustainment costs and increases the licensing cost. If the answer is yes, we suggest that the Government provide language that supports this approach.	General			Yes, see section 6.4.1 of PWS.
55	The Preliminary Design Review (PDR) and Critical Design Review (CDR) language across TO1 and TO2 may have some inconsistencies and may need clarification. For example, TO1 states, “PDR and CDR: Design JPES and conduct PDR and CDR. Following a successful CDR and with Government concurrence, Development will commence in Task Order Two (TO 0002).” The terms PDR/CDR has formal connotation of not changing the design. The TO2 states that there will be multiple PDR/CDR events.” Can the Government provide clarification on the intent in TO1 & TO2 with respect to system design and design changes?	General			See answer to question 51. Agile development allows for changes to the design based on issues and constraints found during development sprints, the goal of the PDR/CDR events is to ensure there is an initial design to start off with at the beginning of the development phase. Design changes shall be discussed and approved by the government.
56	For the TO1 PWS, Can the Government confirm that sections 6.4, 6.5, 6.6, and 6.7 and corresponding deliverables belong in TO1 since they relate to post-design activities and expected to be executed in TO2?	General			Those sections are still valid. For TO1 the focus of those sections is to initially set-up the DevSecOps environment, the pipelines and test and IA tool sets. For TO1 the vendor will need to ensure that the DevSecOps pipelines execute unit tests, functional tests, cybersecurity tests and automated deployment of the software. For TO2, the focus changes to the development of the actual application and DevSecOps activities to support development activities.
57	Suggest that the government offer relief relating the to the clearance requirements for off-site developers. We request that the government adjust the need for an active Secret clearance for all “off-site, non-lead technical personnel” to be an Interim Secret clearance; however, require that all “off-site, lead technical personnel” have active Secret clearance.	General			No
58	Can DITCO provide additional (detailed) requirements the contractors need to provide as part of the Development Environment.	Base PWS	6.2.6		The government does not understand the question. Please elaborate and give examples of what kind of information you are looking for.
59	Can DITCO illuminate what additional tasks (high level) would occupy the remaining 4 years of the PoP?	Base PWS	10		The remaining years would consist of follow-on development task orders similar to TO2. Additionally, towards the end operational and cyber test support, sustainment and support task order will come into play.
60	Should contractor teams presume the remaining 4 years of the PoP would be for post-SunDown sustainment of the JOPES environment?	Base PWS	10		Not all, but some of the remaining 4 years will be post JOPES sunset.
61	Does the Government expect to have JOPES replaced (Sundowned) by JPES at the conclusion of TO-2?	Draft PWS (TO 1)	3		The government expects to sunset JOPES 1QFY23.
62	Regarding the use and maintenance of multiple JPES environments (NIPR & SIPR), are both environments required to be identical or will they have different requirements?	Draft PWS (TO 1)	6.5		The goal is to have all environments mirror each other. Classified test and operational data and documentation of system vulnerabilities are restricted to the classified environment.
63	Will the Government consider a Period of Performance beyond 90-days?	Draft PWS (TO 1)	10		This is the best government estimate. Vendors are free to propose their own timeline.
64	Can the Government expand and illuminate on the 'end-state' of the 9-month TO-2?	Draft PWS (TO 2)	10		The end state of TO2 will be determined at the CDR of TO1.

File details come from the government source that posted it. Updated Mar 11, 2020.