Industry Day - CyPrESS April 19 2021.pdf

www.nasa.gov

The cornerstone of NASA’s current and future missions

NASA Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS) Industry Day

April 19, 2021

T h e c o r n e r s t o n e o f N A S A ’ s c u r r e n t a n d f u t u r e m i s s i o n s

Agency Information Technology (IT) Procurement Office

WELCOME

Marvin Horne Agency Information Technology (IT) Procurement Office Director

Agenda

Topic Presenter Time

Welcome to Industry Day Marvin Horne

Agency Information Technology (IT) Procurement Office Director 11:00-11:05

OCIO MAP Brief Jeff Seaton

NASA Chief Information Officer 11:05-11:50

IT Procurement Office Overview Marvin Horne 11:50-12:05

Cybersecurity and Privacy Organization Agency Vision and Objectives

Mike Witt

Associate Chief Information Officer for Cybersecurity & Privacy and Senior Agency Information Security Officer

(SAISO)

12:05-12:15

Procurement Overview Jim Griffin

Contracting Officer 12:15-12:45

Technical Overview Bonita Oliver

SEB Chair 12:45-1:15

Cost Volume Overview Steve Vacco

Cost Analyst 1:15-1:35

Closing Remarks Marvin Horne

Agency Information Technology (IT) Procurement Office Director

1:35-1:45

OCIO MAP Proposed Transformation Activities

Jeff Seaton – NASA Chief Information Officer Janet Watkins – OCIO Map Project Manager

Sean Gallagher – CIO Glenn Research Center/Technical Deputy OCIO MAP Project Manager April 19, 2021

►What is the Mission Support Architecture Program (MAP)?

►OCIO MAP Schedule & Timeline

►OCIO MAP Goals and Objectives

►High-Level Summary of Changes

►Contact Information for Questions

Business Services Assessment

Strategic Workforce Planning

Mission Support Architecture

(MAP)

The Mission Support Future Architecture Program (MAP) will implement a phased plan to transform all mission support functional areas from their current state to an enterprise architecture. (EC-2017-05-003)

Purpose of MAP

MAP Program Goals & Objectives

Engage Headquarters, Center, and Mission Directorate Leadership throughout the Program lifecycle.

Realign mission support structures to include budget authority and lines of reporting.

Establish a more efficient operating model that maintains critical capabilities and meets current and future mission needs.

Share capabilities across Centers rather than sustaining business and mission support operations at each Center.

Evolve mission support operations consistent with evolving roles/work assignments at Centers & strategic Agency objectives.

MAP Phases

Share plan/proposal (KDP-B) Share plan/proposal (KDP-D)

Phase A Phase B Phase C Phases D & E*

Clarify requirements, goals, and objectives

Develop future state at high level.

What changes and what stays the same?

Begin implementing the future state. Document the transformation.

Implementation check.

Sh ar e pl an /p ro po sa l (

KD

P

A)

Gather and evaluate resource & other data

Teams explore options for future state

Begin developing a concept of operations

Refine requirements

Develop the new reporting structure

Develop the new resources structure

Refine the concept of operations

Execute

Implement the new reporting structure

Implement the new resources structure

Continue to refine the concept of operations

Updated Project Plan

Updated Transformation Plan

Draft Training Plan and Materials

Draft Operations Documentation

(must address structure, operations, people, processes, systems & technology)MAP Phases Communicate with All Stakeholders

*(if required)

Understand the current state.

What do we need? What do we want?

We’re Here!

Share plan/proposal (KDP-C)

OCIO MAP Schedule

OCIO Project Schedule & Timeline

Nov Dec Jan/Feb/Mar

M ar/Apr/May Jun/Jul Aug/Sept Oct/Nov/Dec Jan Feb Mar/Apr May/Jun Jul-Dec Jan - Jun Jul-Dec

Key Project Milestones

Key Decision Point (KDP) Briefings *Leverage Normal Leadership reoccurring meetings in addition to the above

Implementation Continues

CSM F2F

@ JSC

Jan. 2020

KDP C Deliverable 5 weeks prior

20212019

Phase B: Future State Design and Development

KDP-D @ MSC,

no MST-IRB Tentative Date: Oct 22

Phase A:

Local Stakeholder Engagement during this time

KDP-E @ MSC,

no MST-IRB Tentative Date: TBD

(Schedule Ahead, pending KDP Approval)

CSM F2F

Virtual May 2020

20222020

Phase C: Implementation

Project/Transformation Plan inclusive of:

► Service Delivery ► IT Environment ► Governance ► Org. Structure ► Workforce Plan

► Change Management ► Resources & Budget ► Policy ► Risk and Performance

Conditional KDP A approval @MSC (Nov. 2019)

KDP A

approval @MSC (Dec. 2019)

KDP B

approval @MSC (Jul. 2020)

KDP C

Informational @MSC

(Feb. 2021)

KDP C

Informational @MSC

(Mar. 2021)

CSM F2F

Feb. 9-11, 2021

Several CSM, Red Team Meetings Dec. - Feb.

Pilot: Delta KDP-C @MSC Oct. 2021

Wave 1: Delta KDP-C @MSC Jun. 2022

Wave 2: Delta KDP-C @MSC Sept. 2022

OCIO MAP Goals & Objectives

Big Ideas: Major Changes

►Simplify the Customer Experience: Make it simpler for customers to work with OCIO and get the IT they need when they need it. Reduce bureaucracy and process.

► Increase OCIO’s Customer Focus: Enable the OCIO organization to more effectively and rapidly understand and meet customer needs.

►Deliver Reliability and Innovation: Implement an organization and align workforce to deliver both unified and reliable core IT services while enabling the delivery of mission-focused transformational digital solutions.

►Optimize Available Resources: Eliminate duplication and obsolescence in IT services and contracts and maximize the mission benefit of NASA’s investment in IT.

►Measure Performance and Risk: Clarify how we measure success and manage risk of NASA IT, with metrics that are meaningful to our customers.

NASA OCIO Future State Design:

Based on Key Tenets

1. Customer Experience Excellence A focus on creating and enabling easy-to-use, ‘effortless’ experiences for all audiences, internal and external.

2. New Ways of Working

Adoption of new organizing principles (Products over Projects) and methods (Agile and DevOps) to drive business outcomes – and establish IT as a strategic partner.

3. Culture of Innovation & Adaptation

Shift the culture to a business outcome focus that values accountability, aggressive transparency, continuous learning, and ability to quickly adapt.

6. Digitally Dexterous Workforce

A focus on the NASA workforce and how they are upskilled to be more “digitally dexterous”, and enabled with the data, tools, and experiences needed to achieve strategic business objectives.

5. Agile Architecture & Platforms

Shift from a focus on systems to a focus on platforms, embracing modern architecture patterns, integration as a core competency, and agile, cost-effective methodologies leveraging automation and the cloud.

4. Optimized Enterprise Services

Establishment, optimization, and adoption of a shared set of enablers to drive efficiencies, effectiveness, and security.

7. Run IT Like a Business

Increased focus on IT Financial Management to achieve greater financial transparency to optimize cost and value.

Service Delivery & Operating Model Future State

Service Lines & Operating Model:

Summary of Major Changes

►Evolution of Enterprise IT Programs into restructured and expanded Service Lines.

►Customer-centric focus, management, and governance of related products & services through Service Lines.

►Scope extended to Centers to ensure end-to-end solutions, quality, and performance.

►Moving away from 1:1 relationship between enterprise contracts and enterprise service lines.

►Moving from Center-managed in current state to Enterprise-managed, Center-resourced in the future state.

► Service Management Office (SMO) implemented for consistent service delivery accountability across Service Lines.

Integrate and improve communications through improved channels.

Develop, maintain and refresh the service portfolio and service catalog.

Drives consistent service delivery analytics and operational reporting to customers.

► Single enterprise service delivery tool platform: ServiceNow.

►Common enterprise service delivery processes in place across all Service Lines to drive consistent customer experience and service analytics.

►All IT operational support will follow a common intake service delivery model leveraging the Enterprise Service Desk (ESD).

►Consistent customer interfaces through Relationship Management (RM) teams will be assigned to each customer segment.

►Resourced at both Agency and Center; integrated to identify trends and efficiencies in customer needs/issues.

►Accurate, dynamic inventory of software and hardware that is not self-reported.

► Streamlined process for new requests meets customer needs, while preventing duplication.

►Well-defined uses for a suite of enterprise platforms and tools.

Service Lines

Service Delivery

Customer Engagement

Inventory

Transitioning from Programs to Service Lines From To

Operating Model

Team

Methodology

Engagement

Governance

Deliverables

Performance Management

Contract-centric focus Portfolio and Customer-centric focus

Broad range of roles across Programs Consistent Roles/Responsibilities across all SLs

Separate processes / tools / roles Common service lifecycle, roadmaps and processes

Wide range of different approaches Formalized Relationship Management

Many different decision processes Technical Execution and Service Line Boards

Limited & inconsistent service metrics Data-driven Service Delivery Outcome Reporting

No single view of OCIO services Single unified service catalog managed as a portfolio

Initiate Operations Division Infrastructure

Develop Service Line positions and playbook

Transition Programs to broader SL portfolio & structure

Deploy New OCIO Service Catalog

Establish And execute OCIO Service Catalog management process

Pilot First OCIO Service Line and capture lessons learned

Inventory Enterprise and non- Enterprise Services data for OCIO Service Catalog

MAP Service Line Implementation Plan Summary 0-3 Months 3-6 Months 6-9 Months 9-15 Months

Transition Wave 1 Service Lines to new OCIO operating model

Transition Wave 2 Service Lines to new OCIO operating model

Initiation Phased Implementation and Progressive Maturity

OCIO Service Lines Groupings

Workplace & Collaboration

Services

Applications & Platform

Services

Information, Data, and Analytics Services

► Secure, architected Network and Transport services with lifecycle management

► Includes physical infrastructure, cabling, WAN, LAN

► Hosting and cloud brokering services

► Optimizes contracts for the greatest value to the company overall

► Higher-quality insights and faster, more accurate decision-making through enterprise data platform development, data asset management and analytics

► Comprehensive Security services to support needs for risk identification, cyber asset protection, threat detection and incident response.

► All the tools necessary for NASA staff to be productive

► End-user computing and mobile devices, Email, IM and other collaboration tools

► Develop and provide solutions to optimize NASA business capabilities, including application development, integration, platform management and support

Innovation Across Service Lines

* Expect innovation to occur within each Service Line

Network & Telecommunications

Services

Cloud & Computing

Services

Cybersecurity Services

Organization Structure Future State

Office of the Chief Information Officer

Agency CIO

Strategy Division Deputy CIO for Strategy

Operations Division Deputy CIO for Operations

Cybersecurity and Privacy Division

Senior Agency Information Security Officer (SAISO)

Center CIO Enterprise

Architecture Enterprise

Bus. Mgmt.

Customer

Engagement Service

Lines Enterprise

Proj. Mgmt.

IT Service

Mgmt

Existing Cybersecurity

Elements

Cybersecurity Services Service

Line

Proposed Organization Chart

Proposed Center CIO Structure

Deputy CIO

Service Delivery Business Mgmt.Customer Engagement

Service Integration

Center CIO

Center CIOs will scale their organization to best fit their operational model during implementation phase, but with these clearly identified standardized functional roles.

Centers with local staff not large enough to warrant an office or separate organizational unit will organize in the necessary number of offices based on span of supervisory control with these Functional Roles clearly identified and supported.

Service Line Delivery at the Center

Enterprise Service Lines

Center CIOs will continue to be the conduit for Center IT issues.

Organization Structure Integration Proposals

OCIO MAP Integration Proposals

Optimize IT functions by integrating:

►NSSC and Stennis OCIO functions.

►HQ IT Office and GSFC CIO organization.

Rationale:

►NSSC and SSC are physically co-located. There is no need for duplicative CIO functions for core OCIO services like networks and computing.

►HQ is a single building. Aligning the HQ CIO staff under GSFC will provide expanded resources to meet

HQ needs while simplifying the overall CIO org structure.

►Addresses challenges faced by smaller Centers CIO teams.

►Expected benefits include:

Integrated strategy and operations.

Optimized resourcing and resultant efficiencies and increased service quality.

Increased workforce development and opportunities.

Workforce Future State

OCIO Workforce (FTE) Distribution Today

NASA-wide OCIO Functional Distribution

IT Function Total % FTEs

IT Management & Governance 25% 185

Cybersecurity 18% 132

Applications 15% 107

Communications 14% 104

End User Services 7% 52

Information Management 5% 39

Computing & Data Center 5% 35

Digital Transformation 1% 5

Customer-Funded Services 10% 72

Total FTEs 100% 732

185 FTEs

25%

132 FTEs

18%

107 FTEs

15%

104 FTEs

14%

52 FTEs

7%

39 FTEs

5%

35 FTEs

5%

5 FTEs

1% 9

10%

NASA OCIO Funtional Distribution

Workforce: Summary of Major Changes

►Approach OCIO workforce from an Agency/Enterprise perspective.

►Enterprise hiring process to properly vet and manage workforce.

►Workforce Manager and Workforce Management Working Group to develop workforce products and guide reshaping of OCIO.

► Identified consistent roles and responsibilities for OCIO positions.

►Move to consistent roles as part of OCIO MAP transformation.

►Reduce duplication, gain efficiencies and better support customers and internal operations.

►Developed approach for consistent skills and competencies for OCIO positions.

►Consistent skill profile for roles to be foundation for succession planning process and career paths for OCIO.

►Standardization across enterprise offers more opportunities for employees.

►Developed standard approach to developing the “Complete IT Professional.”

►Yearly skills assessment as part of succession planning process to identify organizational skill gaps and developmental and recruiting priorities.

►Multiple career paths to be defined and linked with training, mentoring, rotations and other developmental activities.

Optimize Workforce

Consistent Roles

Consistent Skills and Competencies

Standardized Approach to Employment Development

Resources & Budget Future State

Resources & Budget:

►Establish a consistent funding model for each IT Service.

►Realign OCIO IT Program and Center funds to Enterprise Service Lines (phased approach as Service Lines stand up).

►Simplify and establish consistent funding models for Base Services and Demand Services.

► Implement a WCF for IT Modernization.

► Implement a WCF for IT Services to support IT services in the new Service Lines.

►Phasing out use of current WCF for Enterprise IT contracts as contracts end.

►Utilize integrated Agency approach/process to address significant IT Modernization/Transformation needs.

►Utilize WCF fund for IT Modernization and fund with existing/available sources & build funding over time.

►Partner with OCIO, MSD and DT Business Innovation Office for project ingest and funding decisions/governance.

► Leverage current OCIO IT Investment Fund (ITIF) process.

►Establish integrated Enterprise Resources Team.

► Implement streamlined, consistent, and repeatable financial processes.

► Increase financial visibility and insight into use of limited funding.

►Reduce burden on customers through streamlined budgetary processes.

Establish consistent funding model for Base and Demand Services

Establish two new Working Capital Funds

Utilize strategic, integrated approach to IT Modernization

Implement streamlined IT Financial Processes

IT Acquisition Future State

IT Acquisition: Summary of Major Changes ►Streamlined, automated workflow incorporating all required IT reviews.

►Defined levels of service and clear expectations for all acquisition processes.

►Ensure accessibility to ALL customers, internal and external to OCIO.

►Standardize requirements development processes and templates.

►Simplify onboarding, work prioritization, funding, & performance monitoring/evaluation processes.

► Implement processes for mapping contract estimates and actuals.

►Deploy a single Agency IT contract administration system.

►Provide authorization including coordination of all functional reviews.

►Provide acquisition package development and OP coordination for all commercial IT buys > $10K.

►Plan and implement contract strategies and policy changes.

►Coordinate, develop and maintain standardized OCIO-specific contract language, requirements, and clauses.

►Requesting dedicated support from Office of the General Counsel (OGC) for consistent legal contract and agreement guidance.

►Centrally managed by new Enterprise IT Acquisition Management Function.

►Modify existing contracts in partnership with the ITPO.

Add scope where appropriate.

Simplify and document ordering procedures.

Pursue creative approaches to meeting sourcing challenges.

►Establish new contract(s) to meet current gaps.

►Provide vendor management and small business coordination.

►Create a distributed community of knowledgeable and trained IT Acquisition experts at the Agency and Center-level to guide customers.

Single Point of Entry

Improved Management and Oversight of

Agency IT Contracts

Support Commercial Acquisition

Primary conduit, partner, and collaborator with IT

Procurement Office (ITPO)

Executes Agency IT Acquisition Strategy

►Phased approach based on contract option periods and performance end dates – Target completion Dec 2024.

►Consult with Centers and ITPO to develop comprehensive contract dispersal plans.

Transition current Center requirements to

Agency IT Contracts

Governance Future State

Governance: Summary of Major Changes

►Establishment of agency-level boards (elimination of 2 agency level boards), service line boards, and center-level boards.

►Scope, functions, configuration items, and membership of each board.

►Key Performance Indicators and Critical Success Factors.

►Standardizes and reduces center-level boards.

►Provides consistent coordination and integration between center-level and agency-level boards.

►Ensures center-level boards are not duplicative of agency-level boards.

►Removes duplication in membership across boards.

►Prevents the same subject from being heard at multiple boards.

►Enables decision-making at the lowest level possible.

►Aligns decision process with the PPBE and CPIC processes.

►Provides clear lines of authority and scope to both internal and external stakeholders.

►Minimizes the amount of reporting while increasing transparency into decisions at all levels.

►Ensues appropriate stakeholder engagement.

Comprehensive IT Governance Framework

Center-level Board Alignment

Process Alignment

Clear Lines of Authority

Transparency of Decision Making

Risk & Performance & Management Future State

Risk & Performance Management:

► Instituting an outcome-driven performance management practice (Balanced Scorecard & Objectives and Key Results) across all OCIO Service Lines/Offices.

► Establishing strategic, portfolio-level performance objectives to which all future-state operations will align.

► Integrating performance management objectives with the risk management process to optimize insights.

► Integrating the risk management process with organizational processes for Service Delivery, IT Governance, and Budget.

► Establishing requirements for Risk & Performance process ownership and continuous improvement.

► Facilitating ongoing personnel training and development within IT Risk & Performance

Management disciplines.

► Developing and integrating solution requirements with Service and Project Management System designs.

Streamlined and Integrated Performance Management

Framework

Enhanced OCIO Risk Management Framework

Performance-driven and Risk-based Delivery of

Projects & Services

Policy Future State

Policy: Summary of Major Changes

►Leverage current OCIO policy management process to oversee all Enterprise and Center policies, and ensure consistent IT policies across the enterprise reducing Center differences in implementation.

►Reduce IT policy review timelines for IT agility, and include center-uniqueness as appendices in parent documents.

►Update policy documents to MAP Future State, e.g., NPD 1000.3 and NPR 2800.1.

►Consolidate all Enterprise & Center policy documents to a single OCIO repository.

►Develop knowledge-based Intelligent search capability to locate applicable policy.

►Employee awareness training on Enterprise and Center policies and the new policy repository.

►Define policies requiring OCIO Enterprise Services to be considered first. For e.g., codify MFR 7 and 137 memo dated 2014 into an actual policy.

►Significantly Reduce/Simplify Agency and Center-unique IT policy documents.

►Drive consistent use of enterprise services across Agency.

Streamlined Review Process

Single OCIO Policy Repository

Standardized Policy Implementation

Key OCIO MAP Implementation Timeline & Milestones

►Workforce realignments completed by June 30, 2021.

Service Lines (SLs) workforce realignment will occur as SLs are implemented.

Center Offices will stand up after last wave of service lines are implemented (Apr 2022).

►Organization Structure approved and in place by July 2021.

Organization FTE alignments complete.

Populate Agency Offices.

Populate 1st Service Line.

►First service line pilot begins July 2021.

►First wave of Service Lines stand up Jan 2022.

►Second wave of Service Lines stand up Apr 2022.

For Questions – contact agency-ocio-map@mail.nasa.gov

Topic Presenter Time

Welcome to Industry Day Marvin Horne

Agency Information Technology (IT) Procurement Office Director 11:00-11:05

OCIO MAP Brief Jeff Seaton

NASA Chief Information Officer 11:05-11:50

IT Procurement Office Overview Marvin Horne 11:50-12:05

Cybersecurity and Privacy Organization Agency Vision and Objectives

Mike Witt

Associate Chief Information Officer for Cybersecurity & Privacy and Senior Agency Information Security Officer

(SAISO)

12:05-12:15

Procurement Overview Jim Griffin

Contracting Officer 12:15-12:45

Technical Overview Bonita Oliver

SEB Chair 12:45-1:15

Cost Volume Overview Steve Vacco

Cost Analyst 1:15-1:35

Closing Remarks Marvin Horne

Agency Information Technology (IT) Procurement Office

1:35-1:45

CyPrESS Procurement Briefing

IT Procurement Office Overview

Marvin Horne Agency Information Technology (IT) Procurement Office

HQ Organization

LP-013

IT Procurement Office IT Procurement Office

Marvin Horne, Director Tom Weih, Deputy Director

Enterprise IT Contracts Center IT Contracts SEWP Program Office

Stand-Alone Center IT Contracts Local Unique IT Requirements

Provides the latest in ICT & AV products and services for all Federal Agencies and their approved contractors.

Broad Enterprise Scope

Develop a cadre of IT procuring experts, familiar with IT terminology and best practices

Leverage best practices from industry and other Agencies

Staff trained and certified in the Digital IT Acquisition Professional Course

Leverage knowledge of IT CORs and creating space for collaboration and training

Create a common internal (NASA Stakeholders) & external (industry) experience

Leverage economy of scale

Create a standard approach to IT procurements

Streamline and reduce lead time

Simplify procurement process

Improve Agency’s IT Spend under Management Spend in the tier 1 through 3 categories.

Strategic Priorities

• Agency Applications (EAST 2)

• Communications Services (NICS)

• Computing Services (NICS)

• Cybersecurity Services (CYPRESS)

• End User Services (NEST)

• Information Management Services

• Web Services

Current Contracts:

• ARC - Ames Consolidated Information

Technology Services (ACITS) 4

• GRC - Professional, Admin, Computational, & Engineering (PACE)

IV

• GSFC - Goddard Information Technology Integration Support Services (GITISS)

• HQ - Headquarters Information Technology Support Services (HITSS)

III

• JSC - Communications, Outreach, Multimedia and Information Technology (COMIT) / Base Information Technology Security (BITSEC)

• KSC - Kennedy Infrastructure Applications & Communications (KIAC) / KSC Information Technology Support Services (KITSS) III

• LaRC - Langley Information Technology Enhanced Services (LITES) II

• MSFC - MSFC Information Technology Services (MITS) II

• SSC - Information Technology Services

(ITS)

ICT = Information and Communications Technology AV = Audio-Visual

Multi-award GWAC (Government-Wide Acquisition Contract)

• OMB Authorized Executive Agent

--“Best in Class” Contract Vehicle

• More than 13 million CLINs and over

4 million unique part numbers

• 141 Prime Contract Holders

--more than 110 small businesses

• FY 20 Total Dollars & Orders:

--$9.5 Billion – 53K Orders --Total Small Business:

---$7.5 Billion – 41K Orders

Stand-Alone Procurement Office

Hosted at GSFC but the staff is geographically dispersed around the agency

Focused Product Service Line, IT

Contracts

Operational Since October 2020

Annual Obligations $1.5 Billion

Objectives for Today

Cybersecurity and Privacy Organization Vision and Objectives Technical Overview Procurement Overview Cost Volume Overview

Cybersecurity and Privacy Organization Agency Vision and

Objectives

Mike Witt Associate Chief Information Officer for Cybersecurity & Privacy and Senior Agency Information Security Officer (SAISO)

ORIENTATION AND PROCUREMENT

OVERVIEW

Jim Griffin Contracting Officer

Disclaimer

***** DISCLAIMER *****

These slides are not to be interpreted as a comprehensive description of the procurement strategy or requirements in the Request for Proposal (RFP)

To the extent there are any inconsistencies between this briefing and the RFP, the RFP will govern

This presentation highlights the draft RFP, Offerors shall submit a proposal that adheres to the final RFP

Presentation shall not be construed as a commitment by the Government or as a comprehensive description of any future requirements.

Goals of Industry Day

Provide industry a synopsis of the CyPrESS scope of work and an understanding of the planned procurement strategy

Promote competition and solicit feedback on the proposed acquisition All Questions and Comments regarding the DRFP should be submitted electronically in writing, to James Griffin, Contracting Officer, at james.r.griffin@nasa.gov, using the email subject line “QUESTIONS FOR DRFP 80TECH21R0007, no later than April 26, 2021.

Verbal responses are not official; all official responses shall be in writing.

The Government will consider all comments received in preparation of the Final

RFP. To the extent a comment leads the Government to revise the acquisition approach or requirements, the change will be reflected in the Final RFP. Some DRFP questions and comments may receive a posted response to the GPE if the Contracting Officer determines that a response would facilitate additional understanding of the solicitation.

Ombudsman Information

NASA FAR Supplement (NFS) clause 1852.215-84, OMBUDSMAN, is applicable. The Ombudsman for this acquisition is William Roets, William.roets-1@nasa.gov.

Points of Contact

Contracting Officer:

Jim Griffin James.r.griffin@nasa.gov 216-433-3340

Source Evaluation Board (SEB) Chair:

Bonita Oliver Bonita.J.Oliver@nasa.gov 228-688-3697

Government-wide point of entry website:

www.beta.SAM.gov

General Information

The final RFP and amendments (if any) take precedence over information provided in this conference, the draft RFP, and associated documents issued.

Competition: Full and Open Competition using formal source selection procedures; NAICS Code 541519, Other Computer Related Service, $30M Size Standard.

The draft RFP, Attachments, Exhibits, and Enclosures have been posted to beta.SAM.gov.

Acquisition Schedule

*Future dates are tentative. Refer to Final RFP when released

DRAFT REQUEST FOR PROPOSAL

OVERVIEW

Jim Griffin Contracting Officer

T h e c o r n e r s t o n e o f N A S A ’ s c u r r e n t a n d f u t u r e m i s s i o n s 51

Section A: Solicitation/Contract Form Standard Form 33 – Solicitation, Offer, and Award

⁻ Offerors shall complete blocks 12–16 ⁻ Government requests 250 days for Acceptability Period ⁻ Sign and date blocks 17 and 18

All required procurement documents will be posted on the beta.SAM.gov website. Please note that all documents, including attachments, are draft documents and subject to change prior to release of the final Request for Proposal (RFP)

Section B: Supplies or Services and Price/Cost

Contract Type:

This is a performance-based, hybrid contract that includes Cost-Plus-Award-

Fee (CPAF) Core Indefinite Delivery/Indefinite Quantity (IDIQ) task orders. The IDIQ task orders can be either CPAF and/or Firm Fixed Price (FFP) task orders.

Phase-in is FFP

CLIN Structure

B.5 1852.216-85 ESTIMATED COST AND AWARD FEE (SEP 1993)

Core Requirement (CLINs X01)

The estimated cost of this contract for Core Services is $ To Be Proposed. The maximum available award fee, excluding base fee, if any, is $ To Be Proposed. The base fee is $_0__.

Total estimated cost, base fee, and maximum award fee are $ To Be Proposed.

IDIQ CPAF Tasks (CLIN 601) The estimated cost of this contract for IDIQ Tasks is $ To Be Negotiated by Task Order. The maximum available award fee, excluding base fee, if any, is $ To Be Negotiated by Task Order.

The base fee is $_0__. Total estimated cost, base fee, and maximum award fee are $ To Be Negotiated by Task Order.

CLIN* DESCRIPTION PWS

SECTION

CONTRACT

TYPE **

Phase-In: Contractor shall complete all phase-in activities as required in the Contractor’s phase-in plan.

N/A FFP

X01 CYPRESS Core Services per the PWS and Center Phasing Schedule All CPAF

Indefinite Delivery Indefinite Quantity (IDIQ)

Summation of Task Orders

All CPAF

602 All FFP

*The "X" identifies the Contract Period

** The government may unilaterally reallocate contract value between the CLINs

B.6 Total Contract Value The table below contains the overall total potential contract value.

Clause B.4 Firm Fixed Price and B.5, Estimated Cost and Award Fee (NFS 1852.216-85), contains the total value of the contract through the base period and any exercised option periods. Clause F.4, Period of Performance, provides the performance period details for each period, including the phase-in.

B.6 Total Contract Value (cont.)

The table below contains the overall total potential contract value. Clause B.4

Firm Fixed Price and B.5, Estimated Cost and Award Fee (NFS 1852.216-85), contains the total value of the contract through the base period and any exercised option periods. Clause F.4, Period of Performance, provides the performance period details for each period, including the phase-in.

*Includes the Government Directed Core

ODC NTE

B.6 Total Contract Value (cont.)

The table below contains the overall total potential contract value. Clause

B.4 Firm Fixed Price and B.5, Estimated Cost and Award Fee (NFS 1852.216-85), contains the total value of the contract through the base period and any exercised option periods. Clause F.4, Period of Performance, provides the performance period details for each period, including the phase-in.

IDIQ

CLIN Work Description Period Covered Total

601 (CPAF)

IDIQ NTE Number includes but is not limited to all allowable, allocable, and reasonable labor, material, burdens, overhead, G&A, and fee/profit. The Cost Reimbursable task orders or work request's fees will be costed in the Cost Files and NF533 reporting; however, associated fee amounts will be added to the Fee pool identified under Clause B.5 Estimated Cost and Award Fee and earned in accordance with Award Fee Plan. The Fixed Price task orders profit under this IDIQ CLIN will remain with its associated task order.

2/1/2022 - 9/30/2030

$ 135,000,000

602 (FFP) $ 55,000,000

TOTAL IDIQ $ 190,000,000

GRAND TOTAL ALL CLINS AND ALL

YEARS AT MAXIMUM FEE $

*The Government may unilaterally reallocate contract value between the

CLINs

B.9 GSFC 52.216 94 NONPROPOSED COSTS (FEB 1991) (CORE

CLINs X01)

The total estimated cost of this contract includes the following estimated costs for ODCs:

These costs are the Government's best estimate of what the actuals will be. There will be no adjustment in the fee(s) of the contract should the actuals be different than these estimates, unless additional effort is added to the contract or there is a change to the contract under the Changes clause of this contract which impacts these estimates.

Contract Period: Dates ODC (Core)

Base Period February 1, 2022 – September 30, 2023 $7,913,892

Option Period 1 October 1, 2023 – September 30, 2025 $12,109,517

Option Period 2 October 1, 2025 – September 30, 2027 $12,824,582

Option Period 3 October 1, 2027 – September 30, 2029 $13,605,600

Option Period 4 October 1, 2029 – September 30, 2030 $7,110,434

Period of Performance:

⁻ Maximum potential of eight (8) years and ten (10) months from 12/3/2021 –

9/30/2030 Contract Period: Duration: Dates:

Phase-in 60 days December 3, 2021 – January 31, 2022

Base Period 20 months February 1, 2022 – September 30, 2023

Option Period 1 24 months October 1, 2023 – September 30, 2025

Option Period 2 24 months October 1, 2025 – September 30, 2027

Option Period 3 24 months October 1, 2027 – September 30, 2029

Option Period 4 12 months October 1, 2029 – September 30, 2030

Section C: Statement of Work

The Performance Work Statement (PWS) is composed of 6 sections: (Section J, Attachment A, PWS)

Section 1 Section 2 Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS) Contract Management

Principal CyPrESS Stakeholders and Places of Performance, Center Transition, Goals and Objectives, and PWS Overview

Program Management, Contract Administration System, Critical Staffing Positions, Financial

Management, Property/Inventory Management/Logistics, Quality Management, and Safety, Health, and Environmental (SHE) Management

Section 3 Section 4 Cybersecurity and Privacy Program Management Support Cybersecurity and Privacy Oversight Support

Office of Cybersecurity Services (OCSS) Support, Security Operations Center (SOC) Support, CSPP Business Management, Policy Management, Privacy Management Support, Controlled Unclassified Information (CUI) Management Support, Cybersecurity and Privacy Risk Management Support

Cybersecurity and Privacy Oversight Support

Section 5 Section 6 Cybersecurity Standards, Architecture and Engineering Cybersecurity and Privacy Services

Cybersecurity Standards and Architecture, Identity, Credential and Access Management (ICAM) Engineering, Applications Engineering, Cloud Engineering, Cybersecurity

Network Engineering and Design Support, Operational, Research and Test Environments Support, Project Management and Technical Reviews

Continuous Monitoring and Detection (M&D) and Triage, Incident Response and Management, Cyber Forensics and Incident Analysis, Cyber Threat Detection and Hunt, Cyber Threat Analysis, Cybersecurity Infrastructure

Services, Training and Awareness, Supply Chain Risk Management (SCRM) Support, Risk Management Framework (RMF) Services, Cybersecurity Posture

Assessment Services

T h e c o r n e r s t o n e o f N A S A ’ s c u r r e n t a n d f u t u r e m i s s i o n s 60

Sections D, E, and F Section D - Packaging and Marking

Refer to RFP Section E - Inspection and Acceptance:

Refer to RFP Section F – Deliveries and Performance

Refer to RFP

Section G: Contract Administration Data

G.12 1852.245-71 INSTALLATION-ACCOUNTABLE

GOVERNMENT PROPERTY (JUN 2018) – ALT I (JAN 2011)

NASA anticipates providing:

⁻ Office space, work area space, and utilities. Government telephones are available for official purposes only.

⁻ Office furniture.

⁻ Property listed in Attachment I, Installation-Accountable Government Property.

Section H: Special Contract Requirements

1852.209-71 LIMITATION OF FUTURE CONTRACTING (DEC

1988) The Contracting Officer has determined that this acquisition may give rise to a potential organizational conflict of interest. Accordingly, the attention of prospective offerors is invited to FAR Subpart 9.5— Organizational Conflicts of Interest.

GSFC 52.219-90 SMALL BUSINESS SUBCONTRACTING PLAN

AND REPORTS (NOV 2016)

FAR clause 52.219-9, "Small Business Subcontracting Plan", is included in this contract. The agreed to Subcontracting Plan required by the clause will be included as an attachment to the contract.

H.36 CONVERSION FROM COST-PLUS-AWARD-FEE TO COST-

PLUS-FIXED-FEE

If the contractor attains a total weighted award fee score of 91% or higher for a minimum of two (2) consecutive award fee periods, the Government may determine it is in the Government’s best interest to convert the Cost-Plus- Award-Fee (CPAF) CLINs (both Core and IDIQ)from CPAF to a Cost-Plus- Fixed-Fee (CPFF) structure. To calculate the fixed fee percentage to be applied for the remainder of the contract in the event the contract is converted, the Government will multiply the contractor’s average historical award fee score by the contractor’s award fee percentage.

H.37 ADVANCE AGREEMENT TO TRANSITION FIXED PRICE

WORK PACKAGES

The Government may to transition tasks from the Cost-Plus-Award-Fee CLINs

(both Core and IDIQ) to the Firm Fixed Price IDIQ CLIN under this contract, in accordance with DRD MA-022. The Contracting Officer will transition this work by issuing a unilateral contract modification pursuant to 52.243-2; if the Government (1) determines, at its sole discretion, to be in the Government’s best interest and (2) provides the Contractor a written notice no later than 45 calendar days before performance of the work is expected to start. The effective date of work transition will occur at the beginning of a contract performance year.

Should this transition be executed, the profit rates shown in H.37 will be applicable to the transitioning work when determining the price.

Section J: List of Attachments

Attachment Description Date No. of Pages (including the cover page)

A Performance Work Statement 01/2021 49 B Applicable Documents List 10/2020 16 C Data Requirements List and Data Requirements Descriptions 04/2021 56 D Financial Management Reporting Requirements 06/2014 4

E DD Form 254, Contract Security Classification Specification with Attachments 1 and 2 01/2021 33

F Personal Identity Verification (PIV) Card Issuance Procedures (GSFC/HQ) 02/2015 5

G Safety and Health Plan To be Submitted in Proposal TBD H Small Business Subcontracting Plan TBP TBD I Installation Accountable Government Property (IAGP)

J Organizational Conflicts of Interest (OCI) Avoidance Plan TBP TBD

K Contract Management Plan TBS within 30 Days of the Contract Effective Date TBD

L IT Security Management Plan TBS within 30 Days of the Contract Effective Date TBD

M Reserved.

N Phase-in Plan TBP TBD O Wage Determinations 01/2021 204 P Direct Labor Rates, Indirect Rates and Fee Matrices 03/2015 5 Q Fixed Price Rate Matrix 03/2015 5

TBS = To Be Submitted TBP = To Be Proposed TBD = To Be Determined

Section K: Representations, Certifications, and Other Statements of Offerors

Offerors shall fill in all required elements of this section K.1 Annual Representations and Certifications (FAR 52.204-8)

Offerors shall complete the annual representations and certifications electronically via the online consolidated federal procurement system website accessed through https://www.sam.gov System for Award Management (SAM)

The following provisions also require the offeror to respond: K.2, K.3, K.4, K.5, K.6, K.7, and K.8

Section L: Instructions, Conditions, and Notices to Offerors

L.25 GSFC 52.209-301 NOTICE OF POTENTIAL

ORGANIZATIONAL CONFLICTS OF INTEREST (MAR 2020)

(a) Notice. The Contracting Officer (CO) has determined that this acquisition may give rise to an organizational conflict of interest (OCI).

The OCI Submission, comprised of the Offeror’s OCI Assessment and its OCI Plan, will not be evaluated as part of the Mission Suitability Factor. The OCI Plan will be considered in determining the contractor’s responsibility to perform this contract. As such, the Government may conduct exchanges with any Offeror at any time during the evaluation process concerning its OCI Submission.

A NASA CO approved OCI Plan shall be required in order for a contractor to be eligible for award of this contract.

L.25 GSFC 52.209-301 NOTICE OF POTENTIAL

ORGANIZATIONAL CONFLICTS OF INTEREST (MAR 2020) (cont.)

Potential Offerors are encouraged to submit draft Organizational Conflict of Interest

(OCI) Mitigation Plans, addressing potential Organizational Conflicts of Interest (OCI) identified in L.25, Notice of Potential Organizational Conflicts of Interest, of the Draft RFP, for preliminary and non-determinative review by the Government no later than April 30, 2021 via e-mail to the Contracting Officer.

The Government will review submitted OCI Mitigation Plans for the purpose of gathering additional information regarding potential OCI issues in order to address such issues as early as possible in the solicitation process.

NASA's response will simply be an attempt to preliminarily examine possible circumstances which might lead to or eliminate an OCI. It will not be a confirmation that, in fact, an OCI will ultimately exist or that a Potential Offeror can successfully eliminate or mitigate an OCI.

L.25 GSFC 52.209-301 NOTICE OF POTENTIAL ORGANIZATIONAL

CONFLICTS OF INTEREST (MAR 2020) (cont.)

The proposed OCI Plan shall be consistent with all other areas of the proposal.

Material inconsistencies between the OCI Plan and other proposal areas may render the proposal invalid, resulting in an unacceptable proposal that is ineligible for award.

The proposed OCI Plan is not page limited. The plan shall be included as part as the proposal Offer Volume, or as a separate attachment, consistent with the solicitation instructions.

(b) Description of Potential Conflict. The nature of this OCI is:

(1) Biased Ground Rules: The Contractor may provide support in terms of preparing or assisting in the preparation of policies, standards, specifications, handbooks, and/or work statements, which could be incorporated into requirements for future contracts, which would give rise to a biased ground rules organizational conflict of interest (OCI).

(2) Unequal Access to Information: The Contractor may have access to another company’s proprietary, business confidential or financial data and/or nonpublic Government sensitive information, which would give rise to an unequal access OCI. The Contractor must protect these data from unauthorized use and disclosure and agrees not to use them to compete with those other companies.

L.25 GSFC 52.209-301 NOTICE OF POTENTIAL

ORGANIZATIONAL CONFLICTS OF INTEREST (MAR

2020) (cont.)

(b) Description of Potential Conflict. The nature of this OCI is:

(3) Impaired Objectivity: The Contractor may be required to perform technical reviews or provide engineering consultation services on its own proposals/quotations, products, or services… “…Specifically, there is a possibility that the CyPrESS contractor could be involved in providing oversight of their own Information Technology (IT) services provided under a separate NASA contract, as well as IT services provided to NASA by their competitors...”

(4) Impaired Objectivity: “...Contractor’s own System Security Plans as part of the Information System Security Officer (ISSO) services function, which could create an impaired objectivity OCI.”

*Refer to L.25 for details.

L.25 GSFC 52.209-301 NOTICE OF POTENTIAL

ORGANIZATIONAL CONFLICTS OF INTEREST (MAR 2020) (cont.)

(c) Responsibility of Offeror.

(1) Applying the principles of FAR Subpart 9.5, each Offeror shall assess whether there is an OCI associated with the proposal it submits. The Offeror must explain the actions it intends to use to resolve any OCI identified by the Government or identified through its own assessment.

(2) Offerors shall inform the CO of any potential conflicts of interest, including those involving contracts with other Government organizations, as part of the OCI Submission in paragraph

(g) below. The CO will use this information to determine whether resolution of those conflicts will be required.

(3) If the Offeror’s proposed action to resolve an OCI is not acceptable, the CO will notify the Offeror, providing the reasons why its proposed resolution is not considered acceptable and allow the Offeror a reasonable opportunity to respond before making a final decision on the OCI. In the event that the Offeror is not successful in resolving an identified conflict to the satisfaction of the CO, the Offeror may be determined to be ineligible for award.

L.27 GSFC 52.215-201 (ALT I) PROPOSAL PREPARATION—

GENERAL INSTRUCTIONS (ELECTRONIC PROPOSAL

DELIVERY). (MAR 2020) (c) Responsibility of Offeror.

Proposal Format and Organization

(1) Offerors shall submit proposals in four volumes as specified below:

Volume Title

I Offer Volume

II Mission Suitability Volume

III Cost/Price Volume

IV Past Performance Volume

L.27 GSFC 52.215-201 (ALT I) PROPOSAL PREPARATION—

GENERAL INSTRUCTIONS (ELECTRONIC PROPOSAL

DELIVERY). (MAR 2020) (c) Responsibility of Offeror (cont.)

(b) Proposal Content and Page Limitations

**Prime Offeror and all Significant Subcontractors (page limitation is for the total component (Prime and Significant Subcontractors)).

Proposal Component Page Limitations Mission Suitability Volume 60 Pages

Phase-in Plan 10 Pages (Excluded from 60 Pages) Total Compensation Plan 10 Pages (Excluded from 60 Pages)

Cover Page, Indices, Table of Contents, PWS Compliance Matrix Excluded from 60 Pages

Cost Volume Mixed

(a) Table of Contents, Direct Labor Rates, Indirect Rates, and Fee Matrices (Attachment P) None

(b) Cost Exhibits None

(c) Basis of Estimates 50 Pages**

L.27 GSFC 52.215-201 (ALT I) PROPOSAL PREPARATION—

GENERAL INSTRUCTIONS (ELECTRONIC PROPOSAL

DELIVERY). (MAR 2020) (c) Responsibility of Offeror. (cont.)

(b) Proposal Content and Page Limitations (cont.)

**Prime Offeror and all Significant Subcontractors (page limitation is for the total component (Prime and Significant Subcontractors)).

Proposal Component Page Limitation Past Performance Volume Mixed

(a) Information from the Offeror 20 pages**

(b) Cover Page, Indices, Table of Contents, List of those sent Past Performance Questionnaires, Small Business Subcontracting Plan History, and List of Acronyms

Excluded

L.27 GSFC 52.215-201 (ALT I) PROPOSAL PREPARATION—GENERAL

INSTRUCTIONS (ELECTRONIC PROPOSAL DELIVERY). (MAR 2020) (c) Responsibility of Offeror. (cont.)

When page limitations apply to a volume or specific section, a page is defined as one side of a sheet, 8-1/2" x 11", with at least one inch margins on all sides, using not smaller than 12 point type Times New Roman font. Line spacing or the amount of vertical space between lines of text shall not be less than single line (Microsoft Office Word’s default line spacing). Character spacing shall be “Normal”, not “Expanded” or “Condensed.”

The Government intends to evaluate proposals and award contract(s) without discussions with Offerors (except clarifications as described in FAR 15.306(a)).

Therefore, the Offeror's initial proposal should contain the Offeror's best terms from a cost or price and technical standpoint. The Government reserves the right to conduct discussions if the Contracting Officer later determines them to be necessary. If discussions are held and final proposal revisions are requested, the Government will specify separate page limitations in its request for that submission.

L.28 GSFC 52.215-203 OFFER VOLUME (JUL 2020)

The signed SF33 and the pages with the required fill-ins must be submitted. Annual representations and certifications shall be completed electronically via the System for Awards Management (SAM) web site accessed through https://www.acquisition.gov, in accordance with Section K provision FAR 52.204-8, Annual Representations and Certifications. The balance of the solicitation need not be returned unless the Offeror has made changes to other pages that will constitute part of the contract. Any such changes must be separately identified in the Summary of Exceptions. All SF 33s require original or electronic signatures.

It is requested that Offerors indicate, in Block 12 of the SF 33, a proposal validity period of 250 days. However, in accordance with paragraph (d) of FAR provision 52.215-1, “Instructions to Offerors--Competitive Acquisitions,” a different validity period may be proposed by the Offeror.

Include a statement of acceptance of the anticipated contract provisions and proposed contract schedule, or list all specific exceptions to the terms, conditions, and requirements of Sections A through J of this solicitation, to the Representations and Certifications (Section K) or to the information requested in Section L. Include the reason for the exception, new terms, conditions, and/or clauses, including any proposed benefit to the Government. This list must include all exception(s), deviation(s) and/or conditional assumptions taken.

L.28 GSFC 52.215-203 OFFER VOLUME (JUL 2020) (cont.)

In accordance with Attachment E, Contract Security Classification

Specification (DD 254), Offerors shall possess a Top Secret level facility security clearance by the due date for receipt of proposals and this clearance shall be maintained throughout the life of the contract. Offerors shall provide their CAGE code for verification of current security clearance status. No Offeror will be considered for award who does not have a Top Secret level facility security clearance in place by the due date for receipt of proposals. For proposals submitted as joint ventures, the facility clearance must be granted in the name of the joint venture and the joint venture CAGE code shall be provided.

L.29 GSFC 52.215-205 (ALT I) ELECTRONIC PROPOSAL DELIVERY (NOV

2020) The Offeror shall submit its proposal via NASA’s secure Large File Transfer (LFT). Electronic submissions shall not contain hidden formulas, tables, be locked, be protected or contain links to data not included in the electronic copy.