832571054 - PWS Redacted.docx

CUI

CUI

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. See Defense Information Technology Contracting Organization (DITCO) Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Sensing Systems Support (SSS) for development, cybersecurity accreditation, sustainment, Lifecycle Management, and Tier-III support.

3. Background. As the Department of Defense (DoD) SSS Manager and Representative, the Defense Information System Agency (DISA) Program Executive Office Cyber (PEO-Cyber) compiles and supports a broad range of requirements for each of the Combatant Commands/Services/Agencies component activities and depends on the successful, well-maintained operation of a diverse group of state-of-the-art technology components and interconnected sub-systems. PEO-Cyber provides for wide-ranging sensing, collection, and analysis enabling capabilities derived from strategic union points across the Defense Information Systems Network (DISN) architecture and perimeters. PEO-Cyber is responsible for sensor systems requirements collection, market research, engineering, integration, testing, baselining, certification and accreditation, installation, implementation, operations, and maintenance, and “End of Life” disposition. In addition, PEO-Cyber is responsible for the documented architecture of the DISA Cyber Perimeter Sensing Initiative.

Historically, DISA PEO-Cyber was the established Program Management Office (PMO) for several key operational capabilities the Department of Defense Information Network (DoDIN), formerly known as Computer Network Defense, community of interest relies upon each day. These capabilities include the development and management of the sensor deployment plan, development, and deployment of new Network Intrusion Detection (NIDS) sensor technologies, research, analysis, and adoption of new technologies related to NIDS, integration of key, disparate data sets, visualization of sensor data to provide enhanced network intelligence to the analyst, and sustainment of the backend infrastructure to support these daily operations.

To fulfill its designated role, PEO Cyber requires contractor support to accomplish the tasks necessary to fulfill the responsibilities outlined in applicable DoD Directives.

6. Performance Requirements.

6.1 Task 1 - Contract Management.

6.1.1 Subtask 1 - Contract Management Control Planning. Provide the technical and functional activities at the required level for integration of all tasks specified within this task order, to include an Integrated Master Schedule. This schedule should include check points for productivity and management assessment methods such as quality assurance, progress/status reporting and program reviews. Management Plan shall include at a minimum:

· Organization.

· Resources.

· Personnel Management.

· Task Order Management.

· Management structure/control (by name).

· Contract execution plan.

· Quality Assurance/Control Plan.

· Deployment and Implementation Plan.

· SME support.

· Program Support.

· Deployment Action Plan.

· Technology Refresh Strategy.

Deliverables:

· Integrated Master Schedule.

· Contract Management Plan.

6.1.2 Subtask 2 – Contract Reporting. Contract reporting describes how the contractor is meeting, not meeting, or exceeding goals set forth in the Contract Management Plan. The contractor shall provide a Monthly Status Report (WSRs) monitoring the quality assurance, progress/status reporting, and program reviews applied to the contract. The information in the WSR shall identify the following:

· Progress on contract execution.

· Engineering plan updates.

· Trouble Ticket Status.

· Status on current/outstanding deliverables and issues.

· DoD Information Assurance Compliance updates.

· After Action Report.

· Travel.

· Coordination.

· Test Procedures.

A Project Management Review (PMR) Meeting will be held at the discretion of PM to expand on questions raised in the WSR, provide additional explanation, or define execution of activities under the contract. The PMR will consist of an interchange between the Government and contractor concerning a review of the WSR elements.

Deliverables:

· Weekly Activity Report.

· Monthly Status Report.

· PMR Progress Report.

6.1.3 Subtask 3 – Technical Interchange Meeting (TIM). The introduction of the management and technical teams supporting this contract, and the presentation/delivery of the Management Plan shall be accomplished during a TIM to take place in the National Capital Area within five days after contract award. This will be the beginning of a dialogue between the Government and the contractor to ensure successful execution of the contract. The contractor shall coordinate the date, place and agenda for the TIM and include, as a minimum, the following:

· Introduction of management and technical teams.

· Presentation of Draft Management and Technical Plans.

· Establishment of common understanding of the contract.

Deliverable:

· Technical Interchange Meeting Minutes.

6.1.4 Subtask 4 – Technical Exchange Meeting (TEM). An initial TEM shall be conducted no later than 15 working days after the contract start date at the primary Government location. The TEM will be the beginning of a dialogue between the Government team and the contractor to ensure the successful exchange of the technical aspects for this requirement.

The contractor shall prepare a presentation that provides updates to the technical and management approach including current and projected schedule and performance data. The TEM agenda shall include the following:

· Plans and Accomplishments.

· Issues, Risks and Mitigation Strategies.

· Action Item Review.

· Other relevant items may be introduced at the discretion of the contractor and/or the Government.

The TEM shall continue to meet on a weekly basis at the primary Government location. In addition, the contractor shall produce minutes of all TEM meetings, including a synopsis of the technical discussion and a list of open/closed action items.

Deliverables:

· Technical Exchange.

· Meeting Minutes.

· Meeting Agendas.

· Briefing Materials.

· Action Item.

· Tracking Report.

6.1.5 Subtask 5 – Transition Implementation Plan. Upon contract award, the contractor shall work with the incumbent contractor to create and execute a Transition Implementation Plan (TIP) to transfer, in coordination with the incumbents:

· Government Furnished Equipment (GFE), Government Furnished Information (GFI), (i.e., all Configuration Items), source code, system architectures, system access controls, and other program artifacts.

· DISA facility access; lab access; DoD Common Access Cards; network(s) access; DISA Net-Centric Enterprise Services collaboration services; and other relevant accesses.

· Roles and Responsibilities in any Government managed forum currently supported by the Incumbents.

The Government will facilitate the execution of the TIP to ensure continuity of all current activities supported by the Incumbent.

At the end of the contract, the contractor shall create the TIP to support the transition to a follow-on team as specified by the Government.

Deliverable:

· Transition Implementation Plan.

6.1.6 Subtask 6 – Risk Management. The contractor shall implement a Risk Management process that encompasses identification, analysis, mitigation planning, mitigation plan implementation, and tracking for all projects, programs, and portfolios throughout the lifecycle. The objective is to provide a repeatable process for balancing cost, schedule, and performance goals within program funding, especially on programs with designs that approach or exceed the state-of-the-art or have tightly constrained or optimistic cost, schedule, and performance goals. The contractor shall be responsible for managing all hardware, software and firmware security compliance and implement patches, security updates etc. as needed to maintain required accreditations in accordance with current governance policies.

Deliverable:

· Risk Management Plan.

· Risk Management Tracking Tool.

6.1.7 Subtask 7 – Meeting Support. The contractor shall attend programmatic planning and scheduling meetings, TEM, and conferences. This support shall also include regular technical exchange meetings with external interface partners to ensure interoperability with these partners. The contractor shall prepare meeting agendas and presentation materials, briefings, draft white papers, prepare meeting minutes to include action item lists, track action items, and participate in forums or working groups as the SMEs.

Deliverable:

· Briefings.

· Meeting minutes.

· Action Items List.

6.2 Task 2 – Sustainment.

6.2.1 Subtask 1 – Operations and Maintenance (O&M). The contractor shall provide technical expertise for the O&M of the deployed software and sensors systems. The contractor shall ensure that the systems (and its associated connectivity to all critical interfaces) is operational and maintained to support mission requirements (ready, stable, and reliable). The contractor shall appoint a Service Owner for sensing platforms who shall help create, document, and maintain a Sensing Service Design Plan (SDP) that defines all aspects of the service throughout all stages of its lifecycle. The SDP and Standard Operating Procedure shall be updated anytime there is a change to the architecture, financial posture, or requirements of the service. The Service Owner shall be the primary internal and external SME for the service they are assigned to manage. The SME shall always be aware of the state of their service and report on that status to the Government as required. The Service Owner shall work with all other sensing business managers to ensure that their service is providing value to the sensing programs and their mission partners and users.

Deliverable:

· Sensing Service Design Plan.

· Standard Operating Procedure.

6.2.2 Subtask 2 – Help Desk Reach Back Support (Tier-II). The contractor shall provide technical expertise to the system help desk in resolving operational issues reported by system users. DISA’s Global Service Desk (GSD) will act as help desk/Tier-I where users will call to report issues and open trouble tickets. DISA GSD will reach out to the contractor through phone or ticket system to provide Tier-II support to the users.

The contractor shall provide Tier-II support from Ft. Meade during regular business hours (Monday-Friday 0800-1630 EDT), excluding weekends and holidays. The contractor shall provide immediate response as required to priority I & II incidents with a required problem resolution time within 72 hours from receipt of incident ticket. Responsive within 12 hours to priority III, IV & V incidents with a problem resolution time wholly dependent on the required fix action (not to exceed 1 month without COR approval).

After duty hours, the contractor shall respond to priority I & II incidents on call within 1 hour from notification of the incident ticket by DISA GSD. If remote access is required by the contractor to resolve the incident, the contractor shall report to the place of performance within 3 hours from notification of the incident by GSD. Priority III, IV & V incidents shall be addressed during the next business day. Priorities I-V will be defined by DISA GSD ticketing system.

The contractor shall respond to each request for operational and troubleshooting support. The contractor shall escalate the ticket to Tier-III support if the issue cannot be resolved at the level of Tier I or II. Once the issue is resolved, the contractor shall deliver a summary of the actions taken to the Government in the form of an Issue Resolution Report and close the ticket.

Deliverable:

· Issue Resolution Report.

6.2.3 Subtask 3 – System Maintenance. The contractor shall analyze the deployed System (software, hardware, configuration, etc.) to determine if any changes are required to maintain operational status (for example, changes by external interfaces that impact the system baseline, compliance with Information Assurance vulnerabilities, underlying COTS software upgrades, resolution of Help Desk problem reports, etc.). The detection of this shall be automated. The contractor shall provide the Government with the details of anticipated changes, to include the plan, cost, and schedule associated with implementation (this information shall be documented in the O&M Report). All re-deliveries shall be accomplished in accordance with the instruction in this PWS, including updating all applicable and associated documentation.

The contractor shall:

· Establish and maintain a reference implementation instance within the Government’s development environment in order to support troubleshooting and analysis activities.

· Provide technical expertise to regression testing activities undertaken by the Government to verify the integrity of all proposed O&M related modifications to include support for Government Acceptance and deployment activities.

· Perform hardware and software life cycle management and sustainment including requirements analysis, documentation, installation, testing, and disposition.

· Create and maintain a Master Site POC list for each Sensor operating site; list to be updated every six months.

· Create and maintain a Master Equipment list to include each accountable property item assigned to the respective sensing program.

· Request and coordinate scheduled or emergency Authorized Service Interruptions (ASI)s.

· Coordinate with all affiliated organizations at least 72 hours in advance and perform all scheduled and unscheduled preventive maintenance and network changes.

· Implement software and hardware upgrade.

· Maintain, install, and update Information Assurance Vulnerability Alert (IAVA) patches.

· Perform Backups of servers and network configurations.

· Coordinate with hardware/ software vendors and service providers.

· Provide sensors PM with updated copies of network diagrams and software information as changes occur.

· Provide reports, briefing slides, as-is baseline updates, and meeting materials upon request.

· Dispose of non-supportable or non-repairable sensing equipment IAW DoD guidance.

· Create technical and operational documents.

Licenses and COTS Products - The contractor shall review all licenses and COTS products utilized in support of the system for currency. The contractor shall document the status of all license renewals and COTS products upgrades in the O&M Report. The contractor shall provide no less than 180 calendar days notification to the Government on all forthcoming license renewal and COTS product upgrade requirements.

Deliverables:

· O&M Report.

· Master Site POC list.

· Master Equipment list.

· System Backup.

· System logs.

· Network diagrams and software/ hardware information.

· Briefings.

· Disposal plan and report.

· Technical and operational documents.

6.2.4 Subtask 4 – Continuous Monitoring. Continuous monitoring entails self-assessments, monitoring Information Assurance Validation (IAV) notifications, code reviews, validations, and software update monitoring. The contractor shall maintain and provide a prioritized list of Plan of Action and Milestones (POA&M)s with recommended mitigations and comments to the Government. The contractor shall review the POA&Ms with the Government monthly.

Deliverables:

· POA&Ms.

6.2.5 Subtask 5 – Assured Compliance Assessment Solution (ACAS) Scanning. The contractor shall run scans on the system per ATO requirements. The contractor shall review and respond to any vulnerability scan findings identified to be associated with the system as a non-compliant Security Technical Implementation Guide (STIG) item.

Below are the assets being scanned. The number may increase by 10 assets every year.

· OSP - 58 assets scanned weekly.

· FPCAP – 64 assets scanned weekly.

· ASV – 10 assets scanned weekly.

· Firepower - One baseline ACAS scanned daily in the Project Support Lab.

Deliverable:

· Cybersecurity scan and mitigation report.

6.2.6 Subtask 6 – Configuration Management. The contractor shall provide Configuration Manager support to include creation, documentation, and maintenance of a Configuration Management Plan that shall define all aspects of the Configuration Management process within the sensing programs. The Configuration Manager shall ensure that all configuration items required to deliver sensing services are identified, controlled, audited, and reported in a Government approved Configuration Management System. The contractor shall mange configuration control board (CCB) for system changes. The following shall be included as configuration items:

· Software Licenses.

· Hardware List.

· Warranty List.

· GFE.

· IT Asset Lists.

For each configuration item, the Configuration Manager shall track location, quantity, physical ownership, cost, expiration date, and other relevant details. Quarterly, the Configuration Manager shall provide 100% accounting of all configuration items (accounted for or missing) to ID6 leadership.

Deliverables:

· Master Site POC List.

· Master Equipment List.

· Configuration Management Plan.

· GFE List.

· Warranty List.

· Hardware List.

· Software List.

· CCB plan and log.

6.2.7 Subtask 7 - Asset Management. The contractor shall provide asset inventory and asset tracking services for all GFP to be reported quarterly. Specific duties include receiving all sensor equipment at the Government warehouse; properly documenting and tracking equipment throughout its life cycle; moving/staging/testing/shipping equipment as necessary; providing direct support to DISA property custodian, as related to sensor equipment.

Any interim GFP changes shall be reported to the Government in the MSR. The Quarterly Equipment Inventory Report shall include:

· Make/Model of equipment, Manufacturer, and Serial Number (if applicable) for all hardware and software.

· Physical location to include Building, Room, and Rack identification.

· Ownership to include hand receipt data consistent with Defense Property Accountability System (DPAS).

· A description of how the equipment is being utilized.

· Contract Management aspects to include: Leases, Maintenance Agreements, Service Contracts, and Warranties.

· Financial aspects to include Cost and Depreciation.

Specialized and Government proprietary resources and equipment needed will be provided. The specialized equipment may be GFP or purchased as Order Level Materials at the Government’s discretion.

Coordinating with appropriate site personnel, and DISA property team, to properly track and account for system equipment in the event that equipment is moved as a result of Tier III support activities (i.e. Return Merchandise Agreement (RMA)); completing necessary forms, including but not limited to DD1149, DD1150, and DA316 Property Management forms.

The contractor shall support DPAS and property custodian audits.

The contractor shall return all equipment to the Government’s facility once the equipment is no longer a viable asset, or in support of sensing development, operations, or maintenance. The contractor shall support DISA designated Property Team to dispose of the equipment as necessary.

Deliverables:

· Monthly Shipping Report (incoming/outgoing equipment).

· Monthly RMA Reports.

· Asset Management Plan.

· Asset Management Reports.

· Disposal Plan.

· Interim GFP Updates (MSR).

· Quarterly Equipment Inventory Report.

6.2.8 Subtask 8 – Other Direct Costs (ODCs). DISA will use ODCs to purchase additional hardware/software to support the sensing capabilities. Procurement of hardware/software through ODCs must be approved by the Contracting Officer (KO) before purchase.

ODCs shall cover contractor travel, training DoD staff at all DAOs and Higher Headquarters at hosting and operational sites, hardware/software updates and upgrades, updates to the installation and set-up of the hosting environment, and other hardware/software needed to support sensing capabilities.

Deliverables:

· Procurement/ Travel Report.

· Hardware / Software Updates.

6.3 Task 3 - O&M Engineering.

6.3.1 Subtask 1 – Tier III Support. Tier III support shall be integral to all lifecycle phases of a system. Tier III Support to be provided during normal business hours, excluding weekends and federal holidays:

· Baseline changes to correct issues.

· Configuration Management – managing baselines (change logs, CCB activities, baseline specifications, version control).

· Troubleshooting and resolution of operational issues escalated from Tier II; includes providing updates to Tier II, in accordance with Tier II reporting requirements (i.e. daily updates for high priority tickets).

· Onsite maintenance, as requested; includes coordinating site/theater access, notifications, and other activities necessary to deploy team members to individual sites.

· Coordinate with vendor to resolve advanced operational issues such as defects or other deficiencies that are degrading system performance and/or function.

· Coordinating with appropriate site personnel, and DISA property team, to properly track and account for system equipment in the event that equipment is moved as a result of Tier III support activities (i.e. RMA); includes completing necessary forms such as DD1149, DD1150, and DA316 Property Management forms.

· Information Assurance (IA) – lab scans and resolution of IA findings.

· Testing of patches in the lab and creation of installation procedure for production systems.

· Supporting installation of patches on production equipment.

· Designing and testing capabilities to address operational issues or shortfalls.

Deliverables:

· System updates procedures.

· DISA Task Order (DTO).

· Test procedures and result.

· A&A (scan and DTO) mitigation plan.

· Property Movement Forms (as needed).

· Updated Rack Diagram (as needed).

· Updated Cabling and Interfaces Diagram (as needed).

· Inventory Reports.

· Weekly Shipping Report (incoming/outgoing equipment).

· Monthly RMA (Return Merchandise Authorization) reports.

6.3.2 Subtask 2 - Sensing Lab. The sensing programs are often called upon to build and test new and existing cyber related tools and technologies. This is primarily due to the secure design of the sensing environment, but also because all cyber related data flows through the data brokering service. The contractor shall provide a sensing lab for the sensing capabilities that can support security testing, integrating testing, verification and validation testing and all aspects of system updates. All interoperability testing within the sensing lab shall be performed in coordination with the Joint Interoperability and Testing Command (JITC) at Ft Meade. The lab shall be designed and built within the JITC lab or in a DOD approved cloud solution. The contractor shall develop a sensing Lab Concept of Operations (CONOPS) that shall present the Government with the best value approach for the environment in which the sensing lab will be deployed. This sensing Lab shall support all baseline testing and be accessible from as many places of performance on the contract as possible.

Tasks include: installing hardware (if Government waiver is approved), installing virtual components as systems, installing servers, installing operating systems, installing software, uninstalling software, monitoring systems and processes, patching operating systems and software applications, installing network devices, configuring network devices, patching network devices, monitoring network devices, installing storage and database systems, patching storage and database systems, configuring and tuning system processes, and troubleshooting and resolving problems with lab projects.

The contractor shall appoint a service owner for the sensing lab environment who shall help create, document, and maintain a lab SDP that defines all aspects of the service throughout all stages of its lifecycle. The SDP shall be updated anytime there is a change to the architecture, financial posture or requirements of the service. The Service Owner shall be the primary internal and external SME for the service they are assigned to manage. The SME shall always be aware of the state of their service and report on that status to the Government as required. The service owner shall work with all other sensing business managers to ensure that their service is providing value to the sensing programs and its mission partners and users.

Deliverables:

· Lab Architecture and Setup for Sensor Testing.

· Sensing Lab CONOPS.

· Sensing Lab Test Plan.

· Sensing Lab Service Design Plan.

6.4 Task 4 – Authorization and Accreditation (A&A).

6.4.1 Subtask 1 – A&A for all capabilities except ASV. Upon award of the contract, the contractor shall support A&A of the sensing capabilities via the Risk Management Framework (RMF). The appointed Designated Approving Authority is required to accept all residual risk before granting the Authority to Operate (ATO). The solution must receive an ATO before it is placed on any DoD operational environment. The ATO must be maintained for the entire life of the contract. The Government will review the contractor’s solution and report findings/non-compliance to the contractor. The contractor shall review the findings monthly, identify a mitigation solution, and submit a findings and remediation report to the Government. The contractor shall be required to provide a SME on site to support C&A activity at the Fort Meade location.

Per DOD directive 8500.1, all hardware, firmware, and software will be STIG and IAVA compliant, and information systems shall be assessed using the RMF process before being allowed to process DoD information or connect to a DoD network, unless waived in part by the Government due to critical operational issues. All hardware shall be labeled with the appropriate classification level, labeled with the appropriate inventory control number, labeled with the hardware identification, documented, and inventoried. All cables shall be labeled at each site for easy identification by local POCs. A standard install/rack elevation and wiring configuration shall be followed IAW the sensing PM’s instructions.

Baseline configuration will be based upon accredited sensing Type-accreditation by the DISA CIO. The contractor shall be responsible for maintaining the baseline at the Ft Meade lab and work with Operations to ensure that all systems in the field are configured IAW the baseline unless approval is received by Chief, Infrastructure and Sensing Systems Branch. The contractor shall maintain all baseline systems in the Ft Meade lab and ensure they are updated monthly with the latest patches, fixes, and updates necessary to maintain their ATO. The sensing capabilities baseline shall be scanned monthly with approved compliance software and remediated by the contractor IAW CTO 08- 005.

The contractor shall be responsible for running weekly scans based off the required current software/ hardware on the baseline, uploading findings to the DISA current reporting system, and mitigating and STIG or IAVA related findings required to maintain the security compliance of the baseline IAW the sensing ATO’s.

For the sensing capabilities baseline, the contractor shall be responsible for deploying all patches to comply with a published IAVA/B/T. If necessary, the contractor shall be responsible for developing the POA&M and mitigation dates for OPS to update DISAs current reporting system.

· Continuity of Operations.

· Operational Sustainment, Support and Evolution.

· Configuration Management.

Deliverables:

· Supporting documentation for A&A process.

· Any applicable POA&M.

6.4.2 Subtask 2 – A&A for ASV Only. The contractor shall support A&A of the ASV capability via the RMF as defined in section 6.4.1 Subtask 1.

The base year support shall start later than the contract award date on 03 August 2025 through 02 March 2026. Option year support will align with the contract’s option year dates of 03 March 2026 – 02 March 2027 and 03 March 2027 – 02 March 2028.

Deliverables:

· Supporting documentation for A&A process.

· Any applicable POA&M.

6.5 Task 5 – Sensing Development (Optional). As part of the development phase for DISA sensing software and hardware capabilities and the integration with networks, the contractor shall assist the Government in determining the most efficient and relevant business processes to implement beneficial updates to the sensing system. The contractor shall be responsible for identifying and engineering solutions to support DoD’s requirement to protect and defend the DoDIN. The contractor shall design and document sensor systems that fulfill the JFHQ-DoDIN role. The contractor shall use to the maximum extent possible, COTS and GOTS solutions. The contractor shall consider scalability and integration issues with existing technologies and network infrastructures whether on premises, in the cloud or a combination of the two. The contractor shall provide engineering reports that list the advantages and disadvantages for selecting and integrating a suggested sensor system and configuration solution.

Deliverables:

· White Paper.

· Analysis of Alternatives.

6.5.1 Subtask 1 - Program Management Support. The contractor shall fully support the business processes of the sensing programs by providing support to include the drafting of memos, briefings, and reports by a technical writer; audio/video support and audio teleconferencing for the sensing program. The contractor shall provide program management support for all developed processes, documents, and other associated products necessary to support the sensing program's success. The contractor shall assist the Government in establishing repeatable processes, SOPs, and Techniques, Tactics, and Procedures within the ITIL framework. The contractor shall also ensure that meeting minutes are kept for all official meetings and shall be delivered to the Government as directed.

The contractor shall conduct a formal Weekly Status Meeting to the ID6 leadership and sensing PM that reviews all projects currently required to be tracked by the Government. The contractor shall conduct each Weekly Status Meeting with a coordinated agenda, briefing materials, and document minutes. The Weekly Status Meeting shall provide for task order level interchanges between the Government within ID6 and the contractor. The Weekly Status Meeting shall provide a forum to address technical and programmatic topics of the contract and may include contractor proprietary information.

The contractor shall provide a Monthly Status Report outlining the progress of all projects. This Monthly Status Report shall show both completed and future project milestones and shall clearly identify any risks or issues that require Government interaction. The Monthly Status Report shall include the level of effort or labor hours broken down by each task or project. The Monthly Status Report shall be briefed in the Monthly Status Meeting and then distributed by close of business that same day to the sensing PM.

The contractor shall provide a Monthly Status Report. Information within the Monthly Status Report shall be used by the contractor to provide a summarized review of all deliverables accomplished within the given month and shall report on cost, schedule, and performance. The Monthly Status Report shall highlight major accomplishments and their impact on the sensing mission to protect and defend the DODIN. In addition, the Monthly Status Report shall include an overall quality metric for the work being performed on the contract, financial information from the contractor’s Financial Manager including charging and invoicing information related to the contract, and availability metrics from the Availability Manager. The information provided within the Monthly Status Report will be used to update the Contractor Performance Assessment Reports System (CPARS).

The contractor shall provide the sensing PM with an event driven Integrated Master Schedule (IMS) for the sensing program. The contractor shall use Microsoft Project or other software designated by the Government for developing and maintaining the schedule. The contractor shall leverage an agile framework like SAFe to manage the IMS. The contractor shall review and identify any dependencies or interrelationships between the task order and other program efforts and significant dates. The contractor shall prepare and maintain an IMS for the overall task order to include schedules for each subtask and the level of effort (LOE) for task completion. The IMS shall address dependencies, risks, key milestone events, critical path activities, and delivery dates. The schedule shall also outline all resources assigned to individual tasks and the LOE for each task’s completion. The contractor shall coordinate with the appropriate Government Functional Leads and assess the risks identified in the schedule and recommendation for program resolution. The schedules shall be developed and base-lined in collaboration with the Government schedule team. The base-lined schedule shall not be modified without the Government PM approval. The schedule shall be coupled with weekly management control meetings to ensure all organizations and activities underway are coordinated and support the objectives of the overall program. The contractor shall submit an updated IMS to the Government PM on a weekly basis.

Deliverables:

· Monthly Status Report.

· Weekly Quad Charts.

· Weekly Activity Report.

· Meeting Minutes.

· Integrated Master Schedule.

6.5.2 Subtask 2 – Requirement Analysis. The contractor shall support the Government to establish and decompose requirements for the sensing capability. The contractor shall maintain a Requirements Traceability Matrix (RTM). The contractor shall conduct a System Requirements Review/System Functional Review (SRR/SFR) to analyze project cost, schedule, and performance requirements to determine sufficiency for developing a technical solution. The contractor shall document assumptions and risks. The contractor shall provide technical consultation to internal and external Agency customers to refine requirements and to provide potential courses of action for developing the sensing solution.

Deliverables:

· RTM.

· SRR/SFR briefings.

6.5.3 Subtask 3 - Systems Engineering. The objective of the Systems Engineering subtask area is to establish the technical framework for delivering materiel capabilities to secure the infrastructure. The contractor shall develop, maintain, and execute the program’s Systems Engineering Plan (SEP) that aligns with program plans. The contractor shall develop an architecture that ensures conformance to standards, requirements, and associated systems. The contractor shall use the DoDAF, and/or other framework(s), as specified by the Government.

Deliverable:

· SEP.

· User Stories.

· Reference, enterprise and solution level architectures.

· Initial Capability Document.

· Capability Development Document.

6.5.4 Subtask 4 - Preliminary Designs. The contractor shall provide preliminary designs in support of project and customer requirements. Preliminary designs include the initial design mapped to requirements, testing requirements, and rough order of magnitude solutions with the initial Manufacturing Bill of Materials (MBOM) and a cost estimate. The contractor shall prepare artifacts for Preliminary Design Reviews (PDR)s and other decision forums. The contractor shall work with the Government to determine an appropriate scope for an initial preliminary architecture and design pass prior to implementing the Release Plan, which will be subject to final approval by the Government. The preliminary architecture and design shall be presented at the PDR along with the IMS and Release Plan and contain sufficient detail to transition into development iterations/sprints upon acceptance by the Government.

Deliverables:

· PDR Brief.

· Draft of system diagrams.

· Draft of system design description.

· Draft interface control document.

6.5.5 Subtask 5 - Final Designs. The contractor shall provide final designs in support of project and customer requirements. Final Designs include complete design solutions mapped to requirements, test results, request for work, final MBOM with costs. The contractor shall prepare artifacts for Critical Design Reviews (CDR)s and other decision forums. The final architecture and design shall be presented at the CDR for decision making.

Deliverables:

· CDR Brief.

· Final system diagram.

· Final system design description.

· Interface control document.

· Product Life-Cycle Management Plan.

· Test and evaluation strategy.

· Build of Material.

· Request for Work.

6.5.6 Subtask 6 - Integration and Testing. The contractor shall integrate sensing software/ hardware solutions with associated networks to validate the various externally developed software packages and devices. Integration testing shall be completed to ensure that the individual software packages and devices work together as a whole with other software packages and devices. The integration tests shall validate:

The system and security requirements have been met and that there is no loss in prior functionality, and all interfaces interact in accordance with requirements so an Interoperability Certification can be achieved.

The contractor shall:

· Perform and support testing to ensure the operations and hardware/software are functioning as designed and that hardware and software requirements meet or exceed performance standards and are ready for delivery.

· Demonstrate that the system built complies with the system design and develop and verify a complete set of usable deliverable system elements Perform integration verification.

· Demonstrate that the system is mature (e.g. no thrown exceptions, shutdowns/reboots, data resets, synchronization issues, manageability, etc.).

· Provide real-time reporting of issues, severity, and recommended course of corrective action during continuous integration testing.

· Deliver system release notes and test data, to accompany the system being delivered.

The contractor shall conduct four types of testing:

1. Regression Testing – The contractor shall develop an automated regression testing process that can be used to routinely verify previously released functionality has not been negatively impacted by new software/ hardware deployments. The automated regression testing process shall include data validation to ensure that the functionality demonstrated is also confirmed in system data. An electronic regression test plan shall be provided, the PMO envisions this to be a selectable test suite in the DevSecOps toolchain.

2. Performance Testing – The contractor shall conduct performance testing. Performance testing (load, stress, volume, response time, data collection) is used to determine how the system responds under a particular setting. During performance testing, the contractor shall collect performance and availability metrics from the identified suite for further analysis and to establish a performance benchmark. This may consist of a single capability or integrated capabilities with users performing multiple tasks. Data type, outage trends, slow response times, underperforming capabilities, and system anomalies must be investigated to document system behavior and identify corrective measures to meet system compliance with Key Performance Parameters (KPP). An electronic performance test plan shall be provided by the contractor and shall be a selectable test suite in the DevSecOps toolchain.

3. Interoperability and Integration Testing – The contractor shall test the interoperability and compliance of the system and interconnections, to include both internal and external interfaces. Resulting test reports shall outline the capabilities to ensure all interface standards have been met for feasibility of re-use and are interoperable. The contractor shall propose a methodology for validating that sensing data is consistent with the data received from the authoritative data sources. Data reported and visualized from the sensing system shall be in conformance with the KPPs (accurate, complete, timely and correct). Testing process shall include data validation to ensure that the functionality demonstrated is also confirmed in system data. An electronic interoperability test plan shall be provided, the PMO envisions this to be a selectable test suite in the DevSecOps toolchain.

4. Validation and Verification Testing – The contractor shall ensure that the services and supporting systems(s) have been built to the specified technical, functional, and operational requirements. The validation and verification process shall include requirement reviews, design reviews, code inspections, and product testing to ensure the analytics fulfill the specified requirements. Conduct validation and verification testing to include Unit Test and Internal Integration and Regression testing. Support the Government and/or third-party contractors in the execution of Independent Verification and Validation events. Perform administrative logistic support, test failure analyses, and lead requirements for system modifications, and resolution of any instrumentation issues.

Deliverable:

· Integration and test readiness review.

· Integration and test plan.

· Test procedures.

· Test report.

· Test scripts.

6.5.7 Subtask 7 – Government Acceptance. The contractor shall provide technical expertise to the Government acceptance activities. The testing requirements shall be built into the acceptance criteria for the user story, which will define the criteria for ‘done’ and ‘accepted’.

The contractor shall provide the test scripts necessary to prove that they meet the acceptance criteria. The contractor shall work with the Government to ensure test cases/scripts and results are provided in an efficient and meaningful manner (e.g., use of automated reports and shared repositories). The test cases shall be completely written at the beginning of a sprint and the test scripts shall be delivered alongside configured software and hardware. Both shall be submitted to the Government for verification.

Results from automated testing will be used by JITC as data for their Operational Test requirements; using the tests results to mitigate the risk to Operational Testing.

All Government tests are accomplished in the Government environments using the candidate version of software and hardware that will be fielded operationally in DISN environment like cloud or the disrupted, disconnected, intermittent and low bandwidth solution. The contractor shall propose an installation validation process to the Government and upon approval implement the approved processes. The contractor shall maintain a mechanism to validate that installations are equivalent. The contractor shall brief the solution at a TEM.

The contractor shall provide technical expertise to the administration and functionality during all Government test events. Test support shall be documented in the WSR.

The defect severity measures the impact on the application or capability. When the defects are identified, the Government will prioritize how important and urgent it is to fix the defects.

Defects discovered during testing shall be rated by severity. The severity rating is a system rating used to understand the impact of the defects on system operations. The following table documents the severity definitions used to categorize defects.

Table 3 - Severity Definitions

A serious compromise of national security, A hazardous condition which may result in fatal or serious injury to personnel or extensive damage or destruction of equipment, or A system halt (abnormal termination) in the production environment that prohibits mission accomplishments.

An additional priority rating is provided initially by the end user and functional sponsor and is used to document whether the defect discovered is of High, Medium, or Low priority. A user can provide a priority of high to functionality, which is not catastrophic and will not impede system performance; but is a high priority to be fixed. The contractor shall provide technical expertise in the Government defect review meetings providing the explanation of defects and a recommended severity. Severity 1 and 2 defects result in an unacceptable deliverable.

Deliverable:

· Acceptance test plan.

· Acceptance test procedures.

· Acceptance test report.

· Acceptance test scripts.

6.5.8 Subtask 8 – Release/ Deployment. The contractor shall produce and deliver a Release Management Plan that shall be executed upon Government approval. The plan shall cover the processes, systems, and functions to package, build, test and deploy a release into production. The contractor shall provide technical expertise to the Government in deploying the sensing solution. Deployment assistance shall include technical support and subject matter expertise to the Government while the Government deploys the sensing solution to an operational hosting provider such as a DISA EcoSystems, DISA Cloud environment, a forward operational hosting facility, etc.

The contractor shall perform activities including:

· Provide Release and Deployment Plans.

· Plan Pilot Releases.

· Coordinate on Logistics and Delivery Planning.

· Provide Release and Build Documentation.

· Provide Standard and Controlled Release Packages.

· Create engineering plan for each production site.

· Coordinate with the Review and Closure of a Deployment.

· Support deployment team during installation at production site.

· Limited deployment to The Continental United States (CONUS) sites if required.

The contractor shall be available during all installs via phone, MS Teams or any other approved real time, full duplex communications technology until OPS has verified that all hardware/software is working properly for at least 24 hours. Installation and Operation teams shall use this time to test reboots remotely and ensure everything comes back up, and automated system and health checks are functioning properly.

Deliverable:

· Release Management Plan.

· Deployment Plan.

· Deployment Support Report.

· Software package.

· Config files.

· Release and Build Documents.

6.5.9 Subtask 9 – Operational Testing (OT). The OT is an end user formal end-to-end functional system acceptance test conducted by JITC in the operational environment. In order to support OT, the contractor shall deploy the software/ hardware to an operational-representative environment. OT is conducted in the DoD unclassified/classified environment as the system will be accredited for DoD networks operation. The contractor shall provide technical expertise to the PMO and JITC in providing the scenario and mission threads used during the OT. The Government will provide all of the entrance and exit criteria required to satisfy the JITC OT requirement within the modernized sensing development test period. The contractor shall provide input and technical expertise to the Cooperative Vulnerability and Penetration Assessment (also known as Blue Team) by identifying system mitigations, proposed corrective action and recommended impact of issues found during the assessment. The contractor shall provide analysis, engineering, and solutions in response to the Adversarial Assessment (also known as Red Team) report. The contractor shall provide an Analysis and Remediation Plan to address potential functional, interoperability, and security vulnerabilities.

Deliverable:

· Operational Test Readiness Review Brief

· Operational Test and Evaluation Plan

· Operational Test Procedure

· Operational Test script

· Operational Test report

6.5.10 Subtask 10 - Familiarization and Training. The contractor shall provide demonstration and training for personnel based on roles and positions associated with the implemented sensing solution. Training courses shall be specifically designed and developed for DISA’s configuration and implementation. The contractor shall perform classified and unclassified familiarization training to personnel in support of Test and Evaluation activities and operation. The primary purpose of this familiarization training and demonstration is to familiarize personnel with the sensing solution and to ensure personnel can execute the applicable test and operational cases. The contractor shall perform classified and unclassified demonstrations of sensing solution to the Government on a per sprint basis showing progress towards achievement of the Release Management Plan. This shall include preparing briefing slides, drafting demonstration scripts, and conducting the demonstrations as the subject matter expert of the sensing solution. Demonstrations shall be tailored to the intended demonstration audience. With each demonstration, the contractor shall provide the Government with a script to allow Government personnel to try out the functionality on the contractor’s maintained First Look Site.