832571285 PWS_ ATAT DAPPS.docx

PERFORMANCE WORK STATEMENT

Sources Sought Notice

1. Contracting Officer’s Representative.

a) Primary Contracting Officer’s Representative (COR). See Defense Information Technology Contracting Organization (DITCO) Additional Text G1 - Points of Contact.

b) Alternate COR. See DITCO Additional Text G1 - Points of Contact.

c) Property Administrator. See DITCO Additional Text G1 - Points of Contact.

2. Contract or Task Order Title. Defense Information Systems Agency (DISA) J-9 Hosting and Compute (HaC) Enterprise Account Tracking and Automation Tool (ATAT) and Acquisition Package Preparation System (DAPPS) Solution.

3. Background. The ATAT development contract was awarded in 2021 under contract HQ003421C0011. ATAT was designed to support the Joint Enterprise Defense Infrastructure (JEDI) cloud strategy. This support included providing cloud services acquired by the Department of Defense (DoD) with built-in controls and oversight. These controls were intended for security, billing support, acquisition package development, and ease of use. The goal was to enable rapid access to modern enterprise cloud services across the DoD. The requirements for ATAT changed as the needs of the JEDI changed with the evolving Joint Warfighter Cloud Capability (JWCC) contract. The ATAT Minimally Viable Product (MVP) was successfully in place at the award of the JWCC contract in December 2022. The scope of the contract was contractually increased in May 2023 by the addition of acquisition package generation through the DAPPS tool, providing customers complete integration from package generation to cloud reporting. Continued sustainment and development of both ATAT and DAPPS is required for the JWCC contract.

4. Objectives. The DoD is looking for a solution to maintain the current ATAT and DAPPS applications as they require support for any further program modifications needed to meet the requirements of JWCC customers and stakeholders. This solution will also provide helpdesk services at tier 1-3 levels for these applications, ensuring that any issues or problems are addressed in a timely and effective manner.

In addition, the solution shall continuously update DAPPS to maintain alignment with current contracting standards and documents from DITCO and the JWCC Program Management Office (PMO). Similarly, the solution shall continuously update ATAT to maintain technological relevance, ensuring that the application remains up to date and useful to users.

The solution shall integrate stakeholder feedback into development and sustainment efforts to continually improve the stakeholder experience with the programs. This will ensure that the applications are meeting the needs of users and that any issues or problems are addressed without causing undue delays upon users of ATAT or DAPPS

Finally, the documentation shall adhere to standard software development practices. This will involve providing comprehensive information transfer to any subsequent engineering endeavors that necessitate the use of the application's code. The aim is to ensure that the applications are sufficiently documented, enabling any potential future development or maintenance activities to seamlessly continue from the current solution's stopping point.

5. Scope. The work required for this contract covers the following areas:

· Infrastructure and development pipeline engineering and management in a cloud environment, within ServiceNow, and within a government code hosting solution (e.g. GitLab).

· Application engineering within ServiceNow and cloud environments, developing new features and modifying existing capabilities of a customer-facing webpage, a database, and several Application Programming Interfaces (API) connecting to government and non-government programs at an Information Level (IL) 4-5 level.

· Interfacing with stakeholders for the ATAT/DAPPS programs to gather feedback and metrics, to include application users, Contract Office staff, and JWCC PMO.

· The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this Performance Work Statement (PWS). Surge support over the life of the contract shall not exceed 50% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to DARS 17.202-90.

6. Performance Requirements.

6.1 Task 1 - Program Management.

6.1.1 Subtask 1 - Coordination and Communication

The contractor shall coordinate with the Product Owner, Contracting Officer, and Contracting Officer's Representatives (COR) by attending meetings (both in-person and remote, as appropriate). The contractor shall provide status updates and metrics on standard program management topics, including but not limited to:

· Schedule

· Delivery

· Resource allocation

· Post-mortems

The contractor shall support Government efforts for document review and approval and manage project schedules in accordance with the PWS.

6.1.2 Subtask 2 - Issue and Risk Management

The contractor shall identify and communicate issues and risks to the Government and offer recommendations on how issues/risk will be mitigated to successfully satisfy the requirements. The contractor shall notify the COR when the contractor believes that any Government activity may impact performance, schedule, or cost.

6.1.3 Subtask 3 - Advisory Assistance

The contractor shall provide advisory assistance to other government programs, supplemental to all deliverables and/or transition plans, to include:

· Training sessions to government teams that are utilizing the ATAT documentation and training deliverables.

· Support to other government projects that are interfacing with ATAT or DAPPS, including sending contractor personnel to assist in their understanding of ATAT lessons learned, training plans, Agile methodology, or other documentation.

· Participating in initial planning meetings for other projects, providing the expertise and experience directly related to the work done on ATAT and guiding other projects away from failures experienced in ATAT and towards solutions and processes identified in the ATAT documentation.

6.2 Task 2 - Agile Project Management.

6.2.1 Subtask 1 - Agile Methodologies

The contractor shall ensure all new software development uses modern software development methodologies (e.g., Agile, DevSecOps) to support rapid delivery of standardized, reliable, integrated, and secure mission capabilities. The contractor shall demonstrate a corporate culture of modern software development and management practices.

6.2.2 Subtask 2 - CI/CD Pipeline

The contractor shall ensure implementation of a continuous integration and continuous delivery (CI/CD) pipeline.

6.2.3 Subtask 3 - Metrics

The contractor shall provide Agile Information Radiators (i.e. data metrics) to monitor the development, application, and deployment technology programs.

6.2.4 Subtask 4 - Process Implementation

The contractor shall implement the following:

· A centralized code repository.

· A complete tracking system for all engineering, design, and operations work, including, but not limited to, the following:

· Estimations of work per item.

· Detailed descriptions of the item with acceptance criteria.

· Important dates, such as task start and completion.

· Status markets, such as “To Do/In Progress/Blocked”.

· A proven process (e.g. Jira) to manage all code changes, approvals, and baselines.

· Automated software build tools for compiling of code and dependencies into software artifacts while maintaining version control.

· Automated functional testing tools for unit and integration testing.

· Automated security testing tools.

· An automated deployment process to manage deployment operations configurations and delivery.

· An ability to manage multiple parallel and continuous streams, to include:

· Requirements elicitation (e.g. storytelling, storyboarding, use case creation).

· Rapid development security continuous interaction cycles including all necessary testing.

· Optimized deployment operations with continuous process system injections/integration into the production environment.

· Continuous user feedback processes.

6.3 Task 3 - ATAT Provisioning Processes.

The contractor shall operate, maintain, and engineer improvements upon the existing solution to JWCC cloud provisioning. The required product must continue to enable government programs with JWCC task orders to rapidly gain access to their ordered cloud environments. It must maintain the JWCC side of the API connection to the Cloud Service Providers (CSPs), as specified in the base JWCC contract, and use that connection to facilitate rapid and automatic communication of technical and contract details to CSPs to enable cloud environment creation.

6.3.1 Subtask 1 - Requirements Management

The contractor shall collect and document functional and non-functional requirements from stakeholders using Agile methodologies such as user stories, acceptance criteria, and sprint planning. The contractor shall manage and prioritize the product backlog, aligning with the Government’s priorities.

6.3.2 Subtask 2 - System Design

The contractor shall perform the following actions:

· Develop design documents that serve as the basis of all staging, configuration, and testing efforts.

· Support a design review session to validate the design information and ensure system stability.

· Iteratively refine the system design through regular design reviews and collaboration with stakeholders.

· Analyze identified design issues, consider design alternatives, and present a recommended solution.

· Maintain a design library that includes the entire customer-facing side of the application, standard elements used throughout the product and proposed alternate designs for system improvements.

6.3.3 Subtask 3 - Software Development

The contractor shall ensure all new software development uses modern software development methodologies (e.g., Agile, DevSecOps) to support rapid delivery of standardized, reliable, integrated, and secure mission capabilities (e.g. the code is free from all computer viruses, worms, time-outs, time bombs, back doors, disabling devices and other harmful or malicious code). The contractor shall notify the Government within 30 minutes of malicious activity embedded within one of the contractual deliverables. The contractor shall ensure the software is compatible with government operational systems. The contractor shall develop any requested system diagrams, flow charts, or other technical documentation to support the infrastructure, code, or evaluation. The application(s) source code shall be made available to the Government for a code review and analysis upon request.

6.3.4 Subtask 4 - Test and Evaluation

The contractor shall design and maintain the necessary development and test environments to support interfaces between multiple systems, new development, and upgrades of existing systems prior to integrating into the live production environment. The contractor shall implement and integrate new test tools to account for new features, capabilities, and connections. The contractor shall develop a standard testing template, testing process, build documents, and perform testing tasks from a Government-approved set of requirements. The contractor shall test all produced code and integration efforts before deployment to production, to include:

· Unit/component testing

· Regression testing

· Load and stress testing

· Interoperability and integration testing

· User Acceptance Testing (UAT)

6.3.5 Subtask 5 - Security

The contractor shall ensure all security-related alerts are configured and logged in accordance with government standards, as defined by the STIGS and other controls in the ATAT Authority to Operate (ATO). The contractor shall work with the designated Cybersecurity Services Provider (CSSP) to conduct security investigations. The contractor shall complete any/all security remediations or mitigation efforts within the timeframe set by the CSSP and COR. The contractor shall provide support for the Assessment and Authorization (A&A) process, which involves gathering all necessary artifacts, conducting testing, and providing demonstrations. This support is required to achieve an approved package or maintain an ATO to enable operational status within the DoD environment. The contractor shall not be responsible for the A&A of the application via the Risk Management Framework (RMF) process. The contractor shall provide all necessary documentation to the Government during the A&A process and any other required authorizations.

6.4 Task 4 - ATAT Data Reporting.

The contractor shall operate, maintain, and engineer improvements upon the existing solution to JWCC cloud data reporting. The required product must continue to gather contract cost data from the JWCC CSPs and provide breakdowns of live costing data alongside the contract funding information to stakeholders identified by the COR/Product Owner (PO), including, but not limited to, JWCC customers, the JWCC PMO office, and DISA leadership.

6.4.1 Subtask 1 - Requirements Management

The contractor shall collect and document functional and non-functional requirements from stakeholders using Agile methodologies such as user stories, acceptance criteria, and sprint planning. The contractor shall manage and prioritize the product backlog, aligning with the government’s priorities.

6.4.2 Subtask 2 - System Design

The contractor shall perform the following actions:

· Develop design documents that serve as the basis of all staging, configuration, and testing efforts.

· Support a design review session to validate the design information and ensure system stability.

· Iteratively refine the system design through regular design reviews and collaboration with stakeholders.

· Analyze identified design issues, consider design alternatives, and present a recommended solution.

Maintain a design library that includes the entire customer-facing side of the application, standard elements used throughout the product and proposed alternate designs for system improvements.

6.4.3 Subtask 3 - Software Development

The contractor shall ensure all new software development uses modern software development methodologies (e.g., Agile, DevSecOps) to support rapid delivery of standardized, reliable, integrated, and secure mission capabilities (e.g. the code is free from all computer viruses, worms, time-outs, time bombs, back doors, disabling devices and other harmful or malicious code). The contractor shall notify the Government within 30 minutes of malicious activity embedded within one of the contractual deliverables. The contractor shall ensure the software is compatible with government operational systems. The contractor shall develop any requested system diagrams, flow charts, or other technical documentation to support the infrastructure, code, or evaluation. The application(s) source code shall be made available to the Government for a code review and analysis upon request.

6.4.4 Subtask 4 - Test and Evaluation

The contractor shall design and maintain the necessary development and test environments to support interfaces between multiple systems, new development, and upgrades of existing systems prior to integrating into the live production environment. The contractor shall implement and integrate new test tools to account for new features, capabilities, and connections. The contractor shall develop a standard testing template, testing process, build documents, and perform testing tasks from a Government-approved set of requirements. The contractor shall test all produced code and integration efforts before deployment to production, to include:

· Unit/component testing

· Regression testing

· Load and stress testing

· Interoperability and integration testing

· UAT

6.4.5 Subtask 5 - Security

The contractor shall ensure all security-related alerts are configured and logged in accordance with government standards, as defined by the STIGS and other controls in the ATAT ATO. The contractor shall work with the designated CSSP to conduct security investigations. The contractor shall complete any/all security remediations or mitigation efforts within the timeframe set by the CSSP and COR. The contractor shall provide support for the A&A process, which involves gathering all necessary artifacts, conducting testing, and providing demonstrations. This support is required to achieve an approved package or maintain an ATO to enable operational status within the DoD environment. The contractor shall not be responsible for the A&A of the application via the RMF process. The contractor shall provide all necessary documentation to the Government during the A&A process and any other required authorizations.

6.5 Task 5 - DAPPS Package Creation.

The contractor shall operate, maintain, and engineer improvements upon the existing solution for JWCC acquisition package preparation. The required product must continue to provide the sole method for producing draft JWCC contract packages. These packages must adhere to the latest JWCC PMO guidance as well as to DITCO submission standards. The application must provide a smooth user experience and must be able to produce acceptable JWCC contract documents.

6.5.1 Subtask 1 - Requirements Management

The contractor shall collect and document functional and non-functional requirements from stakeholders using Agile methodologies such as user stories, acceptance criteria, and sprint planning. The contractor shall manage and prioritize the product backlog, aligning with the government’s priorities.

6.5.2 Subtask 2 - System Design

The contractor shall perform the following actions:

· Develop design documents that serve as the basis of all staging, configuration, and testing efforts.

· Support a design review session to validate the design information and ensure system stability.

· Iteratively refine the system design through regular design reviews and collaboration with stakeholders.

· Analyze identified design issues, consider design alternatives, and present a recommended solution.

Maintain a design library that includes the entire customer-facing side of the application, standard elements used throughout the product and proposed alternate designs for system improvements.

6.5.3 Subtask 3 - Software Development

The contractor shall ensure all new software development uses modern software development methodologies (e.g., Agile, DevSecOps) to support rapid delivery of standardized, reliable, integrated, and secure mission capabilities (e.g. the code is free from all computer viruses, worms, time-outs, time bombs, back doors, disabling devices and other harmful or malicious code). The contractor shall notify the Government within 30 minutes of malicious activity embedded within one of the contractual deliverables. The contractor shall ensure the software is compatible with government operational systems. The contractor shall develop any requested system diagrams, flow charts, or other technical documentation to support the infrastructure, code, or evaluation. The application(s) source code shall be made available to the Government for a code review and analysis upon request.

6.5.4 Subtask 4 - Test and Evaluation

The contractor shall design and maintain the necessary development and test environments to support interfaces between multiple systems, new development, and upgrades of existing systems prior to integrating into the live production environment. The contractor shall implement and integrate new test tools to account for new features, capabilities, and connections. The contractor shall develop a standard testing template, testing process, build documents, and perform testing tasks from a Government-approved set of requirements. The contractor shall test all produced code and integration efforts before deployment to production, to include:

· Unit/component testing

· Regression testing

· Load and stress testing

· Interoperability and integration testing

· UAT

6.5.5 Subtask 5 - Security

The contractor shall ensure all security-related alerts are configured and logged in accordance with government standards, as defined by the STIGS and other controls in the ATAT ATO. The contractor shall work with the designated CSSP to conduct security investigations. The contractor shall complete any/all security remediations or mitigation efforts within the timeframe set by the CSSP and COR. The contractor shall provide support for the A&A process, which involves gathering all necessary artifacts, conducting testing, and providing demonstrations. This support is required to achieve an approved package or maintain an ATO to enable operational status within the DoD environment. The contractor shall not be responsible for the A&A of the application via the RMF process. The contractor shall provide all necessary documentation to the Government during the A&A process and any other required authorizations.

6.6 Task 6 - Operations, Maintenance, and Sustainment.

The contractor shall operate, maintain, and engineer improvements upon the existing ATAT and DAPPS tools and all production systems derived from tasks 6.3-6.5.

6.6.1 Subtask 1 - Operations, Maintenance, and Sustainment

The contractor shall provide operations, maintenance, and sustainment to include:

· Providing maintenance to the Government's current and future perpetual licenses, with unlimited usage to the Government (i.e. ensuring all software licenses in use are maintained and renewed before expiration).

· Providing six (6) months' notice to the COR and PO if operations or maintenance schedules will be affected due to either product end of life (EOL) or product sunsetting.

· Developing a systematic approach and metrics for tracking defect rates, resolution times, and release cycles, and documenting and implementing fixes.

· Recovery of all operational data in the event of disaster.

· Managing, maintaining, and publishing approved patches, updates, changes, and new capabilities/baselines to production.

6.6.2 Subtask 2 - Documentation Management

The contractor shall:

· Gather and make available to the Government all necessary documentation, including testing reports, procedures, baseline configuration guides, and lessons learned.

· Organize all artifacts within the appropriate Government-provided web portal.

· Validate and ensure the current document version is being utilized and that superseded versions are archived.

6.6.3 Subtask 3 - Life Cycle Support

The contractor shall provide Life Cycle Support (LCS) for the systems and document all security guideline violations and incidents to the Government COR/Assistant Contracting Officer's Representatives (ACOR).

6.6.4 Subtask 4 - Helpdesk Support

The contractor shall act as Tier 1, 2, and 3 helpdesk support for users of the systems, to include:

· Logging and tracking all trouble calls/tickets through resolution.

· Upon notification of incidents, the contractor shall respond to the end user within 2 business hours to update actions and mark the ticket status to “In Progress”.

· Immediate notification and ticket updates shall be made to the end user once the issue is resolved.

· Service Level Agreements (SLA) shall be determined between the contractor and the COR/PO for all levels of ticket priorities.

Deliverables.

*Standard Distribution: One (1) copy of the transmittal letter without the deliverable to the Contracting Officer; one (1) copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

Contain required information, 90% accurate/error free, and delivered on time.

Any required revisions are:

· Resolved within 1 week.

· Accepted by Contracting Officer (KO) or COR.

Inspection of all 6.1 delivered materials, as listed in the Deliverables section.

Task: 6.2.2, 6.2.3

CI/CD pipeline documentation contains required information, 90% accurate/error free, and delivered on time.

Metrics are understandable and comprehensive.

Any required revisions are:

· Resolved within 1 week.

· Accepted by KO/COR/PO.

Inspection of delivered materials, to include the pipeline documentation, the MSR and any/all relevant metrics, as determined by the COR/PO.

Any required revisions are:

· Resolved within 1 week.

· Accepted by KO/COR.

Product owner or COR inspects tickets before work-start

Any required revisions are:

· Resolved within 1 week.

Weekly or ad-hoc design meetings with the PO covering all new designs

Metrics on error rates, bugs, and test results will be available upon request to the COR and Product Owner.

Inspection of delivered materials

A&A deliverables are on time and >95% accurate.

Inspection of delivered materials

6.6.1

· Unscheduled outages are controlled so that the application is available for over 95% of business hours.

· All ASIs are appropriately coordinated and planned.

· Deficits are tracked, managed, and resolved in a timely fashion.

Measurement of down-time per month.

Tier 1: Resolved or returned to customer within 24 hours.

Tier 2: Resolved or returned to customer with 3 business days.

Tier 3: Resolved or returned to customer within 7 business days.

Monthly inspection of ticket tracking system

8. Incentives.

RESERVED

9. Place of Performance.

Mission Location: 2530 Crystal Drive, Suite 3E26, Arlington, VA 22202

The contractor shall perform unclassified work in support of this contract at the contractor site. Classified work will be limited to government locations outlined in the DD254. Travel is required to the National Capital Region at least once on a quarterly basis.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. The contractor shall be required to account for the physical location of their personnel should this information be requested by the COR. The contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Long distance travel within CONUS is required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the contractor incurring the cost in support of this contract.

10. Period of Performance. The period of performance will include a 1-month Transition Period, 8.5 month Base Period and four (4) 12-month option periods.

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

This requirement is a task order under an existing Indefinite Delivery Contract or Multiple Award Schedule (MAS) and the base Contract or MAS security requirements/DD254 covers all Tasks Orders. DD254s are not required for individual task orders.

The contractor shall coordinate visits with site POC providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References.

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. Security Executive Agent Directive 4, National Security Adjudicative Guidelines, 8 June 2017

m. DoDM 5400.07, Freedom of Information Act Program

n. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

o. DoD Instruction 8510.01, “Risk Management Framework for DoD Systems,” July 19, 2022

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore, the company must have an interim or final Secret, Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.1 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way must be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

11.3 Investigation Requirements.

11.3.1 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation, formerly known as a National Agency Check, Local Agency Check, and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.3.2 The contractor is required to have personnel cleared with an interim or final Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel must also have interim or final clearance Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization. Visit requests shall be processed and verified through the DISS to Security Management Office (SMO) DKABAA10 and DKAHaCC. DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the contract/order number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in PWS/Statement of Work (SOW) Section 1.0.

*Prior coordination with the DISA COR must be made via email to ensure the Visit Authorization Letter (VAL)/Visit Authorization Request (VAR)/Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN must be sent via email to the appropriate COR. The VAL/VAR/VTN must be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. DISS verification of Visit Authorization by Security Manager

4. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e. Start date / End date)

11.4.2 VTN Package. The contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/task order/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology

Other actions:

· Incidents involving violence in the workplace or harassment

· Misuse of time

· Inspector General or General Counsel related inquiries

· Failure to comply with security policies and procedures

· Other reasons that prompted removal of a contractor

The VTN must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

· Date contractor CAC was collected

· Name of COR/Alt COR

· Termination Date

· Reason for Termination

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-4039 or via mail at:

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: DISA J9 HC23 Cyber Division Phone Number: 703-614-5157 E-mail: disa.meade.j-9.list.hc2-cloud-cyber-team@mail.mil

11.6 Information Security and Other Miscellaneous Requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3 Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke contractor personnel access to DISA facilities and networks, who violates one or more of Security Personnel Adjudicative guidelines, harassment or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain Controlled Unclassified Information (CUI) at the Government and/or contractor] facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the Government and/or contractor] facility. Contractor personnel will have access to, generate, and handle classified material up to SECRET level only at the Government and/or contractor location(s) (Ref: Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 3, DoD Information Security Program: Protection of Classified Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI).

A. GFP will not be provided for this contract.

B. Intellectual Property (IP) will be made available, and hand receipted to the contractor for use during the performance of the contract. Below is an estimated list of IP, this estimate is not considered a comprehensive list and more or less IP maybe provided in performance of the contract. IP shall be managed IAW the terms of H8, Defense Information System Agency Incidental Property Management (Apr 2021) or subsequent updates.

Estimated IP to be provided:

1. Existing codebase for the ATAT/DAPPS programs, including DSP application and database configurations, historical builds, and infrastructure-as-code used to support the program.

a. All code is hosted within Vulcan’s GitLab instance, in the following repositories:

i. ServiceNow “SNOW” (XML, Javascript)

ii. Amazon Web Services (AWS) “Hoth API” (typescript, CDK)

iii. UI “WebUI” (typescript, Vue)

iv. CSP orchestration API (yaml)

v. Supporting repos (docker + javascript/typescript/CDK)

2. Existing Ci/CD pipeline

a. Gitlab (Vulcan instance) and AWS

3. Existing Agile management software and tracking system

a. Jira, licensed and run through Vulcan’s on-prem solution

4. Existing metrics and metric tracking systems

a. Jira (PM and agile metrics)

b. Gitlab (code coverage, quality, etc)

5. Existing Design libraries and design files

a. Figma

6. Existing testing automation

a. Cypress tests (javascript/typescript)

b. Gitlab Security/code checks and code analysis

i. unit tests (test files within each repo)

c. Mock test data generation repos (Java)

i. Task order generation

ii. Integration testing with CSPs

7. Existing security logs and logging solution

a. AWS cloudTrail/cloudWatch

b. AWS SecurityHub

c. S3 shared to DISA CSSP

d. custom audit logs in DSP/SNOW

e. DSP managed logs

8. Existing service ticketing management solution and records

a. ServiceNow integration w/ DSP

13. Other Pertinent Information or Special Considerations.

All tasks in section 6 are currently being accomplished with the IP described in section 12. The existing solution is fully authorized and is operating within a Development, Test, Pre-Production, and Production environments. There are 6 existing integrations with ATAT/DAPPS, which are:

1. DISA Services Platform (DSP)

a. A government-owned instance of ServiceNow, connects to the AWS environment used for DAPPS/ATAT backend, and includes connections out to the following systems:

i. Electronic Documents Management System (EDMS): the DITCO contracting system for documents management

ii. Electronic Data Access: a DoD-wide contracting system

iii. Contracting Support System: DITCO contracting system for case management

iv. G-invoicing: Treasury department system, used to gather and verify financial forms

v. J-9 C2: Tracks DSP UI up-time via their SiteScope tool

2. CSPs

a. AWS, Azure, Oracle, Google, per JWCC contract

3. DISA CSSP

a. DISA CSSP pulls logs from our AWS environment

4. Advana

a. Chief Information Officer (CIO) owned C2 system

5. Salesforce

a. DISA J-9 reporting, tracking, and Case management system

6. Enterprise Mission Assurance Support Service

a. automatically updates security status

a. Identification of Possible Follow-on Work. This contract heavily relies on the current JWCC contract. With a potential award of a follow-on to the JWCC contract (JWCC Next), this contract may need to conclude and have the ATAT/DAPPS workload move to a separate contract more aligned towards the different objectives of JWCC Next.

Upon this contract’s completion or during one of the option years, there may be a desire to expand the scope of the DAPPS tasks to more than just JWCC customers. Opening the tool for other similar contract types may require a separate contract; however, the technical work would borrow heavily from the established documentation and codebase from the ATAT/DAPPS contract.

b. Identification of Potential Conflicts of Interest. There are no known actual or perceived conflicts of interest for this acquisition. However, the solicitation will include the local DITCO Instruction entitled “Organizational and Consultant Conflicts of Interest” which requires the Offeror, inclusive of teaming partners, to represent, in response to the solicitation, whether their team has or does not have a conflict of interest. If a conflict of interest is identified, the Offeror is required to submit a mitigation plan with its proposal for the consideration of the Contracting Officer.

c. Identification of Non-Disclosure Requirements. The contractor shall obtain and maintain Non-Disclosure Agreements (NDA) for each employee assigned to the contract/task order. Initial NDAs shall be signed within one week of contract/task order award, and NDAs shall be kept current through the entirety of the period of performance as employee turnover occurs.