MES PWS Draft_842571048 (1).docx

CUI

CUI

DRAFT

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Organization:

Department of Defense Activity Address Code (DoDAAC):

Address:

Phone Number:

Email Address:

b. Alternate COR.

Organization:

DoDAAC:

Address:

Phone Number:

Email Address:

c. Property Administrator.

Organization:

DoDAAC:

Address:

Phone Number:

Email Address:

2. Contract or Task Order Title.

Mobile Enterprise Services (MES)

3. Background.

Since 2013, the Department of Defense (DoD) Enterprise Mobility Division, as directed by the DoD Commercial Mobile Device Implementation Plan, has led the development of an enterprise solution to support controlled unclassified and classified information mobility requirements that leverage carrier infrastructure and provide entry points for wireless capabilities to meet the DoD needs. The DoD Enterprise Mobility Division, hereafter referred to as the Mobility Portfolio Management Office (PMO), offers a mobility program that encompasses multiple subcomponents that when integrated, provide mission partners with enterprise-level unclassified and classified mobile communication services, ensuring interoperability, increased security, access to information, and reliable service anywhere, at any time. DoD Mobility Unclassified Capability (DMUC) and DoD Mobility Classified Capability (DMCC) provide a means for DoD users to perform their official duties using commercial mobile devices (CMDs).

DMUC is DoD’s mobile managed enterprise service that enables approved Government-furnished CMDs and operating system (OS) access to the unclassified DoD Information Network (DoDIN) and commercial information services. DMUC utilizes commercial transport (cellular and Wi-Fi) and DoD Wi-Fi in select locations for access to email, numerous approved mobile applications, and Non-classified Internet Protocol Router Network (NIPRNet) access via a virtual private network (VPN). Customers provide their own Government-furnished CMDs (approved models are identified in the DoD Enterprise Mobility Authorized Devices and Peripherals for DMUC) to connect to the DMUC service.

Below is a high-level description of the current DMUC capabilities:

· Mobile Device Management (MDM)

· Mobile Application Store (MAS)

· Mobility Information Assurance (IA)

· Mobile Device and Operating System (OS)

· DISA Enterprise Services

· Mobile Content Management (MCM)

· Public Key Infrastructure (PKI) / Public Key Enablement (PKE) to include enabling efforts

· Mobility Gateways

· Mobile Apps Network Operating Center (NOC) / Network Operations (NetOps)

· DISA Storefront (a business system) ordering and automated too for providing user and device provisioning data for the MDM

· Health and monitoring system

· Event management systems

· Remedy ticketing system

DMCC is DoD’s mobile managed enterprise service that enables approved DISA-furnished customer purchased Commercial Mobile Devices (CMDs), both Android and Windows for access to the classified DoD Information Network (DoDIN) Secret Internet Protocol Router Network (SIPRNet) to obtain access for voice and Enterprise services, both applications, O365, and web. DMCC is based on the NSA Commercial Solutions for Classified (CSfC) Mobile Access Capability Package (MACP) as well as other required CSfC documents. DMCC devices utilizes commercial transport (cellular and Ethernet) via hotspot to connect to CSfC designed gateways. DMCC is an ever-evolving capability keeping up with the changing of the mobile devices landscape and the request for new capabilities.

Below is a high-level description of the current DMCC capabilities:

· MDM - Android

· System Center Configuration Manager (SCCM)

· Windows Server Update Services (WSUS)

· Mobile Application Store-Android (MAS-A)

· Mobility Information Assurance (IA)

· Mobile Device and Operating System (OS)

· DISA Enterprise Services

· Public Key Infrastructure (PKI) / Public Key Enablement (PKE) to include enabling efforts

· Mobility Gateways

· Mobile Apps Network Operating Center (NOC) / Network Operations (NetOps)

· DISA Storefront (a business system) device and services ordering and automated tool for providing user and device provisioning data for the DMCC provisioning process

· Design, configure, test, implement, support, troubleshoot and support DMCC systems

· Health and monitoring system for operations and CSfC monitoring requirements

· Remedy/ITSM+ ticketing system

4. Objectives.

The objective is to continue support for DMUC and DMCC service offerings current capability and integrate new capabilities across these platforms. The MES Contractor, herein Contractor, shall provide unclassified and classified integration and management, development, engineering, testing, mobile application management, product support, cybersecurity, and Tier III engineering support within a complex unclassified and classified environment. Engineering activities include design and impact assessment of new required capabilities, as well as new equipment and/or software for addressing new and/or updated commercial solutions supporting DMUC and DMCC. Maintaining and improving the user experience is imperative for this fee-for-service offering; utilizing technology (automation) fully is paramount versus placing a manual function or action on the user to execute. Processes that take days or hours should strive to be accomplished in minutes or seconds. Continual service improvement is vital in the ever-evolving mobile space.

5. Scope.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 15% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

The scope of this requirement is to utilize current and future Mobility capabilities to enhance DISA’s ability to provide unclassified and classified mobile communication services to the entire DoD. This contract will support both DMUC and DMCC programs’ ability to provide core mobility capability. This includes system integration, testing, and engineering.

The Contractor shall provide the necessary support on each of the task areas listed below:

· Task Area 1 – Contract and Program Management Support

· Task Area 2 – Transition of Gateway and Operational Support Services

· Task Area 3 – Engineering Support

· Task Area 4 – Mobility Capability Integration

· Task Area 5 – Operational Support

· Task Area 6 – Logistics and Asset Management

· Task Area 7 – Mobile Application Support

· Task Area 8 – Mobility Cloud Hosting Capability (OPTIONAL)

· Task Area 9 – Next Generation EMM Analysis & Requirements (OPTIONAL)

· Task Area 10 – Intune Integration and Support (OPTIONAL)

· Task Area 11 – Thunderdome Support (OPTIONAL)

· Task Area 12 – New EMM Deployment (OPTIONAL)

6. Performance Requirements.

All task areas apply to the full performance period of this requirement. There may be multiple contractors (i.e., from more than one contract vehicle and/or company) supporting Mobility PMO and other DoD activities that are tasked to work related activities. The Contractor shall engage with these other contractors, as required, to accomplish Government requirements, goals, and objectives as efficiently and effectively as possible. This may include, but is not limited to, sharing, or coordinating information resulting from the work required by this PWS or previous Government efforts, and/or working as a team to perform tasks in concert. Changes to the mobile industry (i.e., 5G capabilities, Commercial Solutions for Classified (CSfC), cloud-based technology, and “as-a-service" models) should be anticipated and the related required updates shall be incorporated into this requirement as needed.

The Contractor shall conduct these activities in accordance with DISA’s processes and as part of an integrated team with the Government and other contractors. The Contractor shall review, evaluate, and leverage existing commercial off-the-shelf (COTS) and Government solutions, where needed, to provide the best value. The Government will retain ownership and title to all materials provided to the Contractor for use in connection with performing the services under this contract. The Government’s licensing rights in all deliverables, including custom code, developed and/or delivered under this contract shall be in accordance with the applicable Defense Federal Acquisition Regulation Supplement (DFARS) clause(s).

The Contractor shall comply with appropriate DoD-approved architectures, programs, standards, and guidelines, such as Defense Information Infrastructure (DII), Security Technical Implementation Guide (STIG), Cloud Computing Security Requirements Guide (CC SRG), DII Common Operating Environment, DoDIN, and Shared Data Environment.

All deliverables required in this PWS must adhere to the following:

Deliverables must be provided on the dates specified in the proposal or agreed project schedule. Any changes to the delivery date must have prior approval (in writing) by the COR.

All deliverables must be submitted in a format approved by the COR/ACOR. At a minimum, the deliverable must be in an industry standard format, unless otherwise stipulated.

If the deliverable cannot be provided within the scheduled time frame, the Contractor is required to contact the COR and Contracting Officer in writing with a reason for the delay and the proposed revised schedule. The request for a revised schedule must include the impact on related tasks and the overall project. A request for a revised schedule must be reviewed and approved by the COR before placed in effect. Contract terms and conditions may dictate penalties, costs, and other actions based on the facts related to the request for a revised schedule.

Tables list the deliverables identified by the Government and the schedule for their delivery. All days specified below are calendar days. If a scheduled deliverable calendar day falls on a Saturday, Sunday, or National legal holiday, then the next business day is acceptable as the deliverable due date. Any other changes to the delivery date must have prior approval (in writing) by the COR.

NOTE: Format will be Government determined, Contractor determined or other. All formats will sufficiently serve required detail and function as determined by the Government.

6.1 Task Area 1 – Contract and Program Management Support.

6.1.1 Subtask 1 – Program Support.

The Contractor shall provide management oversight for the task order to ensure performance and schedule requirements are met or exceeded throughout the performance period. The Contractor shall identify, prevent, and ensure non-recurrence of defective and inadequate service. The Contractor shall recommend solutions to new requirements, unarticulated needs, or existing needs using more effective products, processes, services, technologies, or business models that are readily available.

Onsite Program Office Support. The Contractor shall provide on-site unclassified and classified mobility Subject Matter Expert (SME) full time equivalent (FTE) support to the Mobility PMO at Fort George G. Meade as required by the Government. Onsite support will communicate and coordinate among all operations support personnel, engineering, Government personnel, etc. as required in the performance of the tasks detailed throughout the PWS.

The Contractor shall attend meetings supporting Mobility PMO, annotate action items, develop meeting notes, develop meeting minutes, and report action item status within two business days after conclusion of meeting(s). Meeting minutes will be due within three (3) business days and shall include notes from the meeting, action items with due dates, and assigned roles.

The Contractor shall further develop the Mobility PMO’s existing Integrated Master Schedules (IMS) and submit them to the Government for approval within 30 days of contract award.

The Contractor shall provide the Government Program Manager (PM) or designee with an event driven IMS. The Contractor shall use the ServiceNow SPM tool or other software designated by the Government for developing and maintaining the schedule. The Contractor shall review and identify any dependencies or interrelationships between the contract and other program efforts and significant dates. The Contractor shall prepare and maintain Work Breakdown Structure (WBS) and an IMS for all capabilities identified by the government. These IMS will include schedules for each subtask and the level of effort (LOE) for task completion. The WBS and IMS shall address dependencies, risks, key milestone events, critical path activities, and delivery dates. The Contractor shall work with the Mobility PMO to deconflict any schedule or deployment issues. The Contractor shall communicate to the Government immediately when risks/issues arise that impact critical path items. The schedule shall also outline all resources assigned to individual tasks and the LOE for each task’s completion, down to the work package level. The Contractor shall coordinate with the appropriate Government functional leads to assess the risks identified in the schedule and recommendations for program resolution. The WBS and schedules shall be developed and baselined in collaboration with the Government schedule team.

The baselined schedule shall not be modified without the Government’s approval. The schedule shall be coupled with weekly management control meetings as required to ensure all organizations and activities underway are coordinated and support the objectives of the overall program. The Contractor shall prepare and submit an updated IMS to the Government PM weekly.

The Contractor shall develop, implement, and maintain a quality control plan. This plan shall include inspection, validation, evaluation, corrective action, and procedures necessary to effect quality control of all performance and products provided under the contract to include holistic cost schedule performance summary to be delivered weekly, and including potential slips, constraints, and risks. The plan shall allow inspection and evaluation by the Government and shall be applicable to all subcontractors and members of the Contractor's team, as appropriate.

Monthly Status Report (MSR). The Contractor shall develop and maintain an MSR to track the quality and timeliness of the milestones, services, and deliverables as well as risks and task order/program financials. Within 30 days after task order award, the Contractor shall submit a draft MSR to the COR/ACOR to confirm format and contents meet the Government’s needs. The Contractor shall incorporate any Government comments and submit the final report format within five business days. The MSR shall include, but is not limited to accomplishments for the quarter, plans for the next quarter, identifiable risks, and recommendations for mediating the risks, expenditures, cumulative funding summary, and a listing of all personnel associated with the execution of the performance tasks. The MSR for all proceeding months will be due by the 15th calendar day of the following month.

The Contractor shall conduct monthly in-progress MSR reviews that includes a summary of all specific tasks as requested by the Government. The Contractor shall provide a review of progress against cost and schedule performance, programmatic and technical risks, and identify and resolve critical issues and actions as set up by the COR/ACOR. The Contractor shall conduct analysis of the risks involving cost, schedule, and performance parameters associated with the performance of this task order.

Deliverable(s): Meeting Minutes Action items Staffing Plan

IMS

WBS

Work Packages Risk Matrix Quality Control Plan Cost schedule performance summary

MSR

6.1.2 Subtask 2 – Contract Management Support.

Management Plan. The contractor shall prepare a Management Plan (MP) describing the technical approach, organizational resources, spend plan, and management controls to be employed to meet the cost, performance, and schedule requirements throughout the PWS execution. This MP shall include the above stated IMS and a WBS for the overall effort.

· Describe the Contractor’s management approach, corporate commitment, teaming agreements, and subcontractor management will provide effective, efficient, and responsive support.

· Describe the Contractor’s proposed organization and organizational structure, interrelationships of the organizational elements, communications channels, roles and responsibilities, support to achieve program objectives.

· Describe the approach to infrastructures service/gateway management.

· Describe the approach to fostering an SLA-based Government-contractor relationship that leverages shared goals and objectives. Describe how the Contractor team will provide visibility into program status and the accurate, timely reporting of information on program status, performance measures, and metrics.

· Describe the Contractor’s staffing plan. Describe how the Contractor will maintain staff that has the necessary technical knowledge, and the degree to which staff’s competence level is continuous, stable, and more than adequate to meet the Government’s support requirements. The staffing plan will identify key personnel detailing the management strategy used to successfully implement and sustain uninterrupted operations. This plan shall include a detailed roles and responsibilities matrix for the proposed staff members to ensure adequate coverage and proper workload distribution for those supporting field and/or lab operations.

· Contractor shall establish a comprehensive risk management process that includes identification, evaluation, and mitigation of risks associated with cost, schedule, and performance of this effort. Additionally, the team shall develop a risk matrix to track project risks (such as schedule, cost, program, and engineering) that may be revealed during the project, and detail initial action and communication plans to help ensure successful issue resolution and project execution. The risk matrix will be maintained and delivered to the Government as part of the weekly IMS updates. The Contractor shall tailor its risk assessments based on the Government’s direction. The Contractor shall track these high-risk factors via a risk matrix and develop mediations to reduce risk by identifying, addressing, and providing prioritization of risks (including how risks will be recorded and reported) as a part of the MSR. The Contractor shall consider the full range of risks that could impact the project including, but not limited to resources, access, physical and cybersecurity, and unplanned events. Upon Government approval, the Contractor shall implement and monitor the selected mediations. The Contractor shall work with the Government to mediate any schedule or deployment issues.

Deliverable(s): MP Contract Kickoff

6.1.3 Subtask 3 – Risk Management Plan.

The Contractor shall provide a comprehensive risk management plan addressing the identification, assessment, and prioritization of risks including how risks will be recorded and reported. In addressing risk, the Contractor should consider the full range of risks that could impact the project including, but not limited to, resources, access, physical and cyber security, and unplanned events.

Deliverable(s): Risk Management Plan

6.1.4 Subtask 4 – Technical Writing and Knowledge Management (KM).

The Contractor shall provide a comprehensive Knowledge Management (KM) Guide geared for Mobility needs, processes and requirements that leverages and updates the current KM Guide that includes but not limited to Mobility KM Tactics Techniques & Procedures (TTPs) and SOPs, and KM Implementation Plan. The Contractor shall support and update as needed KM TTPs and SOPs, and KM Implementation Plan. Additionally, the Contractor shall provide expertise in the technical knowledge of integration of information and knowledge portals for efficiency purposes, limiting redundancy.

The Contractor shall assist in maintaining, updating and/or developing, if need be, the KM capability to provide continuing support to various functions including but not limited to designated user access list and access areas, task management, engineering action tracking, test management and status, Change Management (CM), and general file storage. The Contractor shall provide expertise in the technical knowledge of integration of information and knowledge portals for efficiency purposes and limit redundancy.

The Contractor shall maintain and update the KM tool(s) in order to create and structure portals necessary to display, disseminate, search, and store current knowledge and information in the most efficient and useable format for the program and product management team, DISA leadership and DoD customers. Additionally, the Contractor shall have a clear understanding of DISA’s approval process and support the DISA Operational Approval Processes as appropriate (e.g., The Operations Review Board).

The Contractor shall provide technical writing expertise to execute the following which includes but not limited to the following: develop, write, edit, and update documentation such as reports, manuals, briefs, white papers, catalogs, guides, and related technical and administrative publications. Example documents include Concept of Operations (CONOPS), Service Operation Annex, and Technical Implementation Plans. The Contractor shall create, edit, and improve any briefings. The Contractor shall be responsible for tailoring briefings for targeted audiences and support graphic design requests.

The Contractor shall provide KM expertise supporting engineering activities and to develop and maintain KM functions for an outward facing Government-provided KM tool (e.g., SharePoint site). The Contractor shall maintain, develop, and update as required SharePoint site structure which include but not limited to the following: sites, workspaces, lists, forms, dashboard, etc., as well as updates for current pages, as well as design of new pages to include implementation and pages data population.

The Contractor shall assist in the following but not limited to maintaining release notes, functional deltas, installation guides, upgrade guides, migration guides, administration guides, user guides, training, and quality assurance plans, engineering diagrams, hardware/software list, and results, as well as any other pertinent documentation relevant to Mobility. Additionally, the Contractor shall maintain archived records, files of work revisions, and other essential documentation.

The Contractor shall provide web and technical support to maintain, update, and improve the DoD Mobility Service Portal (MSP). The MSP must be updated and kept current, as the website is a critical resource for Mobility PMO’s Mission Partners.

Deliverable(s): KM Guide

KM TTP

KM Standard Operating Procedures (SOP) KM Implementation Plan Technical Documentation (e.g., CONOPs, briefs, Technical Implementation Plans, etc.)

6.1.5 Subtask 5 – Program and Product Support.

The Contractor shall provide support for strategic initiatives as they arise to ensure the DMUC and DMCC missions and goals are met. The Contractor shall assist with the formulation of business and technical strategies and objectives to meet short, mid, and long-term goals. This may include planning, research, product development (spreadsheets, presentations, schedules, technical concepts/diagrams, reports, etc.), realignment activities, and assistance through execution of strategic programmatic direction.

Support strategic messaging for the DMUC and DMCC based on requirements being modified and deployed capabilities, e.g., DISA Advisory Message (DAM) and DISA Task Order (DTO) and user messaging.

Deliverable(s): Mission, Vision, Goal & Objective Statements Business and Technical Strategy Program Support Documents Strategic Messaging

Task Area 1 Deliverables:

*Standard Distribution: Transmittal letter without the deliverable to the Contracting Officer, Contract Specialist, and CORs; Deliverable uploaded to the deliverable portal.

6.2 Task Area 2 – Transition (Base Year Only).

6.2.1 Subtask 1 – Transition In Planning, Gateway Equipment, Engineering Services and Operational Support Services.

Contract Transition In:

The Contractor shall provide a comprehensive, low-risk, 60 working-day transition approach from the incumbent Contractor, which starts at contract award and includes major transition risk areas the Contractor identifies. The Contractor shall include risk mitigation proposals of how the Contractor will support a low-risk transition to ensure high availability for mobility services while the user experience is not impacted during contract transition.

A kickoff meeting shall be conducted no later than ten working days after the contract award. This meeting will be between the Government and the Contractor and will be the venue to facilitate a successful execution of this contract, including transition activities and understanding any time sensitive requirements. The kickoff meeting agenda shall include, but not be limited to, the following:

· Common understanding of contract

· Common understanding of technical direction, including introduction to key personnel

· Presentation of all contract deliverables to include proposed formats and reporting methods

· Contractor’s transition plan to support current activities supporting all capabilities

· Other relevant items may be introduced at the discretion of the Contactor and/or the Government

· Risk matrix

The Contractor shall have complete information for the on-site operations and shall have full access and knowledge to all required systems to administer and manage of all capabilities within the Mobility PMO as designated by the Government. The Contractor shall ensure an official handoff of all supporting privileged user accounts to the system and disable all accounts used by the incumbent Contractor. The Contractor will create a transition checklist of required information, documentation, and system access. This checklist will be used to facilitate the transitions between the Contractor and the incumbent Contractors.

All operational support requirements to be transitioned include the following:

· Roles and responsibilities in any Government managed form currently supported by the incumbents

· “Left seat - right seat” functional/knowledge transition from incumbents to minimize impact to the program

· Coordination processes and requirements with DISA Global Operations Command (DGOC) and Watch Officer

· System maintenance and administration requirements

· Configuration Control Board (CCB) processes

· Test lab environments

· Network management support, trouble analysis procedures, network and system monitoring and administration/coordination

· Asset (hardware and software) maintenance, licensing tracking and support

· Circuit configuration advisement

· General administrative tasks as they pertain to personnel and clearances for Government facilities

· Transition support shall also include all real time monitoring and management requirements of DISA Services for operational awareness and Cyber Defense

· Administrative accounts system

The Contractor shall maintain, provide, or update all Mobility service management documentation such as:

· Mobility Operations and Maintenance Manual(s)

· Authorized Service Interruption (ASI) Standard Operating Procedures (SOP) 100-55-08

· Operations and Maintenance (O&M) Convergence Network Operations C2 CONOPS

· SOPs

· Transition support shall also include all real time monitoring and management requirements of DISA

· Services for operational awareness and Cyber Defense

Transition Implementation Plan. The contractor shall provide a Transition Implementation Plan (TIP) that describes activities and timelines required for the Contractor to transition support services identified in this PWS to a new Contractor, as required. The Contractor shall support concurrent network operations services and receive all mobility operational support services from the incumbent Contractor. This shall include but not limited to the following areas of responsibilities:

· Technical approach

· Transition items: 1) goals, 2) assumptions, 3) significant risk, and 4) other critical factors (e.g., pre-transition requirements)

· Transition task

· Management controls: 1) Cost, 2) Schedule; and 3) Risk

· Transition performance measurement: 1) goals, 2) acceptance criteria, 3) metrics, 4) evaluation process, and 5) frequency

· IMS with major Government review milestones and critical path

· Organizational resources

· Deliverables schedule that will need to be employed to meet the cost, performance, and schedule requirements throughout the execution of the transition period

· Government Furnished Information (GFI), (e.g., all configuration items), source code, system architectures, system access controls, and other program artifacts.)

· Information Assurance (IA) (Configuration management (CM) support (current status and processes)

· Cybersecurity support MDM/MAS support

· Implementation management support (to include history and current status)

· System performance analysis

· Mobility Gateways (e.g., hardware, software, and scripts)

· System and network engineering

· System deployment and integration support

· Documentation to support all TIP activities

· Incident detection, handling, and reporting

· Asset management responsibilities (to include transitioning active maintenance/support plans and licenses), transition all administration and user accounts

· System monitoring requirements in order to facilitate a seamless transition and assure minimum service disruption of the current on-site administration support, Service Desk Tier I and Tier II responsibilities and Program Office Tier III responsibilities

· License and certificate expiration tracking

· Application vetting process, procedures, tools, status, and historical reports

The Transition In Close Out Report is a summary on the overall status of the Transition In execution completeness of meeting the task requirements for the transition of knowledge and files from the outgoing contractor and the success of ingestion by the incoming contractor. The report will review but not limited to the following: 1) Key Objectives and Requirements; 2) Overall process review; 3) Transition Items review: Operational and Documentation; 4) Transition items: a] goals, b] assumptions, c] significant risk, and d] other determined critical factors; 5) Transition performance measurement results: a] goals, b] acceptance criteria, c] metrics results, d] Performance result; 6) Privileged accounts completeness; 7) Asset management transfer completeness; 8) Ticketing system handover completeness; 9) Systems support handover completeness; 10) Checklist completeness; 11) Overall transition completeness; 12) Follow-on issues; 12) Corrective plan, measures and timeline. A draft outline is required to be provided to the Government for approval no later than 15 working days prior to when the report is due.

The Contractor shall support Government-initiated weekly meetings during the 60 working-day transition period to ensure a smooth transition of operational support services. The Government will facilitate the execution of the TIP to ensure continuity of all current activities supported by the incumbent Contractor. The Contractor shall also minimize service disruption and service degradation during and after a transition period from the incumbent Contractor. The Contractor shall update the TIP to support the 60 working-day transition to a follow-on contractor as specified by the Government Contracting Officer or COR.

Deliverable(s): Contract Transition In Kickoff Contract Transition In Plan Transition In Implementation Plan Transition In Checklist Transition In close out Report

6.2.2 Subtask 2 – Receipt and Execution of Engineering and Testing Services and Equipment.

The Contractor shall ensure no service disruption and service degradation during and after a transition period from the incumbent Contractor. Transition shall include but not limited to active support plans and licenses, information as required to maintain service and transition all administration accounts and equipment ownership. All transitioning equipment will be verified by the Government via audit and the Contractor shall verify equipment is in working condition and assume responsibilities upon the Government’s audit with the property transfer by the Government and Contractor per designated Government property accountability procedures and rules.

The transition must include the status of the applicable hardware/software on the current National Information Assurance Partnership (NIAP) and/or and Commercial Solutions for Classified (CSfC) Components List for mobility capabilities equipment solutions and mobile devices for both approved and in evaluation.

6.2.3 Subtask 3 – Transition Out Planning, Gateway Equipment, Engineering Services and Operational Support Services (Optional)

Contract Transition Out:

The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue them. The outgoing Contractor shall, upon the Contracting Officer’s written notice, execute the task. The transition out requirements are those requirements of PWS Section 6.2.1, Transition In Planning, but executing in reverse, where the outgoing contractor is supporting Transition Out task to provide the information and knowledge transfers to the incoming Transition In contractor replacement. The Contractor shall provide sufficient experienced personnel during this phase-out to the new incoming contractor to ensure that the services called for by this contract for transition are maintained at the required level of proficiency to ensure the Transition In replacement is sufficiently trained on the three mobility capabilities to support and execute contractual task.

Deliverable(s): Contract Transition Out Kickoff Contract Transition Out Plan Transition Out Implementation Plan Transition Out Checklist Transition Out close out Report

Task Area 2 Deliverables:

*Standard Distribution: Transmittal letter without the deliverable to the Contracting Officer, Contract Specialist, and CORs; Deliverable uploaded to the deliverable portal.

6.3 Task Area 3 – Engineering Support.

6.3.1 Subtask 1 – Systems Engineering Support.

The Government will provide guidance on prioritizations of engineering efforts for the Contractor. The Contractor will be responsible for the entire engineering life cycle from planning through Tier III Operations and disposal in accordance with government direction. This includes but not limited to:

a) Virtualization

b) Gateway solution support and migration as applicable

c) Continuity of Operations (COOP)

d) Classified data at rest (DAR) and non-DAR solution

e) Gateway upgrades in accordance with the latest Mobile Access Capability Package (MACP)

f) Gateway bandwidth capability upgrades

g) Convergence of gateways classifications

· Consolidated black and gray enclaves

· Multiple red enclaves

· Additional gateways (single/converged) deployed

6.3.1.1 Subtask 1.1 – Engineering Support for Nation Partner Solutions (OPTIONAL).

As the mobility capability has grown, so has interest shown from partner nations (e.g., Five Eyes Alliance (FVEY)). Dedicated support is required to address this nation partner need. Travel supporting face-to-face meeting is required. Below are the major support areas:

Voice and Email: The support will be focused on Windows Data-at-Rest (WINDAR) and Next Generation Device (NGD) voice and email interoperability with FVEY partners. The scope is to publish a UK and US interoperability secure mobility voice and email as a catalogue service as well as conduct quarterly secure testing for verification. US aim is for an Interoperability statement added to the DISA Service Catalogue for DMCC-S capabilities. Next steps will be Extensible Messaging and Presence Protocol (XMPP) chat and video enabled calls.

Chat: The support will be focused on WINDAR and NGD XMPP chat interoperability with FVEY mission partners. Initial requirement is DMCC-S interoperability with FVEY desktops that have chat capability (e.g., Cisco Jabber) but then to FVEY mobility devices as deployed in the future by the Mission Partners. The chat will leverage DMCC-S current messaging server capability interfacing with ECVoIP messaging server via the XMPP protocol. This will be achieved initially by one-on-one testing with the FVEY partners as they achieve chat capability. This will be followed by quarterly chat testing as needed for verification of FVEY desktop and as chat capable mobility systems are deployed. The scope is to publish a US/FVEY interoperability secure mobility chat desktop/mobile chat domains service catalogue for use by all FVEY participants.

5G: FVEY Working Group (WG) is working a set of 3-phased 5G tasks that rolls out 5G as part of each FVEY Partner networks as well as some level of interoperability between the FVEY Mission Partners. Of the 12 FVEY WG 5G defined tasks, the following tasks may require some level of DMCC-S input/assistance in relationship to DMCC-S impacts:

· 5G Use Cases

· NextGen Mobile Architecture

· Security Assessment of 5G

· 5G & Legacy Systems Integration

Deliverable(s): White Papers US Secure Mobility Way briefs IA documentation

6.3.2 Subtask 2 – Systems Cybersecurity.

The Mobility solutions have been engineered to maintain and operate the procedures and tools (Cybersecurity software, hardware, and network) that provide the infrastructure with confidentiality, integrity, availability, authenticity, access control, survivability, and non-repudiation of information. The infrastructures shall continue to be engineered so that security shall be provided to protect all information and data in accordance with Federal, DoD, Joint Chief of Staff, DISA Authorizing Official (AO), and Mobility PMO security policies.

As such, the Contractor shall provide Tier III engineering and implementation support services in maintaining and/or meeting the following security requirements:

· STIG compliance

· IA Vulnerability Alert (IAVA) compliance

· Host Based System Security (HBSS) compliance and Cybersecurity/Intrusion Detection (Cyber/ID)

· Physical security requirements for operating systems, as applicable

· ACAS

· MACP compliance

· Mission and Application Portfolio System (MAPS)

· Data at Rest Capability Package (DAR CP) compliance

· DoD Information Technology Portfolio Repository (DITPR)

· DISA AO

· System/Network Approval (SNAP) and/or GIG Interconnection Approval Process, as applicable

· Cybersecurity Scorecard

The Contractor shall ensure the production environments are hardened in accordance with the latest STIGs, vendor patches, and IAVAs. As part of this process, the Contractor shall first test and implement any patches and security updates within the lab environments as prescribed above and within Section 6.3.8 (Lab Support) prior to pushing the updates to the Tier II administrators for implementation.

In coordination with the Government, the Contractor shall continue to maintain secure applications and configurations through applying applicable DoD STIGs, checklists, vendor security guidance, industry best practices, and applicable vendor product security patches. The Contractor shall ensure currently deployed and new applications comply with DoDI 8500.1 Cybersecurity (current version) and DoDI 8551.1 Ports, Protocols, and Services Management (current version). The Contractor shall assist in leveraging, to the maximum extent possible, automated tools to identify and remediate vulnerabilities or weaknesses in the currently deployed applications and systems. Examples are the Common Weakness Enumeration/System Administration, Networking, and Security Institute (CWE/SANS) TOP 25 Most Dangerous Software Errors (https://www.sans.org/top25-software-errors/) and Open Web Application Security Project (OWASP) Top Ten (https://owasp.org/www-project-top-ten/), that could be exploited by unauthorized sources.

The Contractor shall participate in Government formal and informal design reviews to identify potential security weaknesses, deficiencies, and/or vulnerabilities in the design. As part of the change control process, the Contractor shall ensure participation by the Information System Security Engineer or a qualified cyber security SME to evaluate the security impact of each change. The Contractor shall maintain documentation of the results of these evaluations within the Systems Engineering Plan (SEP). The Contractor shall also ensure appropriate security requirements are included as part of the requirements traceability matrix and are evaluated as part of the security assessment.

The Contractor shall assess the implications and coordinate solutions for required security updates that affect the systems with operations personnel and monitor their successful implementation. The Contractor shall ensure the system engineering design is compliant with applicable Cybersecurity and CSfC Capability Package (CP) requirements, STIGs/Checklists, DISA Joint Operations Center Task Orders, ACAS results, DISA AO requirements and NIAP Protection Profiles.

The Contractor shall assist and support Government requirements to accomplish submittal of new and amended Assessment and Authorization (A&A) packages for the DMUC, DMCC-S and DMCC-TS infrastructures including system configuration of all components. The Contractor shall support biannual security self-assessment activities. The Contractor will need to have access to Secret Internet Protocol Router Network (SIPRNet) and Joint Worldwide Intelligence Communications System (JWICS) as applicable to support the cybersecurity requirements.

The Contractor shall provide engineering and or Tier III support to existing mechanisms as they apply to this effort to provide the capability to preserve, protect, detect, react, revise, and recover from threats, intrusions, and denial of services. These procedures/mechanisms have been implemented to protect network, server, mobile devices, workstations, communication security (COMSEC) and physical facilities under Contractor control.

The Contractor shall analyze STIG, IAVA, and ACAS scans and provide appropriate supporting Cybersecurity documentation for upload as artifacts in Enterprise Mission Assurance Support Service. The Contractor shall provide weekly input to elucidate the present security status of the systems to include, but not limited to, open IAVAs, STIG findings and plans to mitigate vulnerabilities, which shall be done in a timely manner. If vulnerabilities cannot be mitigated within 21 days of release, the Contractor shall provide detailed Plan of Action for Mitigation documentation and seek approval from the Mobility Information Security System Manager (ISSM). The Contractor shall provide support for all efforts, duties, and documents for requesting and maintaining Authority to Operate approvals. Completed STIG checklist results for all applicable assets shall be provided to the Mobility ISSM for review and archive annually as evidence of compliance.

The Contractor will be responsible for the development, integration and Tier III support of Cyber Defense systems that are focused on identifying, thwarting, and reporting any Cyber Attack or incident. This applies to the Risk Management Framework (RMF) Cyber Remediation, wherein the Contractor shall actively analyze and remediate within the applicable DoD/DISA timeframes and in accordance with US CYBERCOM Information Assurance Vulnerability Management (IAVM) Notices, Directives, and Orders. In the event of an incident, the Contractor shall respond and address incidents in accordance with impact level High-Moderate-High for DMCC-TS, High-Moderate-High for DMCC-S, and Moderate-Moderate-Moderate for DMUC within the ITSM database. Lastly, identify a trend analysis tracking mechanism for projecting operational impact of identified vulnerabilities.

The Contractor shall provide onsite as required by the Government mobility Cyber SME(s) to support the Government Program Office at Fort George G. Meade. Onsite support will coordinate among the Government, operations support personnel, Tier III Engineering, the Program Office, ISSM, Program Office Cybersecurity team, and Contractor PM in providing required Cybersecurity artifacts, reporting Cybersecurity posture/status, assist in addressing present and upcoming Cybersecurity vulnerabilities, and provide coordination support. IA administrative support will consist of, at a minimum, Cybersecurity analysis, engineering, risk mitigation and other required efforts to maintain DISA AO and or CSfC capability packages cybersecurity compliance/registration as applicable.

In addition, the onsite as required by the Government Cybersecurity SME shall support development of system documentation to facilitate the security assessment and authorization of the system according to DoDI 8510.01 RMF and the associated security controls as defined in DoDI 8500.1, Cybersecurity Implementation (current version).

Deliverable(s): System Cybersecurity Implementation Report

6.3.3 Subtask 3 – Systems Engineering Assessment and Authorization (A&A).

The Contractor must…