A03 DRAFT PWS Combined Indy 9.20.24.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEFENSE FINANCE AND ACCOUNTING SERVICE (DFAS)

COMBINED INDIANAPOLIS SYSTEM SUPPORT

for DISA Automated Time Attendance and Production System (DATAAPS), Headquarters Accounting Reporting System (HQARS), and Wounded in Action (WIA)

PART 1

GENERAL INFORMATION

1. GENERAL:

1.1 Introduction: The Defense Finance and Accounting Services (DFAS) Information & Technology (I&T) supports services to assists: DISA Automated Time Attendance and Production System (DATAAPS), Headquarters Accounting Reporting System (HQARS), and Wounded in Action (WIA).

1.2 Background: The Defense Finance and Accounting Services (DFAS) Information & Technology (I&T) is responsible for the provision of information and technology services, to include the following:

• Support, Operate, and Maintain essential DFAS Information Technology Systems.

• Provide software engineering services in accordance with DFAS standard methods and procedures.

This procurement is to obtain I&T support services to assist with the systems DISA Automated Time Attendance and Production System (DATAAPS), Headquarters Accounting Reporting System (HQARS), and Wounded in Action (WIA).

DATAAPS System Description:

Is a web-based time and attendance (T&A) software package owned by the DISA that provides customer organizations access to civilian T&A and accounting production data via a web browser.

DATAAPS is primarily developed in Java with a back-end Oracle database. DATAAPS production data is transferred to and from the DFAS - owned Defense Civilian Pay System (DCPS) on a set schedule. DATAAPS also contains a PowerBuilder client-server component for certain system administration functionality.

Customer organizations using DATAAPS as their T&A solution are able to select the hosting service provider that will host their particular instance of DATAAPS from either the Defense Information Systems Agency (DISA) or the customer’s own location. Web servers may be either UNIX or Windows-based.

HQARS System Description:

Requires support services for on-going maintenance activities. HQARS supports the departmental accounting systems for receiving, validating, and consolidating expenditure reports and submission of consolidated treasury report. The HQARS system contains 12 subsystems and interfaces with many other application systems. HQARS runs on a Unisys mainframe system.

WIA System Description:

WIA application is used to track soldiers that were wounded in action to ensure changes to WIA soldier military pay accounts are accurate and done in a timely manner. The WIA database runs in a Web environment and has approximately 300-400 users. WIA receives input from six medical and personnel systems to identify WIA soldiers, in addition to the daily Defense Joint Military Pay System (DJMS) Master Military Pay File (MMPF).

Contractor shall ensure organization is in compliance with the DoD Information Assurance Vulnerability Management (IAVM) program and that a written and signed compliance policy is put into effect.

1.3 Objective: The objective of this PWS is to define the tasks necessary to obtain the technical information and technology support services needed to assist in the operation, programming, implementation and maintenance of DATAAPS, HQARS, and WIA.

1.4 Scope: The contractor shall provide planning, developing architectures, designing, building, operating, maintenance/production support, software engineering services, establish/manage DFAS Enterprise Information Infrastructure Architecture and Engineering environment for DATAAPS, HQARS, and

WIA.

The Defense Finance and Accounting Service (DFAS) has identified ten (10) specific tasks that are needed to ensure the success of this program (See Part 4). The following are tasks, which the contractor will be called upon to support the identified systems with:

Task 1: Contract Program Management Task 2: Production Support Task 3: Project Tracking and Software Lifecycle Task 4: Data Conversion and Migration Task 5: Information Assurance (IA) Support Task 6: System Integration Support Task 7: Functional and Business Process Improvement Task 8: Customer Support and/or User Support Task 9: Software and Audit Support Task 10: Knowledge Management training

1.5 Period of Performance: The anticipated period of performance shall consist of one (1) Base Year of 12-months and four (4) 12-month Option Years.

1.6 Recognized Holidays: Contractors are not expected to perform on federally recognized holidays to include but not limited to:

New Year’s Day Labor Day Martin Luther King Jr. Birthday Columbus Day President’s Day Veterans Day Memorial Day Thanksgiving Day Juneteeth Christmas Day Independence Day

1.7 Hours of Operation: The contractor shall conduct business between the core hours of 0630 – 1700 hours Monday thru Friday Eastern Time except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the PWS when the Government facility is not closed for any of the above reasons. The stability and continuity of the workforce is essential. The contractor is required to respond to after-hours support in the event of system failures.

1.8 Place of Performance: The work to be performed under this Task Order (TO) is anticipated to be

100% telework/remote.

Collaboration tools such as phone conference lines and Microsoft Teams will be used for initial orientations and regular status meetings. Arrangements will be made for contract staff to receive a DFAS laptop through shipping and CAC cards can be obtained at any RAPIDS location.

1.9 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, Government Project Manager (PM) and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

These meetings shall be at no additional cost to the Government.

1.10 Knowledge Transfer Plan: Whenever there is a transition in support personnel, the current contractor will be required to transition specific systems knowledge to the replacing labor resources. This transition period will be no longer than 120 days from the end of the current period of performance.

Actual transition time will be determined by DFAS.

Contractor will work cooperatively with the replacement resources to transfer knowledge. In addition, a system configuration audit will be performed to ensure all configurable items have been captured and are in repositories identified in the Software Life Cycle process.

1.11 Contracting Officer Representative (COR): The COR is the primary point of contact for the contractor.

The COR shall interface with DFAS Information and Technology (IT) Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

The COR is responsible for monitoring all technical aspects of the award and assisting in contract administration. COR duties include but are not limited to:

• Ensure contractor performs the technical requirements of the award.

• Perform inspections necessary in connection with award performance.

• Maintain written and oral communications with the contractor concerning technical aspects of the contract.

• Monitor contractor's performance and notifies both the CO and contractor of any deficiencies.

• Coordinate availability of Government furnished property and site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.12 Type of Contract: The TO will be a combined Firm Fixed Price (FFP) and Labor Hour (LH) contract type.

1.13 Identification of Contractor Employees: All contractor personnel attending meetings, answering

Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. Contractor personnel shall ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The Common Access Card (CAC) used for building entrance, computer access, and other situations will identify the individual as a contractor.

1.14 Contractor Travel: Not anticipated at this time.

1.15 Relocation costs: Relocation and travel costs incident to relocation are not allowable and will not be reimbursed hereunder.

1.16 Data Rights: Data Rights: The DATAAPS, HQARS, WIA requirement will utilize current data and software that is owned by the government. Although the Contractor will be given access to, and the ability to use, the existing code, documentation, and data, DFAS will retain its intellectual property rights to the data and code.

DFAS intends that all data, software, and documentation delivered by the contractor in performance of this TO will be owned by DFAS. This data, software, and documentation includes, but is not limited to, data, documents, graphics, code, plans, reports, schedules, schemas, metadata, architecture designs, and the like; additionally, all new open source software created by the contractor and forks or branches of current open source software where the contractor has made a modification; and all new tooling, scripting configuration management, infrastructure as code, or any other final changes or edits to successfully deploy or operate the software.

The government requires “Unlimited Data Rights” to all data produced by the contractor in the performance of this TO. DFARS Provisions and Clauses 252.227-7013, 252.227-7016, 252.227-7017, 252-227-7030, and 252-227-7037 are applicable to performance under this TO.

1.17 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this Task Order may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent

Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The contractor shall notify the Contract Officer (CO) immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.18 Monthly Status Reports: The prime contractor official representative shall submit a monthly status update to the COR, no later than the 10th day of the following month, identifying the initial and annual mandatory training status of all contractor personnel. This report can be integrated with the regularly scheduled Monthly Status Reports and made available to the COR as a deliverable item on the TO.

1.19 Section 508 Compliance:

E208 Support Documentation and Services:

E208.1 General Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E302 Functional Performance Criteria:

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

602 Support Documentation

602.1 General.Documentation that supports the use of ICT shall conform to 602.

603 Support Services

603.1 General. ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

1.20 Agile Methodology: The contractor will work in a team-based Agile environment. The System

Owners (DATAAPS, HQARS, WIA) will specify high-level equirements/capabilities to the Agile team. As in typical Scrum-based Agile processes, the Agency System Owners will work together with the team to develop and estimate user stories and establish acceptance criteria. These acceptance criteria shall specify expected functionality for a user story, as well as any non-functional requirements that must be met in the development of the story. The Agency System Owners, supported by subject matter experts and business analysts, will determine whether or not acceptance criteria have been satisfied.

PART 2

SECURITY REQUIREMENTS

2. SECURITY REQUIREMENTS:

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required. IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days)*.

Contractor/Contractor personnel must apply for fingerprint appointment immediately (the next business day) upon award date. The contractor/contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day) of providing fingerprints. It is the contractor’s responsibility to ensure its contractor and subcontractor employees timely obtain and submit fingerprints; but, tips can be found at this URL: https://dfas.mil/careers/security/87. The information needed in the Declaration for Federal Employment (OF-306) shall be submitted to the Contracting Officer Representative (COR) by the contractor/contractor personnel. The COR will submit the OF-306 and DFAS Form 9035 to DFAS Personnel Security. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.”

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other

Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and

Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.”

Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), COR, and the DFAS Personnel Security Office.

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4- Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the COR, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that person’s delinquent on Federal debt of any kind may not obtain or maintain favorable https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html

Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/

Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Level I Antiterrorism Awareness Training. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

https://public.cyber.mil/training/cyber-awareness-challenge/ https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf https://securityawareness.usalearning.gov/cui/index.html https://securityawareness.usalearning.gov/disclosure/index.html

NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training: Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training.

The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

- Contractor employees required to take the training

- Contractor employees who have completed the training

- Contractor employees who are delinquent

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED EQUIPMENT AND SERVICES:

3.1 Government Furnished Equipment: The Government will provide office space at their facility including but not limited to a desk, chair, storage cabinets, phone, personal computer (PC), consumable supplies and access to a printer to the contractor personnel located on-site. Laptops shall be furnished by DFAS and shipped to the remote working locations of those fulfilling the activity of the contract. All software resident on the computers required to complete the tasks will be made available to the contractor after Desktop Management Initiative (DMI) and Cyber Security Service Contractor (CSSP) approval. Only DFAS Government furnished equipment shall be connected to the DFAS Enterprise Local Area Network (ELAN). The contractor shall be fully responsible for maintaining the inventory, providing physical security, and returning the equipment and materials to the Government in the same condition in which they were received, after completion of the period of performance.

Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI.

For contractor personnel working at alternate locations agreed upon by DFAS and the contractor, access will be provided to the required platforms. The Government shall provide the access network connection, via the Cisco AnyConnect Virtual Private Network for any personnel not working at the DFAS site.

The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of business each workday, Government equipment and materials shall be secured.

3.2 DFAS IT Policy Concerning Contractor Furnished Equipment (CFE).

In accordance with Chapter 3 of DFAS Regulation 8400.1-R, personally owned workstations, laptop computers, software, and printers, including computers connected remotely will not be connected to the DFAS Enterprise Local Area Network (ELAN). This prohibition is a security requirement to protect the ELAN from the spread of malicious logic (viruses and Trojan Horse programs) and to protect sensitive but unclassified (SBU) information from being compromised.

PART 4

SPECIFIC TASKS

4. SPECIFIC TASKS:

The contractor shall perform the work identified below and obtain the results identified in the outcome column of the attached Performance Requirements Summary (PRS). The work associated with objectives is varied but centers around designing and writing code for system change requests (SCR), the testing of those efforts, customer support and assistance in maintaining the applicable systems.

4.1 Task 1: Contract Program Management.

4.1.1 Performance and Cost Report. The contractor shall prepare and deliver monthly a

Performance and Cost Report and a Summary Project Status Report to the COR/System Manager, no later than the 15th workday of the month. The contractor shall maintain and report in accordance with (IAW) the Government’s instructions the following: the current status of this T.O.; relevant information regarding problem areas and course of action taken in their resolution; potential problems anticipated; significant activities, work progress, and T.O.

costs.

The contractor shall track hours worked on various projects using codes provided to them.

The contractor shall also prepare a monthly Status Report. Provide worksheet which includes the following tabs: Expended Hours, Expended Funding, Invoiced to Date, Invoice Data and Staff Matrix for each contractor performing under this T.O. The Staffing Matrix shall list the Contractor’s Name, any other information agreed to by the Government and the contractor.

A soft copy of the Cost Report (not including Travel attachments) shall be provided to COR.

COR provides the soft copy to System Manager for approval. COR returns approval to contractor prior to the contractor submitting invoice to WAWF. Upon the expiration of the period of performance, the contractor is responsible for submitting the final invoice within sixty (60) days of contract end date.

4.1.2 Management Reviews (MRs). The contractor shall prepare and provide Management

Reviews (MRs) to identify and address progress, problems, and other pertinent information.

The Government may require these Management Reviews intermittently in order to address pertinent issues. The contractor shall identify all Subcontractors and address progress, problems, and other pertinent, detailed information. If required, the contractor shall ensure the following topics are available for discussion at the MR: the management of T.O. activities, scheduling, costs, and technical status.

The contractor shall prepare and deliver a Monthly Status Report, Training Progress worksheet and monthly accrual/ invoicing data to the COR/System Manager. The contractor shall report by project/system that details the system, Government team leader, Contractor(s) assigned, summary of activities for the month, progress, problems encountered and solutions to the problems.

4.2 Task 2: Production Support.

4.2.1 Help Desk. Support a help desk by answering questions, determine the issue and provide a response within identified response times. Resolve callers’ issues at the lowest level possible and in a timely manner. (DATAAPS only)

4.2.2 System Development Lifecycle Support. The contractor shall support all activities associated with the systems development lifecycle support. The contractor will analyze and solve production trouble reports (PTR) and system change requests (SCR) and Work Stoppages.

Work requires identifying the cause of a problem, determining what has to be fixed, and then providing a solution to the problem. Perform unit testing of programming change to solve PTR/SCR. The contractor will support mainframe systems by analyzing and resolving abend conditions that arise. For non-mainframe environments, the contractor will analyze and resolve computer problems that arise. As part of fixing and resolving production problems, the contractor will identify and suggest future actions that could be taken to make improvements to the systems.

4 . 3 Task 3: Project Tracking and Software Lifecycle:

4.3.1 The contractor shall analyze performance and recommend corrective actions during the project or release; track staffing, funding, and schedules and inform the Government of significant problems and issues uncovered; participate in regular technical and management reviews; evaluate procedure performance factors, such as execution time, resource requirements, skill requirements, and complexity; and propose tasks and procedures which improve process efficiency and quality. The contractor shall use an in-house project tracking tool. The contractor will provide information used in reporting metrics.

4.3.2 Documentation

Documentation shall be created and/or updated, throughout the appropriate phases of the system life cycle. The documents may require updating in any of the following phases, to ensure that the documentation describes the current configuration baseline for the system. The contractor is required to create and/or update, or assist with the creation/update, of the following documents, throughout the appropriate DOD/DFAS life cycle management phases.

Phase I (Program Definition and Risk Reduction):

• Technical Report

• Global Software Development Plan (GSDP) and/or Software Development Life Cycle

(SDLC)- Create and/or Update; the content of the GSDP/SDLC shall be compatible with the Federal Information System Controls Audit Manual (FISCAM) and/or DoD Risk Management Framework (RMF) and approved by DFAS.

• Release Development Plan – Update and/or create with the associated schedules and milestones.

• Content shall be compatible with Standard for Software Configuration Management Plans

• Risk Management Plan

• Requirements Analysis/Design Specification

• Software Test Plan - Create and/or Update

• Software Test Event and Results - Create and/or Update

• Test Script Matrix – Create and/or Update

• Regression Checklists – Create and/or update

Phase II (Engineering and Manufacturing Development):

• Database Design Description - Create and/or Update

• Software User Manual - Create and/or Update

• Software Transition Plan - Create and/or Update

• Software Version Description - Create and/or Update

• Software Test Plans - Create and/or Update

• Software Implementation Plan - Create and/or Update

4.3.3 Software Configuration Management. Where applicable, the contractor shall use project tracking tool (and/or the applicable system-specific configuration management tracker) IAW approved Software Configuration Management policies and complete the following software configuration management tasks:

• The contractor shall assist in developing configuration management (CM) controls and procedures and shall assist in the development of the software Configuration Management Plan.

• The contractor shall develop and/or assist in developing a Software Version Description (SVD) for each release, if needed.

• The contractor shall follow Government established Software Configuration Management (SCM) controls.

• Establish and maintain a central repository (CM library) for all supported systems.

• Develop and maintain production libraries and extract programs for each release.

• The contractor shall provide administrative support for DFAS to conduct the

Configuration Control Boards (CCBs), to include but not be limited to viewgraphs, reproduction of viewgraphs, handouts, and SCR status reports.

4.3.4 Requirements Management. The contractor shall perform a detailed analysis and/or evaluation of any proposed system changes to include interfaces, required for the system.

The contractor shall perform the following functions in support of system changes:

• Perform detailed evaluation of information systems requirements with the defined functional proponent. This includes assisting the functional proponent with drafting the SCRs.

• Examine existing information system schematics and related supporting software documentation.

• Examine the effects of a proposed software modification on system software reliability and efficiency of design. Create/provide a Rough Order of Magnitude (ROM) estimate.

• Verify operational effects on existing information systems.

• Recommend solutions for fixing the proposed changes and provide the rationale for the recommendation.

• If the system requires it, use Requirements Management software engineering tools pre-approved by DFAS in the performance of the aforementioned tasks.

• Conduct/Facilitate/Participate in Joint Requirements Planning (JRP), Functional

Requirements Review (FRR), Critical Design Review (CDR), Peer Reviews (i.e. Team Lead, and fellow developers sessions with users to elicit and define software requirements.

• Monitor changes to software requirement baselines and ensure the documentation of revisions.

• Participate in reviews to determine the completeness and consistency of software requirements.

• Develop formal requirement documents, such as the Functional Requirements Document, Interface Requirements Specification (IRS) and the System/Subsystem Specification

(SSS).

• Analyze and specify software requirements using business processing re-engineering, entity relationship diagramming, function point analysis, and other Government pre-approved software development methodologies.

• The contractor shall, if necessary, create and/or maintain a business process model and data model of the system. These models shall depict the system with the following information, using Government approved data/process modeling tools.

• A description of the defined software process, to include each of the software process constituent elements, (e.g., analysis, estimating, reviewing, coding, testing, auditing, implementing, post implementation review).

• A depiction of each of the software process elements that comprise the system defined software process, to include depicting the organization’s software process database;

library of software process related documentation; descriptions of the software life cycles; guidelines and criteria for tailoring the organization’s standard software process;

description of the organization’s standard software process; external requirements;

systems requirements allocated to software; activities in the GSDP/SDLC; project results; and work products.

• Analyze the current business environments for possible use by potential customers.

• The contractor shall develop or update System Life Cycle Management (SLCM) documents.

• Continue testing of system functionality to validate requirements and document the modifications needed to meet new or existing requirements.

The contractor shall perform the following Software System Maintenance activities:

• The contractor shall provide software maintenance to include. development and/or maintenance of software, as described in the GSDP/SDLC.

• The contractor shall not effect changes to the system, without authorization of an approved SCR, PTR or UTIL. The contractor shall participate in FRRs, as applicable, System Requirements Reviews (SRRs) and Critical Design Reviews (CDRs), to assist in the preparation of the approved SCRs.

• The contractor shall provide corrective action for emergency SCRs reported by the customer. If a software modification is required to correct the emergency SCR problem, the contractor shall make the software modification immediately and immediately report the corrective action taken to the System Manager.

• The contractor shall submit recommended technical SCRs to the System Manager for proposed changes the contractor determines will improve efficiency or performance of the system; resolve problems arising during the analysis, design, programming, or…