A03 DRAFT PWS Parking Mgmt Software Integration and Enterprise Support Services.pdf

DRAFT PERFORMANCE WORK STATEMENT (PWS)

Washington Headquarters Services (WHS) Executive Services Directorate (ESD)

Pentagon Services Division (PSD) Parking Management Software Integration and Enterprise Support Services

General Information

August 22, 2024

1. GENERAL: This is a non-personal services contract to provide information technology services, software integration, enterprise help desk support, and security engineering services for the WHS-ESD.

The contract shall provide these services to support the new Washington Headquarters Services - Parking Management System (WHS - PMS).

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform software integration and development services, enterprise help desk services and security engineering services to support the WHS – PMS as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: Washington Headquarters Services (WHS) provides administrative and management support to the Military Services, Office of the Secretary of Defense (OSD), and the Department of Defense (DoD) Agencies and Field Activities in the National Capital Region (NCR) and beyond. Washington Headquarters Services, Parking Management Office (PMO) manages parking permits, vehicle clearances and parking adjudication at the Pentagon, Mark Center, and Suffolk Building. These facilities are in Arlington, VA, Alexandria, VA, and Falls Church, VA. The PMO manages secured and unsecured open lots and garages for VIP, Non-VIP, visitors, and persons with physical disabilities at multiple variations of parking allocations, i.e. VIP, Standard Users, Low Emission Vehicles, Carpool, and Visitor Parking.

Building employees and visitors park free at any of the 3 locations but are required to register and receive approval prior to parking. Parking without registering will result in a citation, boot, or towed vehicle. The Pentagon Force Protection Agency (PFPA) and Pentagon Police Department (PPD) enforce parking at all locations 24 hours per day and 7 days per week and those activities should be captured in this system as well for continual monitoring.

The new WHS – PMS will roll out the establishment of an enterprise help desk to support tier 1, 2, and 3 problems with WHS – PMS, the operation and maintenance of the WHS – PMS. Continuous future development tasking will support residual development initiatives in response to operational mission needs generated using the WHS PMS in operation.

1.3 Objectives:

The purpose of this requirement is to integrate newly developed Parking Management system in to full live and post-live status with external applications. The new system is replacing the previous Parking Permit and Parking Vehicle Clearance systems.. The contractor must ensure all Risk Management Framework activities are completed to achieve an authorization to operate in conjunction with live operations inclusive of compliance for connectivity to external applications. The contractor must also collaborate with other entities to ensure proper integration of other systems & capabilities into the parking management system in accordance with DISA Guidance and DoD compliance. The contractor will provide comprehensive system support, prompt resolutions to user-reported issues, and Monitor and maintain the software system’s performance by promptly addressing and resolving technical problems.

1.4 Scope:

This requirement consists of the following major activities: software and system integration & sustainment activities, preparation of supporting project plan; enterprise help desk Tier 1 support, Tier 2 application support, Tier 3 platform support; database engineering, sustainment support, continuous system security / Risk Management Framework (RMF) maintenance support, Appian platform updates, preparation of status reports/IPRs and continuous training.

The contractor shall provide operational enterprise help desk & sustainment services, Tier 1, Tier 2 and Tier 3 support, continuing RMF/Security support, and continual development support per requirements as outlined in this PWS. The resulting contract shall include all cloud computing and support services required to operate, maintain, and safeguard an application in a Platform as a Service (PaaS)/Software as a Service (SaaS) environment. This resulting contract shall also include development services for new features, additional requirements, platform level changes, etc.

Software development and integration is inclusive of the integration of interoperability with external systems and applications in support of greater WHS and DoD mission requirements. This effort also includes enhancements to currently developed application modules, additional automation capabilities to improve system performance and increase database security and interoperability in accordance with DISA compliance and best practices.. The Contractor will also perform all technical activities necessary to ensure the new system integrates with legacy, current and new external systems (PFPA, etc) and will ensure compliance with DoD and DISA best practices. The Contractor will also provide software integration & development support to integrate Congressional and White House user access capabilities into the new parking system. The contractor will provide support for the Risk Management Framework Authorization to Operate (ATO) tasking initiatives in accordance with evolving DISA compliance directives. .

Deliverables under this contract include;

1.4.1 Authority to Operate (ATO) – The new Parking Management System received it ATO with

Conditions in December 2024. The contractor will provide the support necessary to obtain a full ATO during FY25. These support activities include resolving any remaining conditions as defined by the ATO-C, implementing a continuous monitoring program, updating the System Security Plan (SSP) as needed, and any other ATO Compliance requirements set forth by DISA and DoD Support Post - Go LIVE Activities (after full ATO is granted) This includes but not limited to items such as data cleanup not addressed or identified during the transition from the legacy system to the new PMS, modification of workflows, creating new reports, supporting the integration of external systems, or development of new features as directed by the government.

1.4.2 PFPA Case Management System Integration. Contractor will collaborate with PFPA, DISA JSP and other entities to integrate PMS software with PFPA enterprise case management system capabilities.

1.4.3 Congressional and White House user access – The contractor will now provide full lifecycle support and software integration support to incorporate capabilities in WHS PMS to support specialized user access to both Congressional and White House personnel.

1.4.4 Operational & Maintenance Support: System operational and maintenance (O&M) activities required to ensure that the PMS remains functional, efficient, secure, and up-to-date. These activities are essential for maintaining the system's performance, reliability, and security throughout its lifecycle. This support includes but is not limited to system monitoring, incident Management, routine maintenance, configuration management, performance tuning, security management, user support and training, and continuous improvement.:

1.4.4.1 Collaborate with JSP/DISA to provide Tier 1 Help Desk Support: Respond to and process self-service issues, to include task like updating a personal profile, adding a vehicle, updating a vehicle, or updating parking clearance and permit requests.

1.4.4.2 Provide enterprise Tier 2 Help Desk Support: Respond to and process user issues associated with account management, and security management in compliance with DISA directives and guidance.

1.4.4.3 Provide Tier 3 Help Desk Support: Resolve issues associated with software defects, perform regression testing, patch deployment, and release management. Tier 3 personnel will be the primary liaison between the cloud hosting provider (SMX) and the application platform vendor (Appian).

1.4.4.4 Maintain Standard Operating Procedures (SOP) for Tier 1 – Tier 3 helpdesk support

1.4.4.5 Implement enterprise Tier 1 – Tier 3 helpdesk support. This help desk can be expandable to provide help desk to support other FSD applications as well as WHS AD Appian acquisition application.

1.4.4.6 Test/validate Appian Platform updates

1.4.4.7 Feature Enhancements Online training sessions

1.5 Period of Performance: The period of performance shall be for one (1) Base Period of 12 months. The Period of Performance is anticipated to be as follows:

Period of Performance: 30 SEP 2024 to 29 SEP 2025

1.6 General Information:

1.6.1 Quality Control: The contractor shall develop and maintain an effective Quality Control Program (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QCP is how the Contractor’s work complies with the requirement of the contract. The QCP shall be delivered via electronic mail within 30 days of the contract award. Amendments/changes to the QCP shall be delivered to the COR and KO within three (3) business days following any change.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not required to perform service on the following holidays:

New Year’s Day Independence Day Martin Luther King Jr.’s Birthday Labor Day Inauguration Day (when observed)  Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth National Independence Day Christmas Day

1.6.4 Hours of Operation: The Contractor is responsible for conducting business, between the WHS core hours of 7:00 AM to 4:30 PM Monday through Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings regardless of place of performance (on-site and/or virtually). The Contractor shall have the ability to authorize flexible work hours for contractor personnel working virtually. The Contractor must, at all times, maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: The work associated with this project shall be conducted virtually with potential onsite meetings as required. The contractor shall collaborate with the government to ensure a proper environment to stage and host the design, development, testing, and implementation of the solution.

The Government shall provide access to government locations (as needed) to support the efforts of the contract. All classified work will be performed at DISA location at 6910 Cooper Ave, Ft. Meade, MD 20755 or other classified locations approved by COR.

1.6.6 Type of Contract: The Government anticipates a Fixed Price contract.

1.6.7 Security Requirements: The work to be performed under this contract is Unclassified, Secret and Top Secret. While most of the work to be performed is unclassified, identified personnel require both secret and top-secret clearances to support special tasks associated with this effort. This contract requires personnel to obtain the Government issued Common Access Card (CAC) in order to provide identification for access to government computer systems and physical access to facilities. Personnel must meet and maintain investigative and adjudicative requirements specified in DoDI 5200.46, and immediately report to the Government Contracting Activity (GCA) any issues affecting CAC eligibility. Government issued credentials are the property of the United States Government and must be returned when no longer required for performance on this contract. Return CACs to: Washington Headquarters Services (WHS) Security Office, 4800 Mark Center Drive, Suite 10G07, Alexandria, VA 22350.

CACs will not be used to access information systems, facilities, or installations that are outside the performance requirements of this contract. CACs will be used only by the individual to whom it was issued and will not be used for or by any other person.

The contractor will immediately notify the GCA if a CAC is lost, stolen, or otherwise missing.

Replacement CACs will require the contractor employee to obtain a signed memorandum from the WHS Security Office, requesting a new CAC be issued.

1.6.7.1 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be turned over to the Government to close out individual hand receipts and the reissuance / reassignment of government furnished equipment.

1.6.7.2 Cybersecurity: The Contractor shall implement DOD cybersecurity rules and measures related to any work performed under this contract for WHS systems, subsystems, components, and support systems/equipment.

1.6.7.3 Controlled Unclassified Information (CUI): The Contractor shall adhere to the guidance for generating, marking, disseminating, safeguarding, and destroying of Controlled Unclassified Information.

The Contractor is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the Contractor is responsible for applying CUI markings and dissemination instructions accordingly. The contractor shall follow the procedures to protect controlled unclassified information in accordance with DODI 5200.48 “Controlled Unclassified Information (CUI)”.

1.6.7.4 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.4.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due to the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.4.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.5 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.8 Special Qualifications: Contractor personnel shall be required to sign standard non-disclosure statements as required, for system administration personnel who may have access to government data in the course of their duties.

The Contractor shall ensure that personnel accessing the Government’s network and information systems have the proper and current information assurance certification to perform information assurance functions in accordance with IAW DoDD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor will adhere to the qualification and certification standards of DoD 8570.01-M until replaced by the DoD 8140.01 Manual based on the IA functions of the position.

Any contractor obtaining/maintaining privileged access to any information system, contractor personnel performing IA functions described in IAW DoDD 8570.01-M must satisfy both preparatory and sustaining DoD IA training and certification requirements. Additionally, contractor personnel with privileged access must complete a Privileged Access Agreement.

Privileged User: Privileged users are those individuals who are authorized to perform security-relevant functions that require elevated access and authorization.

Privileged access: Authorized access that provides a capability to alter the properties, behavior, or control of the IS or network. It includes, but is not limited to, any of the following types of access:

a. “Super user,” “root,” or equivalent access, such as access to the control functions of the IS or network, administration of user accounts, and so forth.

b. Access to change control parameters (for example, routing tables, path priorities, and addresses) of router, multiplexers, and other key IS or network equipment or software.

c. Ability and authority to control and change program files, and other users’ access to data.

d. Direct access (also called unmediated access) to functions at the operating system level that would permit system controls to be bypassed or changed.

e. Access and authority for installing, configuring, monitoring, or troubleshooting the security monitoring functions of ISs or networks (for example, network or system analyzers, intrusion detection software, and firewalls) or in performance of cyber or network defense operation.

The Contractor shall ensure that contractor personnel who perform work on DoD Automated Information Systems (AIS) must have one of three position sensitive designations:

ADP-I (AKA: Information Technology (IT)1): Single Scope Background Investigation (SSBI)/Single Scope Background Periodic Reinvestigation (SBPR)/Phased Period Reinvestigation

(PPR)

ADP-II (AKA: IT-2): Access National Agency Check with Inquiries (ANACI)/National Agency Check with Inquiries (NACI)/National Agency Check, Local Agency Checks, Credit Checks

(NACLC)

ADP-III (AKA: IT-3): National Agency Check (NAC)/Entry National Agency Check (ENTNAC) IAW DoDI 5200.2-R Personnel Security Program.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings the contracting officer shall apprise the contractor of how the government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): Please see DFARS Clause 252.201-7000 “Contracting Officer’s Representative”.

1.6.11 Key Personnel: The personnel listed below are considered essential to the work being performed under this contract. Before removing, replacing, or diverting any of the listed or specified personnel or facilities, the Contractor shall (1) notify the Contracting Officer reasonably in advance and (2) submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this contract. The Contractor shall make no diversion without the Contracting Officer’s written consent. Please see the below chart for the Key Personnel positions:

PWS Section Position Qualifications 5 Project Manager 8+ years of experience as an Agile project manager managing programs, commercial and/or Government experience combined

5.4 Software Engineer (Senior) 10+ years of experience, private or government experience, in software engineering / systems development;

Bachelor’s Degree in Information Systems, Software Engineering, Computer Science, or other Information Technology related fields.

OR

15+ Years of Experience private or government experience in software engineering / systems development in place of bachelor’s in Information Systems, Software Engineering, Computer Science Preferred SWE with APPIAN Experience

5.3 Senior Security Engineer 10+ Years of experience in several of the following areas is required: business security practices and procedures; knowledge of current security tools available; hardware/software security implementation; different communication protocols;

encryption techniques/tools; familiarity with commercial products, and current internet/EC technology.

Ability to serve as Information System Security Officer (ISSO).

Shall possess at the time of award a TOP SECRET

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel shall be required to obtain, use, and display a Common Access Card in the performance of this service.

1.6.13 Contractor Travel: N/A

1.6.14 Other Direct Costs: N/A

1.6.15 Data Rights: Please see Solicitation/Contract for applicable Data Rights clause(s.)

1.6.16 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan shall be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.17 Phase In Period: N/A

1.6.18: Special Requirements: Contractor personnel responsible for completing tool and application development shall complete the appropriate training requirements to ensure the proper and secure implementation of user requirements. Contractor shall also possess the following certifications and/or credentials:

CMMI LVL 3 Version 2.0 DEV/SVC

ISO27001

ISO9001

TS FCL

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

ACOR Alternate Contracting Officer's Representative aPaaS application Platform as a Service API Application Programming Interface ATO Authority to Operate CAC Common Access Card CFR Code of Federal Regulations CMIS Content Management Interoperability CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf CPR Component Parking Representatives CUI Controlled Unclassified Information CVS Contractor Verification System DFARS Defense Federal Acquisition Regulation Supplement DISA Defense Information Systems Agency DOD Department of Defense DoDI Department of Defense Instructions DPR Division Parking Representatives ESD Executive Services Division FAR Federal Acquisition Regulation FISMA Federal Information Security Modernization Act FOC Final Operating Capability IL Impact Level IPR In Progress Review JSP Joint Service Provider KO Contracting Officer LPR License Plate Recognition MTBP Mass Transit Benefit Program NAC National Agency Check NIST National Institute of Standards and Technology OCI Organizational Conflict of Interest ODBC Open Database Connectivity ODC Other Direct Costs OLEDB Object Linking and Embedding Database OPSEC Operational Security OSD Office of the Secretary of Defense PCO Procuring Contracting Officer PFPA Pentagon Force Protection Agency PIPO Phase In/Phase Out PKI Public Key Infrastructure PMO Parking Management Office PMP Project Management Plan or Program Management Plan PMS Parking Management System POC Point of Contact PPD Pentagon Police Department PRS Performance Requirements Summary PSD Pentagon Services Division PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RMF Risk Management Framework

RMS Reporting Management System RPO Recovery Point Objective RTO Recovery Time Objective RWD Responsive Web Design SaaS Software as a Service SDLC Software Development Life Cycle SOO Statement of Objectives SQL Structured Query Language SSO Single-Sign On STIG Security Technical Implementation Guide TE Technical Exhibit USWDS United States Web Design System WHS Washington Headquarters Services

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: The government will provide basic services to phones, desks, utilities, information technology, and general office supplies) while working in Government facilities.

3.2 Facilities: Basic facilities such as workspace and its associated operating requirements (i.e., phones, desks, utilities, information technology, and general office supplies) will be provided while working in Government facilities. Tele-workers will only use government furnished equipment to remotely access the WHS network.

3.3 Equipment: The Government will provide basic services to phones, desks, utilities, information technology, and general office supplies) while working in Government facilities. Tele-workers will only use government furnished equipment to remotely access the WHS network.

3.4 Software License and Fees: The Government will be responsible for sponsoring any licensing and fees required for Government and Contractor use and/or procurement of non-government owned, software, development platforms, cloud capacity and/or other type applications and services.

3.5 Access to Government Information Systems: The Government will provide Contractor personnel requiring access to Government Information Technology Systems issuance of a Common Access Card (CAC) utilizing the Contractor Verification System (CVS) or similar access authorization process. Access requests will be coordinated and approved by the Government Procuring Contracting Officer (PCO).

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2. Materials: NA

4.3. Equipment: The contractor shall possess the capability to support a web-based development environment to support the effort.

4.4 Training: The Contractor shall be able to provide agile training tailored to Government and Contractor personnel on an as needed basis to facilitate collaborative team execution of this PWS.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1 Project Plan

Task 5.1: Project Plan: Subsequent to award, the Contractor shall prepare a Project Plan for use during the project. The Project Plan will record the sequence of activities necessary to deliver an Final operating capability of the new Parking Management System. The Project Plan shall include:

A project schedule incorporating the start and completion dates for each program increment and associated deliverables.

Management of all lifecycle processes that support buildout of new additional requirements

(Congressional user support and White House User Support) A description of the system development process to be used to address additional requirements An outline of all additional system documentation to be developed and/or modified.

Checklists/matrix to be used for the testing phase of additional requirements A plan for support to software integration with external mission systems (PFPA, etc) A plan for the data conversion and cleanup process.

A plan for the enterprise help desk operations capability compliant with DISA guidance.

The Project plan shall be delivered in draft format to the Government Stakeholders and the COR for review and approval in alignment with agile methodologies

Task 5.2: Requirements Verification and Validation

The Contractor shall verify and validate the Government provided requirements documentation developed under a separate contracting effort have been satisfied.

The Contractor shall perform requirements gathering and gap analysis in support of additional requirements for Congressional and White House support.

Task 5.3: System Design

The Contractor shall use the updated Requirements Analysis documents to develop iterative

System Design Plan which shall result in the creation of updated Parking Management System Design plans shall be tailored to support integration of external systems (ie. Congressional and White House access and user capabilities) in draft format to the Government for review and approval.

Design plans shall follow the industry established Software Engineering Institute Capability

Maturity Model (SEI/CMM) guidelines for system development and use industry best practices for agile software development, such as Development, Security and Operations (DevSecOps) methodologies in accordance with DISA policy and procedures.

Task 5.4: System Development

The Contractor shall follow the Government approved iterative System Design Plans to develop the additional Parking Management System capabilities supporting external system connectivity, Congressional user access and White House user access. The contractor shall leverage the various Requirements Analysis documentation provided by the Government and gap analysis results in the system development effort.

System development shall follow the industry established SEI/CMM guidelines for system development and use industry best practices for agile software development, such as DevSecOps.

The Contractor shall conduct system demonstrations at the completion of one or more Sprints per the Project and development plans. The demonstrations shall include a detailed walk-thru of integrated processes, screens and reports. The Contractor shall enter sample data that mimics real user data into the system prior to demonstrations. Draft copies of all screenshots and all reports for each demonstration shall be delivered to the Government for review and approval.

Task 5.5 System Documentation

Using the industry established SEI/CMM guidelines for system documentation the Contractor shall document the FOC sustainment and operations functionality and will also maintain and update (as required) all system design and functionality. The contractor shall incorporate (as needed) all necessary documentation related to the support of external systems and capabilities (PFPA, White House, etc) The Contractor shall maintain easy-to-follow user guide for enterprise help desk support & system maintenance and support within the context of using agile methodologies. Included in the system documentation shall be on-going system maintenance instructions for use in supporting enterprise Tiered help desk operations.

This system maintenance documentation shall be considered “living documents” and will require continuous updates.

The Contractor shall deliver iterative drafts of system maintenance, design documentation and user guide to the Government for review and approval.

Task 5.6 System Testing

Using the industry established SEI/CMM guidelines, DevSecOps best practices and applicable Government approved checklists/matrix for system testing, the Contractor shall conduct integrated system testing on all new features, system changes, platform upgrades & changes, etc. System test events shall occur on cadence, as defined in the Project Plans and coordinated with WHS and DISA stakeholders. An FOC integrated system validation test shall be conducted in the presence of the Government representative.

Test reports for all Government witnessed test events shall be delivered to the Government with deficiency resolution plans. Subsequent testing shall be performed to demonstrate resolution of deficiencies. Updated reports shall be delivered to the Government when deficiencies are resolved.

Task 5.7 Database Engineering Support

In accordance with defined requirements, the Contractor shall support post go-live initiatives with the clarification and cleanup of data from retiring Parking Permit System and the Parking Clearance System into the new Parking Management System. The Contractor shall also provide operational sustainment of all support databases. The contractor will collaborate with all WHS and DISA stakeholders and technical engineers to support integration of PMS capabilities with new external mission systems as needed. The contractor shall provide database expertise support expansion to Congressional and White user access capabilities.

Task 5.8 System Help Desk Support

The contractor shall provide all support necessary to the Government Stakeholders and embedded contractor teams to support initial operations full system live operations. The Contractor shall provide Tier 1, Tier 2 and Tier 3 helpdesk support to both the Parking Management Government and external stakeholders to include but not limited to the following:

1. System Monitoring

Performance Monitoring: Continuously tracking system performance metrics such as CPU usage, memory usage, disk I/O, and network bandwidth to identify potential bottlenecks or issues.

Availability Monitoring: Ensuring that the system is accessible and operational at all times. This includes uptime monitoring and detecting outages.

Security Monitoring: Monitoring for security threats and vulnerabilities, including intrusion detection, malware scanning, and log analysis.

2. Incident Management

Issue Detection and Logging: Identifying and recording incidents that impact system performance or availability.

Incident Response and Resolution: Diagnosing and resolving incidents in a timely manner to minimize downtime and disruption.

Root Cause Analysis: Investigating the underlying causes of incidents to prevent recurrence.

3. Routine Maintenance

Software Updates and Patches: Applying updates and patches to the software system to fix bugs, close security vulnerabilities, and add new features.

System Backups: Regularly backing up data and system configurations to ensure that data can be recovered in the event of a failure.

Data Archiving and Purging: Managing data storage by archiving old data and purging unnecessary data to optimize system performance and storage utilization.

4. Configuration Management

System Configuration: Managing and documenting the configuration of hardware, software, and network settings to ensure consistency and stability.

Change Management: Implementing and tracking changes to the system in a controlled manner to avoid unintended disruptions or conflicts.

5. Performance Tuning

Optimization: Identifying and implementing optimizations to improve system performance, such as database indexing, query optimization, and load balancing.

Capacity Planning: Analyzing current usage patterns and predicting future needs to ensure that the system can scale appropriately.

6. Security Management

Access Control: Managing user access and permissions to ensure that only authorized individuals can access sensitive data and system functions.

Vulnerability Management: Regularly scanning for and addressing vulnerabilities to protect the system from threats.

Compliance Management: Ensuring that the system complies with relevant regulations and standards.

7. User Support and Training

Help Desk Services: Providing technical support to users to address their questions, issues, and training needs.

User Training: Educating users on how to effectively use the system and any new features or updates.

8. Documentation and Reporting

System Documentation: Maintaining comprehensive documentation of the system’s architecture, configuration, procedures, and changes.

Performance Reports: Generating regular reports on system performance, incidents, and maintenance activities to inform stakeholders and guide decision-making.

9. Disaster Recovery Planning

Disaster Recovery Procedures: Partnering with product vendor and cloud platform support to Develop and test plans for recovering the system in the event of a major failure or disaster.

Redundancy and Failover: Collaborating with SMX and APPIAN to validate redundancy and failover mechanisms to ensure business continuity.

10. Vendor and Third-Party Management

Vendor Coordination: Collaborating with software vendors and third-party service providers to ensure timely support and updates.

Service Level Agreements (SLAs): Monitoring compliance with SLAs to ensure that vendors meet their performance and support commitments.

11. Continuous Improvement

Feedback Collection: Gathering feedback from users and stakeholders to identify areas for improvement.

Process Improvement: Continuously refining operational processes to enhance efficiency, effectiveness, and user satisfaction.

Task 5.9 Status Reports

The Contractor shall meet weekly with the Task Monitor and provide a brief status report of the project to date. The status reports shall include accomplishments, risk, action items, and issues that need to be addressed and a requested timeframe before closing each item.

Task 5.10 Information System Security Officer (ISSO) Services

The Contractor will be required to provide ISSO support in the WHS Parking Management System Support system utilizing the eMASS tool as the repository for all artifacts and POA&Ms. eMASS must also be used to track the status of all system authorizations. The System ISSO is responsible for creating, maintaining, and updating all documentation and artifacts required to meet the requirements for the Risk Management Framework and throughout the lifecycle of the system.

The Contractor shall coordinate with Program Managers, Information System Security Managers, User Representatives, and Information System Owners to verify proper data entry into both eMASS and the DoD IT Portfolio Repository (DITPR) in accordance with the DITPR Users Guide and JSP guidance. The Contractor shall perform oversight to ensure consistency between eMASS and DITPR. The Contractor shall submit a comparison report between eMASS and DITPR and provide recommended process/ procedure changes to improve accuracy.

The Contractor shall provide data to support DoD Cybersecurity Scorecard metrics involving PKI- Enablement of web-based systems.

The Contractor shall attend and provide recommendations to JP22 for any governance board items related to systems that they are responsible for and ensure that changes are updated in the authorization packages in eMASS. For deviations from DISA, JSP, or Department of Defense (DoD) policy, the Contractor shall complete and provide waiver requests to the JP22 Government Security Manager (SM) for Authorizing Official (AO) risk decision. The System ISSO shall write/update security-related artifacts, policies and procedures for implementation into the maintenance of the system, and inclusion into the system’s Assessment and Authorization (A&A) package.

The Contractor shall obtain/maintain the following access: RMF Knowledge Service login (PKI-enabled), DISA STIGs (to include PKI-enabled DISA webpages), NIST webpage access, Remedy, Common Criteria webpage access, JP22 related SharePoint sites, and JSP Splunk pages, Fed-Ramp site, DITPR registry, eMASS, and remain current on applicable security controls and Cyber Security-related updates and information and sites identified by the JP22 Government.

The Contractor shall perform RMF requirements on networks/ systems/enclaves in both the DISA Network, Transport, Test, Stand-alone, and Cloud environments to include Common Control Provider (CCP). The Contractor shall write and prepare A&A packages for both the DISA Authorizing Official Designated Representative (AODR) and the JSP Authorizing Official (AO) review/recommendation/approval/disapproval. A completed A&A package consists of addressing all applicable security controls to sufficiently provide a completed Implementation Plan, Security Assessment Plan, Continuous Monitoring Plan, System security Plan, and Plan of Action and Milestones (POA&Ms);

and further, the ISSO will prepare the STRR for transition to RMF Step 4 and readdress concerns from the SCA-R derived from the Security Assessment Plan and the Security Assessment Report, to include the Risk Assessment Report.

The Contractor shall develop and prepare all documents required to support compliance with CNSS 1253 controls and associated control correlation identifier within eMASS. Further, the contractor shall provide all documents required for the submission of Assessment and Authorization packages for all JSP systems.

The contractor shall create, maintain, and update all Appointment Orders, PMPs, and Applicable Control Templates.

The Contractor will be responsible for initiating the authorization of new systems and the re-authorization efforts expired/expiring systems starting with Prepare, Phase 1- Categorization, Phase 2 - Select Security Controls, Phase 3 - Assess Security Controls, Phase 4 - Validate Security Control, Phase 5 - Authorize Information System Phase 6 - Initiate Continuous Monitoring. The contractor shall also provide this support to

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS :

6.1. The Contractor must abide by all applicable statutes, regulations, publications, manuals, and federal policies, procedures including but not limited to those listed below:

National Institute of Standards and Technology SP 800-53 and FedRAMP DoD RMF Federal Information Security Modernization Act of 2014 (FISMA) (https://www.dhs.gov/fisma) JSP Business Rules/DoD & DISA Security Standards United States Web Design System (USWDS) 2.0 DoD Instruction 1000.27, “MTBP” October 28, 2008 Administrative Instruction 88, “Pentagon Reservation Vehicle Parking Program, August 26, 2009 Administrative Instruction 30, “Force Protection of the Pentagon Reservation, June 26, 2009, change 2, September 27, 2012

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. ATTACHMENT/TECHNICAL EXHIBIT LIST:

7.1. Attachment 1/Technical Exhibit 1 – Performance Requirements Summary

7.2. Attachment 2/Technical Exhibit 2 – Deliverables Schedule

7.3. Attachment 3/Technical Exhibit 3 – Estimated Workload Data

7.4 Attachment 4/Appendix 1- Parking Enforcement Requirements

TECHNICAL EXHIBIT 1

Performance Requirements Summary The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement)

Standard Performance Threshold (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

Method of Surveillance

PRS # 1.

Meet the technical requirements of the contract.

The contractor shall meet all technical requirements of the contract.

No more than one deviation per performance period of the contract.

Random samples of work and milestone updates via IPR and project updates

PRS #2

The contractor shall provide qualified personnel to perform the tasks identified in the PWS Part 5:

Tasks 1 - 9.

The contractor shall meet 100% compliance with the PWS for all personnel requirements.

No more than one deviation per life of the contract.

Periodic Surveillance

PRS # 3

All deliverables submitted in accordance with approved Project Management Plan.

The contractor shall meet all the delivery timelines as listed against each item identified in the approved Project Management Plan.

The contractor meets or exceed 95% on-time delivery of all deliverables.

100% Inspection

PRS # 4

The contractor shall provide oral and written reports and presentations on the program to inform customers and management of the operations and initiatives, processes followed, and problems encountered in such a way that this facilitates accomplishment of tasks identified in the PWS Part 5: Tasks 1-9

Presentations and reports are complete and well received by the audience. Draft presentations do not need to be revised more than once at the request of the COR.

No more than three (3) valid complaints on non-compliance in one year.

100% Inspection

PRS # 5

Ensure all quality requirements performed in accordance with established standards (incl QCP &

QASP).

The contractor shall meet all quality requirements of the contract.

Zero deviation from standards set forth in QCP.

Periodic Surveillance

PRS # 6

Responsiveness to clarifying customer defined requirements.

The contractor shall accept in-scope requirements and assess integration timeline.

The contractor incorporates 100% clarifying in-scope requirements.

100% Inspection

PRS # 7

Responsiveness to emergent customer defined requirements.

The contractor shall assess emergent, in-scope requirements and assess integration timeline based on mission criticality.

The contractor incorporates 75% or more emergent in-scope requirements per period of performance.

100% Inspection

The following listing provides various types of Surveillance as examples to select from and should not…