A11 Draft DIFS RFI PWS.pdf

DRAFT

PERFORMANCE WORK STATEMENT (PWS)

DEFENSE INTERGRATED FINANCE SYSTEM (DIFS)

RE-ARCHITECTURE

PART 1

GENERAL

1. GENERAL:

1.1 Introduction: The contractor shall provide all personnel, items, and services necessary to design, modernize, re-architect and convert the code base for the Defense Integrated Finance System (DIFS) platform onto a common, supported, and secure Cloud and web software platform as defined in this Performance Work Statement (PWS). The overall project will incorporate DevSecOps principles, and the resulting product will be fully audit compliant with a full Authority to Operate (ATO). The activity requirements do not include user experience enhancements, or code consolidation, but may include data conversion. Vendors to accomplish the required code conversions and deliver the revised or re-architected DIFS code base can use any means and methods.

1.2 Background: The Defense Finance and Accounting Service (DFAS) owns and maintains

DIFS, a financial system providing Department of Defense-level financial management functions for the Security Assistance (SA) program. DIFS links implementing activity records with the bill and supporting financial statements issued to countries purchasing articles and services through foreign military sales. These functions include centralized Foreign Military Sales (FMS) trust fund accounting, foreign customer billing, and financial management reporting. DIFS consolidates FMS data from the United States Army, Navy, Air Force, and other implementing agencies (IA) and provides accountability for the oversight of the financial and program management aspects of SA.

Below is an overview of the architecture, hardware, and users of DIFS:

System Architecture: DIFS software is written in COBOL and data is maintained on the VSAM file management system. DIFS software resides on a logical partition (LPAR) of an IBM mainframe computer, which is managed by the Defense Information System Agency (DISA). The IBM mainframe uses z/OS 2.4 operating system. Users access DIFS application through the NIPRNET telecommunications using a web browser and MIAP. Interface partners send data through DAI’s GEX for consumption by DIFS. The chart below contains the current Lines of Code for DIFS:

DIFS System Lines of Code

Code Type Lines of

Code CICS Maps 32,214 CICS Cobylib 39,362

CICS COBOL 260,610

Batch Copylib 30,670 Batch Programs 628,453

JCL 3,767

PROC 115,864

Control Cards 6,708

Note: This includes 354 stand-alone programs, 216 programs calling other programs and 134 called modules.

Hardware: DIFS is hosted on an IBM z-series Business Class mainframe computer. All site provided equipment must be common access card (CAC) enabled and be able to support CAC certificate-based login.

Users:

Functional Users: Users are responsible to provide the functional users’ equipment capable of supporting a web browser. Web access is supported for .mil sites only with SSL via DISA’s Multi-Host Internet Access Portal (MIAP). The Cloud version of DIFS will be required to support Chrome, Firefox, and Edge browser access. DIFS currently has 600 users with 180 roles.

Technical Users: Users are responsible to provide the Technical users’ equipment capable of supporting CAC access.

1.3 Objective: The intended end state of DIFS at the end of the project will be a Government Owned Government Operated comprehensive billing system for the DoD FMS community that is formed entirely of components which are non-proprietary except to the government. The end state will be a common codebase and will maintain the functionality and logic of the original COBOL application. The conversion process should adhere to industry best practices including documentation and testing, to ensure a seamless transition and maintainability of the codebase. To include the conversion of the DIFS code base to use a common, secure, and supported Cloud and web framework platform for DoD approved browsers (Chrome, Edge, and Firefox). Contractor to provide end to end traceability and visibility of functionality and data. This legacy technical environment needs to be converted to a new modernized single universal interface. This must all be accomplished without loss of functionality or data.

The DIFS system will:

Utilize a single data structure Leverage open architecture Be cloud hosted (on JWCC provider) Provide web-based, user friendly access for DFAS technicians and other Government employees Allow real-time account updating Allow for batch processing where and when appropriate Complete processes, such as processing, in an efficient and timely manner Comply with all DoD and Government regulations governing financial systems

Including but not limited to Standard Financial Information System (SFIS) standards and Standard Line Of Accounting (SLOA) standards

Contain any other actions/activities/requirements that will be needed to develop a modern, customer friendly, secure system

Vendors must design a comprehensive strategy to deploy DIFS in an alternative operating environment. Recommendations should identify the approach as a revision to modify and refactor DIFS to Cloud or a rearchitect to materially alter DIFS to Cloud. All recommended strategies must address the total environment structure including, but not limited to, hardware, infrastructure, platforms, software, and security. Contractor’s environments (DEV, TEST, PROD) must all be accredited at IL5.

DFAS is open to considering any reasonable designs, however, there are certain technical aspects that have been pre-determined:

a. Code Conversion: The desire of DFAS is to convert/replace legacy code (which includes, VSAM, COBOL, DB2, JCL, CICS) to a modern language, in order to utilize existing languages that have a proven track record for auditability, compliance, and accuracy. The current DFAS code base for this conversion effort is approximately 800,000 lines of code.

Clean Code: It is the expectation of DFAS that the code will be fully converted to a new language vice migrating COBOL to a new (cloud) environment. In addition, it is the expectation that the converted code will also be refactored to provide a modern, clean, and efficient code base, which leverages modularity and microservices to the greatest extent possible, in the target language (i.e. Java). Final code base should be easily integrated with other code bases in the same language. Code will be readable, clear, reliable, secure, easy to test, documented, annotated and modular.

b. Database Structure: The desire of DFAS is to consolidate disparate data types with different data structures into a single data structure that will comply with DoD and DFAS data standards (i.e. SFIS, SLOA). It will apply/leverage an efficient design that best utilizes a high performance and scalable RDBMS that aligns with DFAS Enterprise Architecture. The target database will also need to comply with, and accommodate NARA requirements, and will need to retrieve archival data for retroactive processing.

c. Data Cleansing and Conversion: The desire of DFAS is to cleanse, convert, and migrate all necessary system and account data, current and historical, from the legacy systems into the new data structure. Data in the DEV and TEST environments should be refreshed at an agreed upon frequency. This data consolidation only impacts this application.

d. Application: The system should utilize a common modern language, in the application logic. Update the existing UI. In addition, all coding (developed and converted) should follow Federal best standards for efficiencies, secure coding, and maintainability.

e. Business Intelligence and Analytics: In alignment with DFAS enterprise technology architecture and DFAS expertise, the system should integrate with a current DFAS commercial Business Intelligence and Analytics tool such as Microsoft Power BI.

f. Cloud Hosting: The production environment will reside in a DoD Cloud enclave engineered for large, high performance workload. It is the expectation of DFAS that the system will be hosted in a FIL level 5 certified, DISA approved environment.

g. Security: All software, commercial and developed, must fully comply with all applicable DoD and DFAS Cyber Security requirements and guidelines, including

Zero Trust, and Security Technical Implementation Guide (STIG), NIST, STIGs, SSAE18, DoD FMR. Any and all tools, platforms, and software libraries must be current, with patches, versioning, and under vendor support. Software must also comply with Supply Chain requirements and clearly identify company and country of origin. In addition, all products, commercial and custom, must be analyzed for vulnerabilities using code analysis tools such as FORTIFY or ACAS. Vulnerabilities found in testing or code scanning to be tracked in a Vulnerability tracker and noted on a POAM (Plan of Action and Milestones) or risk tracker.

h. DevSecOps: The desire of DFAS is to utilize DevSecOps and Agile methodology for this project and to transition these processes to DFAS upon completion. Following Agile methodology, development and testing will follow Sprint cycles that will refine user stories and acceptance criteria, allow for collaborative development and testing, and produce potentially shippable products beginning with the deployment of the MVP, followed by MVCR that will occur on a scheduled basis. The establishment of a DevSecOps pipeline must comply with DoD, DISA, and DFAS standards to include monitoring and providing compliance enforcement of containerized applications which cover all the DevSecOps pillars (Develop, Build, Test, Release & Deploy, and Runtime) for a secure posture with the focus being on automation and integration going forward. The contractor must demonstrate a proven method for leveraging Cloud services including Continuous Integration/Continuous Deployment (CI/CD) and DevSecOps.

i. Authority To Operate: The desire of DFAS is to complete a full ATO, following the

(NIST) Risk Management Framework guidelines and standards for the submission and completion of the ATO. In addition, the initial ATO should be positioned for migration to a Continuous ATO as instructions and guidance are established.

j. Interfaces: The desire of DFAS is to modernize interface processing to the extent possible but utilizing an interface broker and utilizing modern formatting and processing. The system must retain the capability to send and receive data via all existing interfaces.

k. System Integrator: The desire of the DFAS is to work with a vendor that has experience leading large modernization efforts that involve many different technical aspects that will need to be brought together for an efficient and stable modern system.

1.4 Scope: The contractor shall provide planning, developing, designing, building, and licensing in order to support the DIFS Modernization and Re-architecture requirement.

In addition, the contractor shall provide all personnel, management, administrative and technical services to meet the requirements outlined in this PWS. To support the scope of DIFS the contractor shall complete the seven (7) tasks outlined in Section 4 of this PWS as follows:

TASK 1: Contract Program Management TASK 2: Technical Analysis and Design – (Analysis, prototype, development, devsecops, user guide) TASK 3: Software Programming – (Conversion, Unit Test, Peer Review, Data

Migration) TASK 4: Security – (FISCAM, RMF, FFMIA, DFIS, Vulns, STIGs)

TASK 5: Data Conversion and Migration TASK 6: Deployment TASK 7: Training and Maintenance – (Training plan and documentation)

1.5 Period of Performance: The anticipated period of performance shall consist of one (1)

Base Period of 4 months and five (5) 6-month Option Periods.

Base Period: 11/1/2024 – 02/28/2025 Option Period 1: 3/1/2025 – 8/31/2025 Option Period 2: 9/1/2025 – 2/28/2026 Option Period 3: 3/1/2026 – 8/31/2026 Option Period 4: 9/1/2026 – 2/28/2027 Option Period 5: 3/1/2027 – 8/31/2027

1.6 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which they assure themselves that the work complies with the requirement of the Task Order (TO). The program should take into consideration the Task (See Part 4) and Performance Requirements Summary (PRS) of the PWS.

1.7 Quality Assurance Plan: The Government shall evaluate the contractor’s performance under this TO in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance and the minimum acceptable level of support.

1.8 Recognized Holidays: With the exception of customer support calls, contractors are not expected to perform on any federally recognized holidays, to include but not limited to:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Christmas Day Independence Day

If the holiday occurs on a Saturday the holiday will be observed on Friday. If the holiday occurs on Sunday the holiday will be observed on Monday.

1.9 Hours of Operation: The contractor shall conduct business between the core hours of

0630 - 1700 hours Monday thru Friday Eastern Time except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the PWS when the Government facility is not closed for any of the above reasons. The stability and continuity of the workforce is essential.

1.10 Place of Performance: The work to be performed under this TO is anticipated to be 100% remote. Collaboration tools such as phone conference lines and Microsoft Teams will be used for initial orientations and regular status meetings. Arrangements will be made for contract staff to receive a DFAS laptop through shipping and CAC cards can be obtained at any RAPIDS location.

1.11 Type of Contract: The contract type is anticipated to be a mix of Firm-Fixed Price (FFP) and Labor Hour (LH).

1.12 Travel: The Government does not anticipate any travel at this time.

1.13 Relocation: Relocation costs and travel costs incident to relocation are not allowable and will not be reimbursed hereunder.

1.14 Shared Data: Vendors might receive access to, or generate, controlled unclassified information (CUI), legacy information, or official DOD information while providing support of the project. CUI, legacy information, and official DOD information are defined in DoDI 5200.48, 32 C.F.R. 2002, and DoDI 5230.09. Vendors must complete and sign a Non-Disclosure Agreement to identify, share, mark, safeguard, store, disseminate, destroy, and maintain CUI, legacy information, and official DOD information in accordance with DoDI 5200.48. No person may have access to CUI, legacy information, or official DOD information, unless that person has been determined by the Contracting Officer Representative (COR) or Contracting Officer (CO) to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Some legacy information made available by the government may contain legacy markings, such as FOUO, reflecting restricted access or restricted dissemination. If during the handling, the materials containing legacy markings remain in the DOD, it will be treated as CUI.

1.15 Data Rights: The DIFS requirement will utilize current data and software that is owned by the government. Although the Contractor will be given access to, and the ability to use, the existing DIFS code, documentation, and data, DFAS will retain its intellectual property rights to the data and code.

DFAS intends that all data, software, and documentation delivered by the contractor in performance of this TO will be owned by DFAS. This data, software, and documentation includes, but is not limited to, data, documents, graphics, code, plans, reports, schedules, schemas, metadata, architecture designs, and the like; additionally, all new open source software created by the contractor and forks or branches of current open source software where the contractor has made a modification; and all new tooling, scripting configuration management, infrastructure as code, or any other final changes or edits to successfully deploy or operate the software.

The government requires “Unlimited Data Rights” to all data produced by the contractor in the performance of this TO. DFARS Provisions and Clauses 252.227-7013, 252.227- 7016, 252.227-7017, 252-227-7030, and 252-227-7037 are applicable to performance to orders placed under the Blanket Purchase Agreement.

1.16 Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties shall identify themselves as contractors to avoid creating an impression, they are Government officials. Contractor personnel shall ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The Common Access Card (CAC) used for building entrance, computer access, and other situations will identify the individual as a contractor.

1.17 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, government project manager (PM) and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

These meetings shall be at no additional cost to the Government.

1.18 Contracting Officer Representative (COR): The COR is the primary point of contact for the contractor. The COR shall interface with DFAS Information and Technology (IT) Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656

Follow the link titled “Site Specific Force Protection/Security Services” in the Additional Points of Contact section near the top right side of the Web page.

The COR is responsible for monitoring all technical aspects of the award and assisting in contract administration. COR duties include:

Ensure contractor performs the technical requirements of the award.

Perform inspections necessary in connection with contract performance.

Maintain written and oral communications with the contractor concerning technical aspects of the award.

Monitor contractor’s performance and notifies both the CO and contractor of any deficiencies.

Coordinate availability of Government furnished property and site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.19 Section 508 Compliance:

E201.1 Scope ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.

E208.1 General Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E302 Functional Performance Criteria

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

602.1 General Documentation that supports the use of ICT shall conform to 602.

603.1 General. ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

PART 2

SECURITY REQUIREMENTS

2.0 SECURITY REQUIREMENTS:

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination. Personnel must maintain favorable clearance throughout the duration of the contract. Contractors who provide signed letters of intent from offered resources confirming their ability and intent at start of task order PoP may be rated more favorably.

Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required. IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days)*. A Declaration for Federal Employment (OF-306) should then be submitted to the Contracting Officer Representative (COR), who will submit this form along with a Contractor Request for Investigation (CRI) (DFAS Form 9035) to DFAS Personnel Security as soon as possible, but not less than fifteen (15) calendar days prior to the intended start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security

Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by

DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA

Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations;

paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), COR, and the DFAS Personnel Security Office.

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731.

This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines- U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the COR, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to

(317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that person’s delinquent on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted.

Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel.

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServic es.aspx

Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI

5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/

Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Level I Antiterrorism Awareness Training. All contractor personnel shall take this training.

For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training: Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office.

To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServic es.aspx

The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation.

Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

- Contractor employees required to take the training

- Contractor employees who have completed the training

- Contractor employees who are delinquent

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Government Furnished Equipment: Laptops shall be furnished by DFAS and shipped to the remote working locations of those fulfilling the activity of the contract. All software resident on the computers required to complete the tasks will be made available to the contractor after Desktop Management Initiative (DMI) and Cyber Security Service Contractor (CSSP) approval. Only DFAS Government furnished equipment shall be connected to the DFAS Enterprise Local Area Network (ELAN). The contractor shall be fully responsible for maintaining the inventory, providing physical security, and returning the equipment and materials to the Government in the same condition in which they were received, after completion of the period of performance.

Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI.

For contractor personnel working at alternate locations agreed upon by DFAS and the contractor, access will be provided to the required platforms. The Government shall provide the access network connection, via the Cisco AnyConnect Virtual Private Network for any personnel not working at the DFAS site.

The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of business each workday, Government equipment and materials shall be secured.

3.2 DFAS IT Policy Concerning Contractor Furnished Equipment (CFE).

In accordance with Chapter 3 of DFAS Regulation 8400.1-R, personally owned workstations, laptop computers, software, and printers, including computers connected remotely will not be connected to the DFAS Enterprise Local Area Network (ELAN).

This prohibition is a security requirement to protect the ELAN from the spread of malicious logic (viruses and Trojan Horse programs) and to protect sensitive but unclassified (SBU) information from being compromised.

PART 4

SPECIFIC TASKS

4. SPECIFIC TASKS:

The specific tasks that the contractor shall perform are identified in the Performance Requirement Summary (PRS), which is attached hereto and fully incorporated herein. It sets forth how the contractor’s activities will be monitored and measured. The tasks required are organized into the following system lifecycle categories: Technical Analysis and Design, Software programming, Training and Security activities. Each category of work has specific detailed tasks that set forth the results the contractor must accomplish and the performance measures for each. Specific outcomes and requirements will be identified in tasks listed below.

The contractor is encouraged to overlap the performance of the tasks even though specific timelines are documented, here the timelines and required tasks for each period will be agile.

4.1 Contract Program Management

4.1.1 Weekly Status Reports - The contractor shall provide weekly status reports (by email on Wednesday) to the DFAS COR. This status report shall detail what projects contractor resources are currently working on and any problems or other issues encountered. It shall also include the course of action taken in resolving problems, potential problems anticipated, significant activities, project schedules, and planned upgrades/changes.

4.1.2 Monthly Performance Reports - The contractor shall prepare and deliver to the COR a monthly Status Report describing the current status of ongoing contract activities, problem areas and course of action taken in their resolution, potential problems anticipated, significant activities, DIFS system audit readiness, and work progress, . The contractor shall submit a monthly Status Report to the COR no later than the 10th working day of the month and be available to discuss with the GPOC as necessary.

The Contractor shall maintain and report in accordance with the Government approved Structure Summary Report, the following:

• The status of the ongoing task order

• Relevant information regarding problem areas and course of action taken in their resolution

• Potential problems anticipated

• Significant activities and work progress

• Analyses

• Data for the Computer Software Configuration Item (CSCI)

• Software Change Package (SCP) level as appropriate for the task being addressed

• Status in accordance with the Government-approved WBS.

• Achievements of contractor personnel

4.1.3 Management Reviews - The contractor shall prepare and provide Management

Reviews (MRs) to identify and address progress, problems, and other pertinent information. Contractor offers viable solutions to problems/ issues in a timely manner.

4.1.4 Helpdesk Support - Contractor responds to end-user requests for technical assistance through Tier 1, 2 & 3 tickets in the Helpdesk in a timely manner.

4.2 Technical Analysis and Design (Analysis, prototype, development, devsecops, user guide)

4.2.1 Solution Development - Study current DIFS application architecture and present a recommended architectural approach to deploy DIFS in a Cloud environment within 120 days of the project start date for Government review and potential approval to proceed. The contractor will provide details of the solution architecture within the government furnished target architecture. The reference architecture must show: the underlying Cloud environment, application layer, integration layer, data layer, presentation layer, and how they interface.

4.2.2 Proof of concept - Within 120 of contract start date, Contractor shall develop and present at least one general menu screen (first screens entered by users), at least one inquiry screen (no database updates), at least one update screen (including database updates) for approval to proceed. Prototype shall include documented architecture of modernized target environment. Proposal would include code conversion test plan, and a plan to convert all screens to a web based UI.

4.2.3 Technical Analysis - Within 90 days of contract start date, Contactor shall provide a recommendation for a common, current, and supported technical architecture for a Cloud and web framework supporting the entire DIFS code base. Architectural proposal to be documented on DFAS form Capability Design Document part 2 (required for audit purposes) and reviewed by Government including the Enterprise Architecture group for approval to proceed. Schedule of Conversion: After completion of the above items, the Contractor shall develop and present a reasonable schedule documenting completion dates for the entire DIFS code base for approval to proceed. The contractor’s methodology must articulate the approach to conversion and data migration. They must address how technical shortfalls will be mitigated and their production roll out strategy. Must also address code and data validation. It is expected that existing capabilities will remain the same while functionality will differ given the use of updated code.

The DIFS application must retain the capability to send and receive data via all existing interfaces

4.2.4 DevSecOps Pipeline - Contractor shall provide plans for E2E pipeline for testing of current project and future system maintenance.

4.2.5 User Guide - Contractor shall provide documentation for both end users and front and back end developers

4.3 Software Programming - (Conversion, Unit Test, Peer Review, Data Migration)

4.3.1 Code Programming - Contractor to present updated complete DIFS code base. To include MVP and Minimum Viable Capability Releases. Contractor must migrate code from contractor DEV/TEST environment with location information to government environment.

4.3.2 Unit Testing - Revised/re-architected/replaced the DIFS application code to the agreed-upon modern, secure, and supported common…