ADCAP PWS_RFP Draft 20211008.pdf

A1 DTA/ADCAP PWS

DRAFT PERFORMANCE WORK STATEMENT

FOR

AIR FORCE DIGITAL TRANSFORMATION ACTIVITY

AT

RANDOLPH AFB, SAN ANTONIO, TEXAS

NOTICE TO VENDORS:

THIS DOCUMENT IS A DRAFT PROVIDED FOR INFORMAITONAL PURPOSES AND IS

SUBJECT TO CHANGE.

CHANGE LOG

This record shall be maintained throughout the life of the document. Each published update shall be recorded.

REVISION/MOD RECORD

Revision Mod Date Description of Change

Table of Contents

SECTION 1 DESCRIPTION OF SERVICES

1.1 GENERAL

1.2 BACKGROUND

1.3 BACKGROUND

1.4 SCOPE

SECTION 2 WORK BREAKDOWN STATEMENT

2.1 TASK 1 – PROGRAM MANAGEMENT

2.2 TASK 2 – MANAGED SERVICES

2.2.1 HOSTING SUPPORT

2.2.2 OPERATIONS MANAGEMENT

2.2.3 TECHNICAL OPERATIONS

2.2.4 SECURITY OPERATIONS CENTER

2.2.5 CHANGE MANAGEMENT

2.2.6 SUPPORT TO APPLICATIONS

2.3 TASK 3 – TECHNICAL IMPROVEMENT AND OPTIMIZATION

2.4 TASK 4 – HOSTING

2.5 TASK 5 – SURGE

SECTION 3 DELIVERABLES

SECTION 4 TIMELINES AND STAKEHOLDERS

SECTION 5 GENERAL INFORMATION

SECTION 6 APPENDICIES

APPENDIX 1 – CLOUD PROVISIONS

APPENDIX 2 – DEFINITIONS, ABBREVIATIONS AND ACRONYMS

APPENDIX 3 – QUALITY ASSURANCE AND SURVEILANCE PLAN

APPENDIX 4 – A1 VDC APPLICATIONS LIST

APPENDIX 5 – MAINTENANCE CONTROL PLAN (MCP)

APPENDIX 6 – INCIDENT RESPONSE PLAN

APPENDIX 7 – APPLICATION SERVICES STANDARDS & REFERENCES

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1 GENERAL:

The contractor shall assist the AF/A1 Digital Transformation Activity’s (A1 DTA) and offer full range of services to operate, sustain, and allow for the improvement

(optimization) of the existing A1 cloud environment. The A1 VDC will now be referred to as the A1 Digital Cloud Access Platform, or ADCAP.

1.2 BACKGROUND:

The applications (Listed in Appendix 4) that moved to the ADCAP environment required updates and improvements in operating systems or other software in order to migrate. In an effort to close the Randolph Data center expeditiously, the applications were moved as quickly as possible, with the bare minimum changes required made to the applications. As a result, the applications and the environment itself, while fully functional, are not optimized for efficiency, bandwidth utilization, data storage and movement, enterprise architecture utilization, Cloud Service Provider (CSP) offered tools and capabilities, and external integration with other Air Force systems and contracted CSP cloud spaces.

The contractor’s cloud hosting efforts are focused on providing the infrastructure up to the virtual servers, as well as maintaining and securing the Operating System. Additionally, the contractor will be responsible for providing and using approved applications to maintain and secure the ADCAP. All functional applications and data will remain under the

Government’s control. This effort includes connectivity to the AF Information Network and all security and performance requirements in the Federal Risk and Authorization

Management Program (Fed RAMP) IaaS certification policy. The proposed solution shall be

FedRAMP certified at the IILs identified above at the time of proposal. The solution shall also have a current DoD Provisional Authorization at the time of proposal for the IILs identified above. The ADCAP will include multiple VDCs supporting the IILs identified above. Each VDC will include boundary, security, common services, management, and application services. The vendor shall be responsible for many daily operational tasks that support A1’s VDC in the cloud environment. Additionally, this initiative will provide initial capability for A1 DTA to manage and secure multiple applications in the various IIL environments.

1.3 OBJECTIVES:

The objective of this requirement is to provide a fully functional commercial cloud environment capable of supporting applications in the A1 and A1 DTA portfolios and those applications migrating from the existing A1 DTA data center. This effort is focused on

Infrastructure-as-a- Service (IaaS) cloud capabilities as defined in the DoD Cloud

Computing Security Requirements Guide (CC SRG). This commercial cloud environment shall meet all current and future Department of Defense (DoD) and Air Force (AF) requirements for the following Information Impact Levels (IIL) s as defined in the DoD CC

SRG: IIL 4 and IIL 2. The utilization of the cloud computing services provides A1 an opportunity to accelerate information technology (IT) delivery, efficiency, and innovation as an Enterprise.

There are three primary objectives in this requirement:

1.3.1 Operate and sustain the existing commercial cloud environment with all supporting network, directory services, and other components necessary to supporting applications in the Air Force A1 and the A1 DTA portfolios. There will be a test, development, integration (Pre-Production) and production environments available as required by the systems and applications. The contractor shall support capabilities added by existing applications.

1.3.2 Provide Capacity Optimization, describe services to optimize the use of cloud capacity to support reliable and efficient operations. Include aspects of capacity planning and demand management, not just the optimization of existing capacity.

Conduct research into technology improvements within the existing cloud space, and external to the existing cloud space in order to improve application efficiency, effectiveness, and/or reduce overall operating cost and risk exposure, and implement approved changes.

1.4 SCOPE:

The scope of this contract is for the operation and sustainment of the AF/A1 cloud environment. Specifically:

1.4.1 Operate and maintain the IIL4 FedRAMP compliant IaaS cloud environments for Test and Development (TDE), Pre-production and Production environments to ensure the environments are available, reliable, secure, and integrated into the A1 architecture. Provide operation teams based on service desk volume, quantity of applications, quantity of organizations, quantity and complexity of releases, and quantity of environments and organizations provisioned. Operate and support of the Infrastructure-as-a-Service (IaaS) cloud capabilities as defined in the DoD Cloud Computing Security

Requirements Guide (CC SRG). The cloud environment shall continue to meet all current and future DoD and Air Force (AF) requirements for the following IILs as defined in the DoD CC SRG: IIL 4 and IIL 2.

1.4.2 Make the cloud environment available for up to a 10% increase of additional application migrations to the cloud space. This includes any application that supports or is related to the HAF A1 mission area. These systems are eligible to migrate, with government approval.

1.4.3 Evaluate the ADCAP, propose and implement GOVCLOUD approved technologies and processes in accordance with the procedures in section 2.3 that will improve application system and/or environment performance, and reduce the overall operating cost of the environment. This includes tools and applications in the environment, as well as potential systems or applications external to the environment (to include external applications migrated under section 3.5).

1.4.4 The contractor will be responsible for the integration and sustainment of approved applications (Appendix 4) to monitor, maintain and secure the

ADCAP. The Contractor will provide the connectivity as stated in the

Transition Plan. All applications and data will remain under the Government’s control. This effort includes connectivity to the AF Information Network

(AFIN) and all security and performance requirements in the Federal Risk and

Authorization Management Program (Fed RAMP) IaaS certification policy.

The ADCAP will include multiple virtual spaces supporting the IILs identified above. Each virtual cloud space will include boundary, security, common services, management, and application services.

SECTION II

2.0 WORK BREAKDOWN STRUCTURE

2.1 TASK 1 - Program Management (CLIN 01-FFP)

The contractor shall provide the following program management support services and ensure satisfaction of all PWS tasks, including program management.

2.1.1 The Contractor shall submit a program management plan describing the overall methods used to meet the PWS requirements. This document is an evolutionary document that will be reviewed and updated throughout the lifecycle of this requirement. This will include partnering and subcontracting plans and identifying the tasks that they will be performing. The Plan must be kept current.

Monthly Status Report (MSR): The Contractor shall provide a MSR for all tasks describing all service level metrics required throughout this PWS, status of execution under the contract, any known contract issues or deficiencies, expected information or support required from the Air Force, high level funding status

(where appropriate), and a risk matrix with details on medium/high risks. The

Contractor shall submit an individual MSR for each task to the Program Manager for each associated PWS task. The Contractor shall distribute the MSR for work efforts assigned by the 5th business day of the month.

2.1.2 The MSRs shall include:

2.1.2.1 Risks that may delay the work effort’s completion and proposed solutions.

2.1.2.1.1 Steps to accomplish each work effort, percentage complete status, and the target date for each work effort’s completion.

2.1.2.1.2 Concerns, issues, delays, risks, and proposed resolutions of identified problems or concerns.

2.1.2.1.3 Project activities, Key Personnel, and planned expenditures by task/subtask for the next month.

2.1.2.1.4 All software and license purchases must be approved by PM and COR.

2.1.2.1.5 Personnel changes that impact ability to execute/perform responsibilities.

2.1.2.1.6 Changes to the program management plan and/or the quality control plan.

2.1.2.1.7 For each employee: labor category, functional area, hours worked (denoting on or off site), and cumulative hours worked.

2.1.2.1.8 Problem Notification Reports.

2.1.2.1.9 List of applications/systems/software management status and estimated completion date.

2.1.2.1.10 Issues affecting system accreditation and authorization and software and license management (include description, impact and recommended solution)

2.1.2.1.11 Any changes to requirements with description of issues that impact ability to execute/perform responsibilities as outlined.

2.1.2.1.12 Identify Contractors trained, subject matter, and date trained.

2.1.2.1.13 Required deliverables and the timeframe for their delivery are located in Section 3.0, Table 1 of this PWS.

2.1.3 Schedule: The Contractor shall submit a schedule for major tasks in the PWS.

This shall include all specific instances in the PWS where a specific date or days are identified.

2.1.4 Quality Control Plan: The Contractor shall submit a quality control plan detailing how the Contractor will ensure quality products and services are provided to the Government. The plan shall be provided 30 days after task order award. This document is an evolutionary document that will be reviewed and updated throughout the lifecycle of this requirement.

2.1.5 Meetings: The Contractor shall provide meeting support and shall accomplish the following:

2.1.5.1 Participate in status meetings, to review current and planned activities for the major task areas.

2.1.5.2 Prepare an “Activity Report Brief” at least one business day prior to the

Status Meeting that details the results and planned actions for the

Contractor’s team supporting the tasks. Typical topics may include status, stoplight charts, and planned acquisitions and changes/updates to the program management plan. The information in this report shall be considered the foundation for the monthly status reports.

2.1.5.3 Conduct and/or attend monthly program reviews to present status of tasks.

2.1.5.4 Conduct and/or attend initial Assessment and Authorization (A&A) and

Government requested software management task kick-off meetings and weekly meetings thereafter to present ongoing project status until each project is completed (Applicable to the A&A Task).

2.1.1 Required deliverables and the timeframe for their delivery are located in Section

3.0, Table 1 of this PWS.

2.2 TASK 2 – Managed Services (CLIN 01-FFP)

The contractor’s cloud hosting efforts are focused on providing the infrastructure up to the virtual servers, as well as maintaining and securing the Operating System. Additionally, the contractor will be responsible for providing and using approved applications to maintain and secure the ADCAP. All functional applications and data will remain under the

Government’s control. This effort includes connectivity to the AF Information Network and all security and performance requirements in the Federal Risk and Authorization

Management Program (Fed RAMP) IaaS certification policy. The proposed solution shall be

FedRAMP certified at the IILs identified above at the time of proposal. The solution shall also have a current DoD Provisional Authorization at the time of proposal for the IILs identified above. The ADCAP will include multiple VDCs supporting the IILs identified above. Each VDC will include boundary, security, common services, management, and application services. The vendor shall be responsible for many daily operational tasks that support A1’s VDC in the cloud environment. Additionally, this initiative will provide initial capability for A1 DTA to manage and secure multiple applications in the various IIL environments.

The Managed Services task covers services the government requires to operate and sustain the ADCAP. It includes operations management, technical operations, change management and application support. The contractor shall be responsible for the operations and sustainment of the ADCAP environment, infrastructure, services, network connections, and enterprise data architecture contained in the cloud. To effectively manage the operations of the government cloud, the contractor will be responsible for the following:

2.2.1 Operations Management:

2.2.2.1 Integrate with DevOps processes. This includes code promotion and other interrelated activities between the Test and Development

Integration and Test (Preproduction), and Production environments.

Ensure separation policies/processes are adhered to IAW DoD and AF mandates/directives. A1 DTA personnel assigned to the SOC, Functional

Systems Administrators, and those approved by the Cloud Management

Office shall be granted privileged user access to production servers.

2.2.2.2 The contractor shall ensure all managed services and associated solutions achieve 99.5% uptime and that solutions scale in real-time to accommodate all IIL4 and IIL2 applications migrated to the cloud with no more than two second latency within the cloud environment.

2.2.2.2.1 Identify, compile, track and recommend all software and licenses necessary for the operation of the environment.

When approved by the government, procure, configure and manage commercial software and software licenses deployed in the ADCAP environment. The contractor shall be capable of generating automated reports for relevant Commercial off-the-shelf (COTS) software license availability and usage to ensure compliance with SL agreements. The contractor shall notify the A1 DTA software license manager when licenses are three months from expiration or usage agreements are being violated. A Software License

Management Plan must be kept current. Plan must be submitted for approval as described in deliverable schedule in section 4.

2.2.2.2.2 Configure and maintain dashboards and other automated reporting tools native to the environment for all levels of the

A1 DTA organization, system owners, and external agencies as needed. Reports shall include all operational parameters of the environment and the hosted applications. Reporting tools shall be customized when requested by the government

Program Manager or the COR. Access to the dashboards will be restricted by group policy and approved by the A1

DTA for only those required to have access.

2.2.2.2.3 Establish a cadence with operations team to hold regular status meetings with the operations support team to quickly discuss any outages or degradations, results of troubleshooting efforts and daily activities to correct them, and present other activities that are ongoing in the operations and sustainment division.

2.2.2.2.4 Represent the Operations and Support Team at the A1

Service Desk daily calls to provide amplifying or additional information to enhance reporting and troubleshooting.

2.2.2.2.5 The contractor shall participate in the A1 DTA Maintenance

Control Plan (MCP) change management process.

2.2.2.2.6 The contractor shall submit a monthly cloud Usage Report, with detail that shows the overall environment and application usage by data and by user.

2.2.2.2.7 Contractor will allow government personnel and contractors approved by COR access to the AWS management console.

2.2.3 Technical Operations: The contractor shall be required to perform duties necessary to operate and sustain an AWS IIL2 and IIL4. In addition, the contractor shall be responsible for the following:

2.2.3.1 Operating, modifying or otherwise changing the environment as necessary to support operations in the environment and the application requirements.

2.2.3.1.1 Collaborating with the hosted applications to improve business processes, correct outages, improve degradations, and analyze change requests for validity.

2.2.3.1.2 Addressing all operational aspects of the DISN network with respect to cloud connectivity, to include troubleshooting and optimizing the cloud network infrastructure, DISA CAP/IAP connections, and other components of the DISN.

2.2.3.1.3 The contractor shall configure to discover and optimize availability and performance metrics to include the ability to identify usage by application.

2.2.3.1.4 Configure and manage a copy of AFNet Active Directory services. Maintain core infrastructure applications. This task includes monitoring, maintenance, backup and restore, configuration management, patching and security assessments. The contractor shall provide A1 DTA Cloud

Management Office and A1 DTA Security Operations

Center (SOC) access to infrastructure applications, management, and monitoring tools as requested.

2.2.3.1.5 Configure and manage the anti-virus (AV) solution capable of protecting the ADCAP against malware. The contractor shall ensure that the specified AV software is installed, up-to-date, and active, and is running current malware signatures. When malware is detected, the contractor shall ensure that the software proactively ensures quarantine and automatically creates an incident ticket for the remediation of the issue. The contractor shall ensure that audits are performed to ensure individual servers are running AV without issue. HBSS is the current Government solution and integrates with other AFNet services so HBSS shall be used.

2.2.3.1.6 Configure and manage a software version tracking and update system for ensuring all software has all of the IAVA, patches and other releases that keep the software up to date.

All IAVA, patches and software revisions will be tested in preproduction with all applications prior to deployment in production. For applications that have an organic capability to patch their own software and systems, the contractor shall work with the application to give the application the most latitude possible to maintain their own software, and execute an oversight and reporting role for those applications.

2.2.3.1.7 Configure and manage the backup and restore system, configuration, environment, and cloud services. The backups shall be created and stored in the ADCAP and data storage costs associated with backups are part of the customer cloud environment operating costs.

2.2.3.1.8 Configure and manage the Domain Name Servers (DNS) for the AWS environments. This includes both cloud-provided

IIL 2, and as provided by the Air Force Directory Services office for IIL 4.

2.2.3.1.9 Provide Active-Active (AA) disaster recovery architecture and processes to meet 99.5% application availability to users. The contractor shall provide full planning, annual testing and execution of a managed disaster recovery solution encompassing applications, systems, and environments.

2.2.3.1.10 Configure and manage the application generated email for the test and development environment. The application generated email shall only be used to test applications and shall not be connected to the AFNet, the DOD or other production email systems. The contractor shall provide

Simple Mail Transfer Protocol (SMTP) Gateway administration support. Provide operational support for encryption key management and rotation, encryption of volumes and data, and implementation and management of service encryption certificates.

2.2.3.1.11 Provide technical support to application and/or functional system administrators, loading applications on pre-configured servers in the Test, Preproduction and Production environments.

2.2.3.1.12 Support the configuration and management of the identity and access management solution for all users of the environment and applications residing in it. This shall include a Security Assertion Markup Language (SAML) token capability that can integrate with AFNet Active

Directory to produce a token for management console access. This shall include supporting approximately one million~ users (i.e. retirees, family members, etc.) that are not in the AFNet directory. The current application performing this function is Okta.

2.2.3.1.13 Configure and manage the Network Time System as

provided by AFNet.

2.2.3.1.14 Configure and manage an Online Certificate Status Protocol

(OCSP) and Certificate Revocation List.

2.2.3.1.15 Configure and manage the production, pre-production, test and development infrastructure and virtual desktop environment for users to access the TDE. The virtual desktops shall be accessible in the DMZ for external access.

2.2.3.1.16 Maintain external-facing firewall, IPS, IDS and other components of a next-generation firewall. The contractor shall ensure separation and monitoring of inbound/outbound

ADCAP traffic.

2.2.3.1.17 Conduct all OS level and Database level patching.

2.2.3.2 Troubleshooting Availability

2.2.3.2.1 The government will provide to the contractor a list of all applications with POCs within the environment, along with which applications are critical. The contractor shall provide identification and response to application outages, analysis, corrective action, and root cause analysis.

2.2.3.2.2 Hours of operations for non-critical application trouble shooting, 0700-1800CST.

2.2.3.2.3 Critical application support trouble shooting can be required afterhours based on the following: one-hour response time after normal hours of operations, 30 minutes response time during normal hours of operations. Non-critical after hour support will only be approved by the COR/ACOR, or CMO

Division Chief.

2.2.3.2.4 Participate in A1 DTA Maintenance Control Plan (MCP) problem management process. All outages and degradations reported to the contractor shall be tracked in the approved government system for service calls, which is currently a

ServiceNow instance Called the Talent Management

Information System, or TMIS.

2.2.4 Security Operations Center (SOC) Support:

2.2.4.1 The contractor shall ensure all levels of data, information, analysis, and technical support are provided and available to the A1 DTA SOC.

2.2.4.1.1 Status reports of ITSM-related SLAs. These SLAs include specific SLAs included in Cloud Service Provider (CSP) provider's contract. These monthly SLA reports are designed to ensure service transparency by providing quality metrics that serve as the baseline for an ITSM Continuous Process

Improvement methodology.

2.2.4.1.2 The contractor shall provide the A1 DTA SOC and CMO access and visibility into all configuration management and change management tools used to manage and secure the

ADCAP applications and data.

2.2.5 Change Management: It is expected that all applications hosted in the ADCAP will change and grow over time. The contractor shall participate, utilize, and abide by the government approved Change Management Process currently in place to document and gain approval for changes made to the ADCAP in support of applications, functions, or capabilities hosted in the environment. The contractor shall support the government in moving change requests through the process to approval and implement approved changes. (Change Management

Process is reference in Appendix 5.)

2.2.6 Support to Applications: Support to A1 DTA incident management process by providing response to the application when the application requests a modification to their environment that is beyond the elastic capabilities of the environment or the application. For any requested support effort, the contractor shall provide the following:

2.2.6.1 24-hour response to acknowledge requests to the originator in the A1 DTA Talent Management Information System

(TMIS). If the application is critical, or the requirement is deemed an emergency by the government, the response time will be 8 hours.

2.2.6.2 24 hours to set up meeting (Not to exceed 3 business days for an initial meeting unless application requests a longer period of time) to get all requested information about application and the information for the requested support.

2.3 TASK 3 -Tech Improvement (CLIN 01-FFP)

The ADCAP cloud environment is fully operational and supports the A1 mission area for all applications in the environment. Current capabilities and functionality contained in the ADCAP were not optimized for operational, functional or financial efficiency.

2.3.1 The contractor shall provide the following services and capabilities with respect to the environment and technology:

2.3.1.1 The contractor shall review all software applications and tools that exist within the ADCAP environment, and make assessments as to which tools would benefit the applications in the environment, or the environment itself. The minimum list of tools that should be considered are found at https://aws.amazon.com/compliance/services-in-scope/, under the

Government Cloud IL4 tab. The tools should be reviewed on a recurring basis as the A1 DTA space continues to grow, as applicability may change over time.

2.3.1.2 The contractor shall review the same list above for software applications and tools that are not list in the IIL4 column, to see if any of them are under review for future inclusion in the IIL4 environment. The tools under review for future IIL4 inclusion should be reviewed on a recurring basis as the A1 DTA space continues to grow.

2.3.1.3 The contractor shall review other Cloud Service Provider offerings and software to evaluate them for applicability in the ADCAP environment, and make an assessment and recommendation for inclusion in the

ADCAP operations portfolio. The evaluation should consider customer interface/customer experience, operational impacts, all costs, and functionality of the evaluated capability related to the other applications in the HAF A1 portfolio.

2.3.1.4 All recommendations for changes, modifications, and/or improvements to the ADCAP platform should be made in a manner that will reduce risk for platform migration.

2.3.1.5 For any tool, application, or software internal to the A1 DTA environment that is recommended by the contractor and approved by the government, the contractor shall implement the tool, application or software in the manner recommended.

2.3.1.6 For any tool, application, software, or Cloud Service Provider capability https://aws.amazon.com/compliance/services-in-scope/ external to the ADCAP environment that is recommended by the contractor for improvement to the ADCAP, the contractor shall also include a cost estimate for implementation of the recommendation. If the government approves of the recommendation and funds the recommendation, the contractor shall implement the tool, application, software or Cloud Service Provider capability in the manner recommended.

2.4 TASK 4 – Hosting (CLIN 02-ODC)

The contractor shall provide the following cloud services in support of the A1 DTA’s mission:

2.2.1 Hosting Support

2.2.1.1 Provide technical and database administration support to improve, modernize, operate and support all AF/A1 Network Enterprise systems.

Support, maintain, modernize and enhance the software environment supporting the AF/A1 network enterprise. This includes: managing application software installations, configuration, and upgrades;

establishing software test environments; and integrating software problem reporting procedures, plans and tools installation/integration.

Research, analyze, test, document system issues and keep tactics, techniques, and procedures (TTPs) current.

2.2.1.2 Manage the allocation of virtual resources within the environment to ensure the most efficient and economical utilization of resources occurs.

2.2.1.3 Schedule Requirements and Support for the entire IL 4 ADCAP and complete all internal and testing in conjunction with the government

POC and the government-preferred solution. Provide ATO related documentation for the ADCAP IL4 to the AF/A1 Cloud Management

Office (CMO).

2.2.1.4 Provide modernization support to AF/A1 AF Internet Connectivity

(AFIN) to identify and resolve any connectivity, latency, and/or bandwidth issues related to AFIN connectivity to the cloud environment, improve and transform wherever possible.

2.2.1.5 The contractor shall provide supporting tools and capabilities, using cloud industry standards, such as the cloud Marketplace tools/services/capabilities to operate, maintain and secure the ADCAP.

The contractor shall avoid the use proprietary tools.

A1 DTA, Air Force Personnel Center (AFPC), and Air Force Life Cycle Management

Center (AFLCMC/HIH – Human Resource Division) personnel will have access to the

ADCAP and all assets included in the various VDCs. The contractor is responsible for providing A1 DTA, AFPC, and AFLCMC personnel access to the cloud system management console to create and manage virtual resources, as approved by the CMO. This requirement will also support other customers outside A1 DTA and AFLCMC/HIH that currently reside in the A1 DTA data center or as required to support of the AF mission.

2.4.1 Provide dedicated Test and Development (TDE), Pre-production and Production environments within the cloud environment, and host services in the effort to support application upgrades and improvements. Performance will be focused on

Infrastructure-as-a-Service (IaaS) cloud capabilities as defined in the DoD Cloud

Computing Security Requirements Guide (CC SRG).

SECTION III

3.0 DELIVERABLES

Table 1: Deliverables & Schedule

Required

Deliverable/

Report

FORMAT

Required Due

Date

SEND

TO

PLANNED

FREQUENCY

PWS

Ref.

Performance

Threshold

Monthly Status

Report

Submit

Word, PDF or Excel via

ITSS

Due on the 15th of each month

COR/

CO

Monthly 3.1.7

100%

Timely/Accurate

Delivery and provides required service level metrics

Program

Management

Plan

Submit

Word, PDF or Excel via

ITSS

Draft with proposal and final

60 calendar days after contract award

COR/

CO

Quarterly 3.1.2 100%

Timely/Accurate

Delivery

Software License

Management

Plan

Submit

Word, PDF or Excel via

ITSS

Draft with proposal and final

60 calendar days after contract award

COR/

CO

Updates as required

3.2.1.2.1 100%

Timely/Accurate

Delivery

Usage Reports Submit

Word, PDF or Excel via

ITSS

Due on the 15 th of each month

COR/C

O

Monthly 3.2.1.2.6 100% Timely/Accurate

Delivery and provides required usage metrics

Program

Schedule

Submit

Word, PDF or Excel via

ITSS

Draft with proposal and final

60 calendar days after contract award

COR/

CO

Updates as required

3.1.3 100%

Timely/Accurate

Delivery

Quality Control

Plan

Submit

Word, PDF or Excel via

ITSS

Draft with proposal and final

30 calendar days after contract award

COR/

CO

Updates as required

3.3 100%

Delivery

Cost Report Submit

Word, PDF or Excel via

ITSS

Due 30 calendar days after contract award or

Exercising Option.

COR/

CO

Monthly 3.2.1.7 100%

Compliance/On- time delivery and provides at least 2 layers of cost dissection

TMIS Requests Submit via

TMIS

24 hour response to the request of the originator.

COR/

CO

As required 3.5.2.1 100%

Compliance/On- time delivery

ATO Artifacts Submit

Word, PDF or Excel via

ITSS

Due as required in eMASS

COR/

CO

As required when contractor updates relevant info

3.2.1.8.4 100%

Timely/Accurate

Delivery and describes all relevant security controls

Log Reports Submit

Word, PDF or Excel via ITSS

Due within 60 minutes of discovery and analysis

COR/

CO

Upon discovery of incidents or events

3.3.1.19 100% Timely/Accurate

Delivery and provides required data and recommendations

Performance

/Utilization

Dashboard

Dashboard

Display

Available within

30 days of contract

COR/

CO

As requested by COR

3.3.1.21 100% Timely/Accurate

Display

SLA Reports Submit

Word, PDF or Excel via ITSS

Due on the 15 th of each month

COR/

CO

Monthly 3.3.1.25 100% Timely/Accurate

Delivery

Scan Reports Submit

Word, PDF or Excel via ITSS

Daily COR/

CO

Daily 3.3.1.30 100%

Penetration

Testing

Submit

Word, PDF or Excel via ITSS

Within 120 days of the contract award

COR/

CO

Annually 3.3.2.4 100% Timely/Accurate

Delivery

Cloud

Suitability

Analysis

Submit

Word, PDF or Excel via ITSS

1st due 60 calendar days after contract award

COR/

CO

As required upon execution of task

3.3.9 100%

Timely/Accurate

Delivery and addresses all applicable systems

Detailed cost schedule

ADCAP

app migration analysis

Submit

Word, PDF, Excel via ITSS

60 days after

Formal Request

COR

PM &

App Owner

Any application approved to migrate to the

ADCAP

100%

3.1. Delivery Instructions

Copies of deliverables shall be furnished to the appropriate

Government personnel. The contractor must submit their required deliverables/reports as part of this Task Order through approved contract management system.

3.2. Inspection and Acceptance of Services

All deliverables shall be inspected, tested (where applicable), reviewed, and accepted by the Government within a reasonable period of time in accordance with FAR 52.212- 4 and the acceptance criteria are set forth in Table 1, Section 3.0 in the section titled “Performance

Threshold” column. Further inspection and acceptance details are outlined in the QASP (Appendix 4).

3.3. Contractor Quality Control Requirements

The task order is for performance based commercial cloud services. The contractor shall develop and maintain a quality process to ensure services are performed IAW commonly accepted commercial practices and existing quality control systems throughout the life of the order.

3.3.1 The contractor shall develop and implement procedures to identify, prevent and ensure non- recurrence of defective services. However, the government reserves the right to perform inspections on services provided to the extent deemed necessary to protect the government’s interests.

The contractor must control the quality of the services and deliverables provided in support of this task; the contractor must maintain substantiating evidence that services conform to contract quality requirements and furnish such information to the government if requested.

3.3.2 The contractor shall establish and maintain a complete

Quality Control Plan (QCP) to ensure the services are performed in accordance with PWS and commonly accepted commercial practices, throughout the life of the task order. The QCP shall include a Quality Control Matrix

(QCM) that addresses all deliverables in Table 1, of Section

3.0. The QCM shall reflect the method by which the

contractor will meet the level of required performance and quality reflected in Table 1 of Section 3.0.

SECTION IV

4.0 TIMELINES & STAKEHOLDERS

4.1 Timeline: All deliverables must be complete/finalized within 45 days of the end of the

Period of Performance. Delivery dates for recurring deliverables are established in the deliverable table. Any delay in the recurring deliverables must be communicated in writing to the government a minimum of five working days before the due date. For non-recurring deliverables the contractor must communicate any deliverable delays a minimum of ten working days before the due date.

4.1.1 Throughout the execution period of this contract, the contractor and the government will plan for and agree to delivery dates for certain products and services. The contractor shall inform the government of any delays in these deliverables as soon as the possibility of a delay is realized.

4.1.2 The A1 DTA has several organizational divisions that deliver software or other capability using an Agile method. There will be times where establishing a specific date for a deliverable will be challenging due to the nature of releases from these divisions. In these instances the contractor shall work with the A1 DTA Release Management team to ascertain what capabilities are on what releases, and make delivery estimates based on the government’s release schedule. Where Agile releases affect contract deliverables on this contract, the contractor shall communicate any delays in schedule on this contract as soon as it is realized there will be a delay.

4.1.3 The contract performance will be reviewed at a minimum annually. The review will include all deliverables in the past 12 months, and the planned activity and deliverables in the next 12 months.

4.2 Stakeholders (Collaborating Offices): Stakeholders for this effort will include:

4.2.1 Headquarters Air Force (HAF) A1/A1X – Develops the overarching requirements for and executes oversight of the ADCAP. Plans for and funds the continued operation of the A1 DTA.

4.2.2 Headquarters Air Force (HAF) A1/A1D – Own, operate and maintain the

MyVector Platform and associated software hosted in the ADCAP

4.2.3 Headquarters Air Force (HAF) A1/A1XD – Provide requirements for, direction, and oversight of the Enterprise data architecture and data governance, to include data architectures, applications, and software in the

ADCAP.

4.2.4 Headquarters Air Force (HAF) A1/A1XI

4.2.5 Headquarters Air Force (HAF) A1/A1XM – Data Transformation and

Analytics, user of the ADCAP Talent Management Digital Environment

(TMDE) data orchestration and analytics applications.

4.2.6 Air Force Personnel Center (AFPC) – Develops operational and business requirements for applications and data hosted in the Government Cloud for active duty Air Force personnel.

4.2.7 Air Force Reserve Center (AFRC) – Develops operational and business requirements for applications and data hosted in the Government Cloud for

Reserve Air Force personnel and the Air National Guard.

4.2.8 Air Force Life Cycle Management Center (AFLCMC) HIH – Own, operate and maintain applications and software hosted in the ADCAP.

4.2.9 Air Education and Training Center (AETC) – Own, operate and maintain applications and software hosted in the ADCAP.

SECTION V

5.0 GENERAL INFORMATION

5.1 Travel Requirements: Contractor employees will be required to travel for the purpose of semiannual meetings, information sharing, and to conduct cloud suitability analysis.

Travel shall be a cost reimbursable expense, and no G&A or other administrative fees shall be allowed on travel. The Government will pay up to the rates specified in the

Government Federal Travel Regulations (FTR) for travel destination.

5.1.1 Trip Reports: For all travel required under the terms of this PWS, the contractor shall submit Trip Reports when submitting monthly invoices after completion of a trip for all long distance travel and for local travel when requested by Government Task Lead. Trip reports shall be uploaded into

ITSS once a month when invoices are uploaded. The Trip Report shall include the following information:

5.1.1.1 Personnel traveled

5.1.1.2 Dates of travel

5.1.1.3 Destination(s)

5.1.1.4 Purpose of Trip; contract effort supported and Task Order ID number

5.1.1.5 Government Agency supported (if applicable), explain the benefits of the travel to the Government.

5.1.1.6 Actual Trip Costs

5.1.1.7 Approval Authority

5.1.1.7 Summary of events

5.1.2 Approval for Travel: All travel shall be scheduled at least two weeks in advance whenever possible to maximize savings to the Government through receiving the best travel rates available. Emergency requirements shall be defined and approved by the COR. All travel shall be in accordance with the

Federal Travel Regulation (FTR) and shall be at or below per diem unless approved via CTP.

5.1.2.1 The contractor is required to ensure good stewardship of travel funds, and shall seek rates lower than per diem whenever possible. The contractor shall make every effort to locate the airport that will provide the lowest cost of air travel possible.

5.1.2.2 The COR may require a cost benefit analysis to support any travel, as deemed necessary. Travel shall be at the allowable per diem rate.

Travel charges over and above per diem without proper approval, shall be at the expense of the contractor. After travel is incurred, documentation/receipts shall be sent to the COR (with the invoice submittals). NO PAYMENT WILL BE MADE WITHOUT

DOCUMENTATION and RECEIPTS.

5.1.2.3 The COR shall approve travel valued below $3,500.00 per trip. The

CO shall approve all travel expenses in excess of $3,500.00. NOTE:

The Government reserves the right to audit, thus; the contractor shall keep on file all backup support documentation for travel, materials, and ODC procurements (travel) made on behalf of the Government under the terms of the contract.

5.2 Materials/Hardware/ODCs and Ancillary Supplies and/or Services (CLIN): The

Contractor may be required to provide materials/software/ODCs or ancillary supplies and/or services for the purpose of cloud hosting. This could include software licensing and tools required to operate in the cloud environment. The total estimated material/hardware costs are estimated at the levels described Appendix D-Pricing

Spreadsheet. NOTE: This information is provided for estimating purposes only. Other

Direct Costs (ODCs) are categories of charges for commercial items utilized in direct support of the task order. To the extent possible, all anticipated ODCs associated with performance and within the scope of the NASA SEWP V contract should be offered, and have an established contract price. ODCs must not be the primary purpose of the task order.

5.3 Support Items: Support Items are categories of charges utilized by the Contractor in the performance of the task order service. Support items are ancillary in nature and integrally related to the contractor’s ability to perform the service being acquired, i.e., they must be necessary for the completion of the task. The support item must satisfy the criteria expressed within the scope of the contract/task order. Support items must not duplicate cost covered in other areas of the contract. Incidental - Open Market items must be necessary and integral with the overall service being performed in the task order.

5.4 Additional Considerations:

5.4.1 Performance Specifics:

5.4.1.1 Performance Location: Work will be performed on the Government site and at the contractor site. The Government site is located at:

550 C Street West, JBSA-Randolph AFB, TX 78150, Randolph AFB, TX. Contractor personnel will not report to Government facilities to work nor remain at the work locations any time the Government is unexpectedly required to close their offices. Due to COVID-19, a blended in office and teleworking approach may be utilized.

The contractor will not be compensated for these unexpected or expected Government closures. The contractor is responsible for all notification of their contractor staff during times of closure.

5.4.2 Performance Time & Days: The Government site is open during normal business hours, Monday through Friday (0700-1800) and as needed on weekends, except Federal holidays. The dates/times the contractor personnel work to support the objectives of this requirement are at the contractor’s sole discretion however onsite work at the Government facility must fall within above business hours. This order is performance based, and all tasks must be completed timely and at the level of quality identified herein.

5.4.3 Observed Federal Holidays: The following Federal holidays are observed by the Government and affect the contractor’s ability to access Government’s facilities or Government personnel:

New Year’s Day: January 1st

Martin Luther King’s Birthday: 3rd Monday in January

President’s Day: 3rd Monday in February

Memorial Day: Last Monday in May

Juneteenth: June 19th

Independence Day: July 4th

Labor Day: 1st Monday in September

Columbus Day: 2nd Monday in October

Veterans Day: November 11th

Thanksgiving Day: 4th Thursday in November

Christmas: December 25th (and possibly the day after or before, depending on an executive order)

NOTE: If personnel have to obtain a background check prior to being able to perform under the terms of the order, the contractor is not permitted to perform services until the contractor’s personnel are fully able to perform the requirements of the PWS.

5.5 Government Property: The Government will provide either access to the A1 DTA facility for seating up to 10 or provide laptops with AF VPN access to the network. This

GFE is limited to the IIL 4 requirements and should be kept to the minimum required.

CAC readers can be provided for remote access to AF systems on contractor property.

5.8.1 Contractor Acquired Government Furnished Property: No Contractor acquired Government property is foreseen under this contract.

5.6 Personnel Cybersecurity Workforce Certification

As stated in AFMAN 17-1303, Cybersecurity Workforce Improvement Program, Paragraph 1.4, Contractor personnel performing cybersecurity activities are required to have at the time of reporting for duty and maintain a DoD approved cybersecurity baseline certification(s) as outlined in DoD 8570.01-M, Information Assurance

Workforce Improvement Program, Paragraph C1.4.4.7 (T-0).

5.7 Special Terms and Conditions/Requirements: Contractor Employee Guidelines: The contractor shall not employ persons on this task order if such employees are identified to the contractor by the client representative as a potential threat to the health, safety, security, general well-being, or operational mission of the installation and its population.

5.8 508 Compliance: The Industry Partner shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C.

794d) requires that when Federal agencies develop, procure, maintain, or use electronic information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

5.8.1 Applicable standards are 1194.21-1194-26. The Industry Partner should review the following websites for additional 508 information:

http://www.section508.gov/index.cfm?FuseAction=Content&ID=12 http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

5.9 Post Award Orientation Conference: The contractor shall participate in a post-award conference for the purposes of making introductions, coordinating security requirements, discussing schedules, prioritizing PWS requirements, and providing details regarding the transition of work requirements from the incumbent contractor.

The contractor shall commence work on the first day of the period of performance.

The Post Award Orientation Conference shall occur at Randolph AFB, TX, 14 days after award. Attendance by the contractor shall be at no additional (direct) cost to the http://www.section508.gov/index.cfm?FuseAction=Content&amp%3BID=12 http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

Government.

5.10 Transition Plan (Phase In and Out of Task Order): The contractor shall comply with their submitted awarded/approved transition plan that outlines the designated time period and strategy to transition into the duties as the contractor and to transition out of the task order at the end of the period of performance.

Note: The transition period shall not exceed 90 days.

5.11 Personal Services: The client has determined that use of the XXXX to satisfy this requirement is in the best interest of the government, economic and other factors considered, and this task order is not being used to procure personal services prohibited by the Federal Acquisition Regulation (FAR) Part 37.104 titled “Personal services contract”. To counter the circumstances that infer personal services and to preserve the non-personal nature of the contract, the contractor shall adhere to the following guidelines in the performance of the task:

5.11.1 Contractor provides for direct supervision of all contract employees assigned to the task.

5.11.2 Refrain from discussing the issues such as skill levels and hours, salaries, cost and funding data, or administrative and personnel matters affecting contractor employees with the client.

5.11.3 Ensure close communication/coordination with the Contract PM, reporting problems to the PM as they occur (not waiting for a monthly meeting).

5.11.4 Do not permit government officials to interview potential contractor employees, discuss individual performance, approve leave or work scheduling of contractor employees, terminate contractor employees, assist contractor employees in doing their jobs or obtain assistance from the contractor in doing Government job.

5.11.5 Do not assign contractor personnel to work under direct government supervision.

5.11.6 Maintain a professional distance from government employees.

5.11.7 Provide contractor employees with badges, if appropriate, identifying them as contractors.

5.11.8 Ensure proper communications with the government (technical discussion and government surveillance is okay, but the Government cannot tell the contractor how to do the job).

5.11.9 Assign a task leader to the task order. The task leader or alternate should be the only one who…