ADP MATOC - PERFORMANCE WORK STATEMENT - Draft.pdf

Army Data Platform IDIQ PWS

PERFORMANCE WORK STATEMENT (PWS) 1

Army Data Platform 2

PART 1 - BACKGROUND 4

1. General: This Multiple Award Task Order Contract (MATOC) Indefinite Delivery,5 Indefinite Quantity (IDIQ) for Army Data Platform (ADP) is designed to provide a vehicle 6 to award Task Orders (TOs) in a streamlined manner in support of United States Army 7 data requirements. 8

1.1. Description of Services/Introduction: The ADP ecosystem utilizes a multi-9 platform strategy that provides users with a task order method to provide scalable and 10 integrated data platforms, tools, and professional services. The purpose of this MATOC 11 is to establish a follow-on capability to the current Under Secretary of the Army directed 12 Army Vantage program, providing Enterprise level data platform capabilities and 13 associated platform support services. Professional services to implement data 14 management and analytics tasks on the vendor-provided platforms is not in scope of 15 this MATOC. 16

ADP directly supports five of the six components of the Business Enterprise 17 Architecture Data to Decision business process and is the platform component of what 18 the Army is beginning to call a “Data Mesh.” It is a core component of the Army’s efforts 19 to become a Data Centric force and supports the implementation of the Army Digital 20 Transformation Strategy’s goal of using data as a strategic asset. The requirement 21 focuses on enterprise level functions; it spans support across the Business Mission 22 Area (BMA) and Warfighting Mission Area (WMA) at the operational level of war and 23 above (i.e., division and higher). Many specifications identify the technical requirements 24 of a data platform such as data ingest and transformation, and the critical aspect of this 25 requirement is ease of use for data analysts to generate new data products for the 26 Army. 27

1.2. Background: As part of Army modernization, the Army needs to increase the 28 speed and quality of decision at echelon. The right data at the right time is a key enabler 29 for improving decisions. As per the 2018 Under Secretary of the Army (USA) signed and 30 Chief of Staff of the Army (CSA) Directed Needs Statement, the Army requires a data 31 platform to facilitate this goal. Ease of use at echelon is critical to enable citizen analysts 32 and the data democracy to meet the scale and speed necessary for relevance of our 33 today and future Army. The Army’s current program that provides this capability is Army 34 Vantage, previously titled the Army Leader Dashboard. Army Data Platform 2.0 replaces 35 this initial capability, refining its scope based on lessons learned from three years of use 36 and maturity of the Army’s data community. 37

The Army Data Platform is part of a larger data ecosystem or Data Mesh. The Data 38 Mesh follows four main principles: Data Ownership by domain; Data as a Product; Data 39 available everywhere, Self-Serve; and Federated Governance. The goal is to provide 40 the right data to the right echelon at the right time. Data will be simplified, authoritative, 41 and fit the decision required. The data is independent of any source system—it is 42 integrated as a ‘product’ ready for a Soldier or civilian to use the VAULTIS criteria43 (Visible, Accessible, Understandable, Linked, Trusted, Interoperable, and Secure). 44

This MATOC allows the Army to create a multi-platform collaborative ecosystem 45 utilizing capabilities across a range of industry vendors. The intent is to foster 46 collaboration and innovation among large vendors, smaller vendors, professional 47 services, and specialized data tools. As technology and Army needs change, the Army 48 needs access to a changing suite of capabilities provided as a service. Over time, the 49 vendor base for platforms, tools, and/or services needs to evolve. 50

The Government will use a task order process to: 1) develop, implement, and operate 51 data platforms, 2) assist with creating, managing, and implementing data products, 3) 52 help control overall costs for the platform and delivery services. 53

1.3. MATOC Objectives: 54

1.3.1. Qualify and select vendors able to deliver platform and provide platform support 55 services. 56

1.3.2. Establish an ecosystem of enterprise data platforms from multiple vendors and 57 service providers that support Army data requirements. 58

1.3.3. Maximize competition at the task order level by releasing request for task and 59 delivery orders. 60

1.3.4. Provide to the Army an expedited ordering process for new, emergent platforms 61 that integrate seamlessly into the Army’s ecosystem of enterprise data platforms. 62

1.3.5. Satisfy data product and data consumption requirements for the following types of 63 users: 64

• Decision Makers65

• Data Analysts/Product Generators66

• Platform Enablers67

2. PART 2 – Platform Objectives 69

2.1. Overview: The ADP program will provide the Army Enterprise solution for current 71 and future data platforms. This contract will be utilized for the issuance of TOs for ADP. 72 ADP MATOC IDIQ requirements will include platform delivery and support as required to 73 maintain visibility into the vast amount of data contained in numerous databases 74 dispersed across the Army Enterprise. These platforms will enable self-service data 75 domains and data product owners to create, manage, use, and publish data products. 76

As a component of the Data Mesh, the data platforms provide enterprise compute and 77 store to build, run, and monitor data products. They are the engine for producing data 78 products to meet mission, giving users the ability to create and use conforming data 79 products without needing detailed understanding of the federated mesh governance 80 policies. The data platforms are uniquely suited, as they provide the workspace for 81 working with Army decision makers at echelon to determine what data is needed for 82 decision. They extract, transform, enrich, and present data as needed by the decision 83 maker. The platform then can host the data and provide continuous data pipelines, 84 ensuring the data needed by the decision maker meets the decision makers’ latency 85 requirements. Platforms are the strategic enabler for data products and mission. 86

ADP capabilities will solve the following two broad high-level problems and two broad 87 objective needs: 88

(1) High-Level Problem Areas89

a) The Army requires the ability to see itself (access all its data).90

b) The Army has an information technology problem of acquiring,91 aggregating, analyzing, and integrating data that already exists.92

(2) High-Level Objective Needs93

a) The Army at echelon needs to be able to operate (with information) at94 the speed of war.95

b) The Army needs to make a fundamental shift in how leaders at echelon96 access and use information.97

ADP will serve as the innovation engine that develops and refines data products to meet 98 the Army’s missions. The following (Table 1) is from the ADP Capabilities Requirements 99 Document (CRD) and highlights high level objective requirements and processes. 100

HLO Process Description To-Be State User Experience

The solution shall present information in a way that is immediately understandable and actionable for any end

• The decision maker user experience requires an application with drill-down, point and click capabilities to quickly comprehend large-scale data for non-technical users.

• The analyst user experience requires an intuitive searchable interface to quickly locate, connect to, and integrate data user. Inclusion of a mobile solution (all form factors) is preferred.

sources to create customized ingests, and automate data/information updates.

• Platform enablers require a platform that provides intuitive identification of problems with data extraction, transformation, integration, and export automation.

• The user community requires a platform that can be easily adapted to support decision making activities and staff processes for collaboration at echelon.

Data Integration

The solution shall be capable of integrating both current and historical structured and unstructured data sets, perform predictive analytics, and forecasting.

• Capability to acquire data from numerous unclassified and classified authoritative data sources in an automated manner:

including automated or manually initiated data “pull” jobs through a Representational State Transfer (RESTful) web API or direct connections.

• Data “push” or “subscribe” to other Army systems requiring authoritative, integrated data or support to other joint platforms authoritative data as needed.

• Platform which provisions curated and source data sets to other Data Analytic and Software Development environments and provides high quality metadata on source system and data lineage.

• Data-agnostic data integration, including structured, unstructured, and semi-structured data integration capabilities at terabyte scale that provides an intuitive interactive solution to assist with data quality ensuring completeness, accuracy, reliability and timeliness, and the ability to automatically generate and curate a searchable catalog of analytic content.

• Data protected in accordance with applicable laws, regulations, and policies governing Personally Identifiable Information (PII) and Protected Health Information (PHI).

Analytics and Visualization

The solution shall be interoperable with EDSC and ICAM capabilities, and shall facilitate enterprise data mining and analytics.

• Integrates, analyzes, and visualizes information in real-time/near real-time from multiple disparate data sources—both private and public—with an intuitive, interactive, top-down, and large-scale data exploration application.

• Processes and displays all current data and available historic Army authoritative data and provides a solution that enables access through all modern Army approved Army devices, enabling the ability to filter, receive/view alert(s) and share information with other users as well as plaintext search capability.

Security and Infrastructure

The product and/or capability is commercially available now and integrates with Army and or DoD ICAM capabilities.

• Capable of delivering integrated classified and unclassified content to SIPRNet users and enable the Government to pass data and insights from an unclassified solution to a classified solution.

• Protects data at rest and in transit using Federal Information Processing Standards and uses Army Identity Management solutions.

• Employs role and organizational based access controls that meets or can meet the DOD Risk Management Framework (RMF) accreditation requirements for an Authorization to Operate (ATO) on DOD NIPRNet and SIPRNet.

• Enables dynamic scalability of compute for advanced analytics.

Table 1. High Level Objectives

2.2. Threshold Requirements for All Data Platform Task Orders: The vendor will 101 provide a platform capable of meeting or exceeding the following Threshold 102 Requirements: 103

2.2.1. Usability 104

2.2.1.1. Data Operations and Data Workforce– Intuitive, interactive, large-scale data 105 exploration application to allow users to interactively view data ingest status and quality 106 metrics in a drill-down, point-and-click application. Presents a broad and immediate 107 awareness of source data and data products in the platform. Presents information that 108 is immediately understandable and actionable to users. Provides user defined alert(s) 109 and ability to setup and tailor an alert banner. 110

2.2.2. Data Integration 111

2.2.2.1. Data ingest jobs through a Representational State Transfer (RESTful) web API 112 or direct connections that refresh data and can be run manually or on a schedule. Data 113 egress to or subscriptions by other Army systems requiring authoritative, integrated data 114 or to provide other authorized platforms authoritative data as needed. 115

2.2.2.2. Data management solution that acquires data from numerous unclassified 116 authoritative data sources in an automated manner that minimizes or eliminates the 117 requirement for manual intervention during data acquisition and enables information 118 management. 119

2.2.2.3. Data-agnostic data integration, including structured, unstructured, and semi-120 structured data integration capabilities at terabyte scale. 121

2.2.2.4. Provide an Enterprise Data Platform that can produce and share data products 122 with other Data Analytic and Software Development environments. 123

2.2.2.5. Provide an intuitive interactive solution to assist with data quality ensuring 124 completeness, accuracy, reliability, and timeliness. 125

2.2.2.6. Provide metadata on source system and data lineage to assist automated input 126 to the Army Data Catalog. 127

2.2.2.7. Provide the ability to automatically generate status of data production and 128 usage. 129

2.2.3. Security and Infrastructure 130

2.2.3.1. Enables dynamic scalability of compute for advanced analytics. 131

2.2.3.2. Use Army Approved Identity Management solutions. 132

2.2.3.3. Always provide data confidentiality using only approved algorithms (e.g., 133 Federal Information Processing Standards (FIPS) 140-2). 134

2.2.3.4. Role based access controls, assignable to individual users or groups of users135 and are securely stored in lists, which can be updated at any time. 136

2.2.3.5. Provide the capability for Digital Loss Protection at the individual file level 137 utilizing vendor agnostic data loss prevention tools. 138

2.2.3.6. Must achieve authority to operation on NIPRNET using the DoD Risk 139 Management Framework (RMF). (DoD Risk Management Framework (RMF) Package 140 Deliverables, DI-MGMT-82001). 141

2.2.4. Audit Capability. Ability to audit data products at the data analyst/product 142 generators and decision maker level to validate the product being utilized for decision 143 making. 144

2.2.4.1. Ability to track origin, processing, and transformation of data products, including 145 data sources, transformations, and calculations applied. 146

2.2.4.2. Ability to record and track changes to data products, including who made the 147 changes, when, and why. 148

2.2.4.3. Ability to maintain a tamper-proof record of all system activities, including data 149 access, modifications, and deletions. 150

2.2.4.4. Ability to verify the accuracy, completeness, and consistency of data products 151 against defined rules and standards. 152

2.2.5. Key System Attributes 153

2.2.5.1. Ability to export/import/reuse current hosted data along with open-source code 154 (e.g., R, Python, SQL) used to develop/build logic for data transformation/curation. 155

2.2.5.2. Ability to scale to Army needs as determined by Government requirements with 156 an initial reference to be able to manage at a minimum of 40,000 named user accounts. 157

2.2.5.3. Tier 3 support help desk to support advanced troubleshooting and resolution of 158 complex technical issues support and documentation on functionality. 159

2.2.5.4. Synchronize with Army Data Catalogue for data lifecycle management 160 functions. 161

2.2.5.5. Automated tracking, monitoring, and documentation of its resource utilization, 162 including compute, storage, processing, and network usage, to support real-time 163 visibility and optimization of resource allocation. 164

2.3. Extendable Threshold Requirements that are Data Platform Task Order 165 Specific 166

2.3.1. User Experience 167

2.3.1.1. Decision Makers – Intuitive, interactive, top-down, large-scale data exploration 168 application to allow nontechnical users to interactively explore massive-scale data in a 169 drill-down, point-and-click application. Presents a broad and immediate awareness of 170 actual or predicted Army status. Presents information that is immediately 171 understandable and actionable to users. Provides user defined alert(s) and ability to 172 setup and tailor an alert banner. 173

2.3.1.2. Data Analysts/Product Generators – Provides an intuitive searchable interface 174 for consumers to quickly locate and connect to data sources for use in other 175 applications. Ability to conduct self-service analytics at scale; ingest, integrate, curate, 176 analyze, and visualize in individual and group workspaces, providing a robust set of 177 tools that enable collaboration such as version control. Ease of use of the data platform 178 is critical to lower barriers of entry and increase velocity of change in the Army. 179

2.3.1.3. Platform Enablers – Provide status of data within the platform. Provides intuitive 180 identification of problems with data extraction, transformation, integration, and export 181 automation. Provides easy to use platform controls, to include user access, 182 store/compute utilization, optimization tools based on usage rates. 183

2.3.2. Classified Data Integration Capability 184

2.3.2.1. Requirements identical to PWS 2.2.2 (1) - (7), Data Integration, but to include 185 classified capabilities on the SIPRNet. 186

2.3.2.2. Must achieve authority to operation on SIPRNET using the DoD Risk 187 Management Framework (RMF). (DoD Risk Management Framework (RMF) Package 188 Deliverables, DI-MGMT-82001). 189

2.3.2.3. Organize and integrate data on NIPRNet into a SIPRNET-hosted solution. 190

2.3.2.4. Capable of delivering integrated classified and unclassified content to SIPRNet 191 users and enable the Government to pass data and insights from an unclassified 192 solution to a classified solution. 193

2.3.3. Protected Unclassified Data Integration Capability 194

2.3.3.1. Requirements identical to PWS 2.2.2 (1) - (7), Data Integration, but to include 195 unclassified data management that protects data in accordance with applicable laws, 196 regulations, and policies governing Personally Identifiable Information (PII) and 197 Protected Health Information (PHI). 198

2.3.4. Analytics and Visualization 199

2.3.4.1. Integrates, analyzes, and visualizes information in real-time/near real-time 200 (within 24 hours of data updates) from multiple disparate data sources, both private and 201 public. 202

2.3.4.2. Intuitive, interactive, top-down, large-scale data exploration application to allow 203 nontechnical users to interactively explore massive-scale data in a drill-down, point-and-204 click application and filter billions of pieces of data into a digestible set of useful 205 information. 206

2.3.4.3. Processes and displays all current data and available historical Army data as 207 needed to provide future predictive analytics for time frames required at echelon 208 (Division and higher). Additionally, recommend the capability provide “confidence levels” 209 with predictions to fully inform Decision Makers as to utility and risks associated with the 210 predictions. 211

2.3.4.4. Provides a solution that enables access and/or launches access through all 212 modern Army approved (classified and unclassified) Army devices (desktop, laptop, 213 tablet, and mobile). 214

2.3.4.5. Provides ability to filter, receive/view alert(s), and share information with other 215 users. 216

2.3.4.6. Provides plaintext search capability across authoritative data. 217

2.3.5. Key System Attributes 218

2.3.5.1. Provide training content in a self-paced, online format, accessible from within 219 the platform, tailored to various types of platform users. 220

2.3.5.2. Transition Requirements. The data, data workflow, and display logic in the 221 current platform must be transferred to any new platform. This includes: 222

2.3.5.2.1. ETL logic and curated data. 223

2.3.5.2.2. Linkages to data sources at the current frequency and capacity. 224

2.3.5.2.3. Support the current user and analytic workload. 225

2.3.5.2.4. Display graphics and dashboard user experience. 226

2.4. Objective Requirements 227

2.4.1. Integrate Artificial Intelligence (AI)/Machine Learning (ML), Robotic Process 228 Automation (RPA), and other analytic capabilities directly within the platform. 229

2.4.2. Provide an “agility” layer to transactional systems: once a decision is identified in 230 the data analytics platform, provide the ability to transmit transaction requests back to a 231 transactional system based upon that decision utilizing cross platform identity 232 management and permissions and is compliant with IT Audit General Controls. 233

2.4.3. Provide the ability to prioritize computational and data exchange activities. In a 234 Disrupted, Intermittent, and Low/Limited-Bandwidth (DIL) environment, network and 235 computational abilities will be stressed. Based on operational need, data activities (e.g., 236 Existing Extract, Transform, Load (ETL)s, data export, data ingest) that task limited 237 resources (e.g., compute and network throughput), need to be able to be prioritized by 238 the user to enable priority missions. 239

2.5 Environment: Data platforms shall operate at Impact Levels (IL) 4/5 and 6 and 240 conform to one of these three conditions: 241

(1) SaaS offerings that are FEDRAMP and DISA PA authorized.242

(2) SaaS offerings with sponsorship and the ability to meet DISA PA requirements243 may be considered based on mission need.244

(3) PaaS and SaaS offerings deployed in cARMY.245

2.5.1 The platforms shall be able to deliver security and incident logs to the Army in an 246 automated fashion. 247

2.5.2 The platforms shall interoperate with enterprise services such as Identity 248 Credential and Access Management (ICAM), Army Data Catalog, and share data and 249 objects with other data platforms through an API management layer. 250

2.5.3 All data platforms within the ADP ecosystem must be able to interoperate with 251 each other, and they will support connectivity to third party data analytics and 252 visualization tools. 253

2.6 Delivery Model: Vendors shall deliver platforms through innovative, iterative, and 254 customer-centric development. The vendors shall leverage modern, agile delivery 255 practices that are tailored to the needs of the mission. The vendors shall demonstrate 256 how they integrate agile best practices into their workflows and provide agile metrics to 257 assess performance using their choice of tools and methodologies. 258

2.7 Training and Documentation: The vendor shall develop and deliver training 259 materials to meet the needs of platform users. Training material shall consist of, but not 260 limited to – onboarding material, user training, skill assessments, refresher training, and 261 support training. Furthermore, the vendors shall maintain a comprehensive list of 262 artifacts to include, but not limited to, user manuals, technical manuals, administrative / 263 configuration documents, process workflows, support documentation (contact 264 information, SLA’s, escalation paths and ticketing) and specifications, and operational 265 and troubleshooting procedures. 266

2.8 Capability Support: Following delivery of an enterprise data platform solution, the 267 vendor shall provide post-deployment support and maintenance services, including bug 268 fixes, performance tuning, and updates. System performance will be monitored to 269 include addressing any issues that arise and offering ongoing technical support, 270 helpdesk services, and training support. Technical support and helpdesk services will 271 include hours of availability, responses time by priority level, escalation methods, and 272 technical support and help desk responsibilities. Additional details will be provided in 273 future task orders. 274

2.9 Service Contract Reporting: System for Award Management (SAM) Service 275 Contract Report (SCR): The vendor shall report ALL vendor labor hours (including 276 subcontractor labor hours) required for performance of services provided under this 277 contract for the Army via a secure data collection site. The vendor shall completely fill in 278 all required data fields through the following web address: www.sam.gov. Reporting 279 inputs will be for the labor executed during the PoP during each Government Fiscal 280 Year (FY), which runs from October 1 through September 30. While inputs may be 281 reported any time during the FY, all data will be reported no later than October 31 of 282 each calendar year. Vendors may direct questions to the help desk by clicking “View 283 Assistance for SAM.gov” which is located at the top of the SAM.gov website. From 284 there, you can the select “Contact Our Service Desk” which will allow you to contact 285 SAM.gov directly. If contract PoP ends prior to September 30, the vendor has twenty 286

(20) days from end date of the contract to complete the SAM SCR requirement.287

Steps for Submitting a SCR: 288

1. Go to www.sam.gov and log in.289

2. Select Entity Registrations and then select Service Contract Reporting.290

3. SAM displays your entities which have service contracts and meet the reporting291 criteria. Select View by entity to see the service contracts for each entity.292

4. Next, select Add for the service contract against which you want to create a SCR.293

5. Each service contract which meets the FAR Subpart 4.1703 reporting thresholds294 is displayed. You will be taken to the Complete SCR page. SAM displays the295 contract details and allows you to report. You are required to enter the following296 information:297

6. Total Amount Invoiced: Total dollar amount invoiced for services performed298 during the previous Government fiscal year under the contract (this amount299 should include the prime and any subcontract amount) (? No b) paragraph)300

Prime Contractor Hours Expended: Prime vendor direct labor hours expended on the 302 services performed during the previous Government FY. The amount you enter is 303 automatically divided by 2,080 hours to calculate a Full Time Employee (FTE) 304 equivalent, displayed under the Prime Contractor Hours Expended as Prime Contractor 305 FTEs. 306

• Report any required Tier 1 subcontractor information by selecting the Add Tier 1307 Subcontract Information button.308

• When you are ready to submit the report, select Submit. This saves your report309 and returns you to the Select Service Contract page where you can create other310 SCRs or edit an existing SCR.311

Steps for Editing a Submitted Report: 313

• Follow steps 1-4 above. Any previously submitted SCR will have a View/Edit314 button instead of an Add button.315

• Select View/Edit. You will be able to view the current SCR, edit available fields,316 and resubmit the record. You can also delete previously entered information317 altogether.318 http://www.sam.gov/ http://www.sam.gov/

Standard: All information provided by the vendor will be accurate, complete, and not 320 exceed suspense dates noted in corresponding paragraph above. 321

Acceptable Quality Limit: 100% Compliant 323

2.10 Vendor Key Personnel: Each MATOC Contract Holder shall identify personnel to 325 serve in the following roles at that MATOC level. The Government will not separately 326 pay for these positions. No costs for Vendor Key Personnel shall be billed to the ADP 327 program. Key personnel at the MATOC contract level will serve as the primary points of 328 communication throughout the ordering period. Contract Holders may fill key personnel 329 positions however they see appropriate provided that the individual(s) filling those 330 positions are empowered to speak on behalf of the company. The following positions 331 are identified as key personnel at the Base MATOC Contract level. 332

Contractor Contract Manager (CCM): Contractor Representative responsible for 334 negotiating contractual matters on behalf of the ADP MATOC Contract Holder. 335

MATOC PCO has current point-of-contact information for the Contractor Key Personnel 337 positions. In the event of a change to Contractor Key Personnel, the Contractor shall 338 notify the MATOC PCO and provide all Point of Contact information for the new Key 339 Personnel within five (5) calendar days of the change. 340

The Contractor shall ensure that the MATOC PCO has current point-of-contact 342 information for the Contractor Key Personnel positions. In the event of a change to 343 Contractor Key Personnel, the Contractor shall notify the MATOC PCO and provide all 344 Point of Contact information for the new Key Personnel within five (5) calendar days of 345 the change. Failure of Contractor Key Personnel to perform their duties effectively and 346 efficiently will be construed as conduct detrimental to contract performance and may 347 result in Off-Ramping. 348

2.11 Program Management: The vendor shall provide program management support 350 for managing ADP TOs as needed. Supporting tasks include: 351

• The vendor shall support regular coordination between MATOC award holders on353 related projects.354

• The vendor shall provide periodic TO status updates as required by the355

Government within an agreed-upon frequency and schedule.356

• The vendor shall respond to cybersecurity incidents in accordance with the357 requirements of the TO.358

• The vendor shall provide program management documentation as required by359 the Government to support TO project deliverables.360

• The vendor shall provide transition-in/transition-out activities to facilitate a361 smooth transition at TO start and completion.362

PART 3 – General Information 363

3. General Information:364

3.0. Quality Assurance: Vendor performance under resulting TOs will be surveilled by 365 the Government in accordance with the requirements of the Performance Work 366 Statement (PWS), Contract Data Requirements Lists (CDRLs), Quality Assurance 367 document and TO. 368

3.1. Recognized Holidays: The following provides information on recognized holidays 369 for the purpose of this PWS. If submittal of any documentation (e.g., deliverables, 370 submittals, etc.) deadline fall on a holiday, the closest workday prior to the holiday will 371 apply as the deadline for submittal. The Government recognizes the following holidays 372 listed below. The vendor will not be required to work on Federal Holidays: 373

• New Year’s Day374

• Martin Luther King Jr.’s Birthday375

• President’s Day (George Washington’s Birthday)376

• Memorial Day377

• Juneteenth National Independence Day378

• Independence Day379

• Labor Day380

• Columbus Day381

• Veteran’s Day382

• Thanksgiving Day383

• Christmas Day384

3.2. Place of Performance: The place of performance will be defined at the TO 385 level. The Government contemplates that the primary place of performance across all 386 TOs will be the Contractor’s facility. Mission requirements of certain TOs may require 387 performance at the Government’s facility. Remote work may be authorized to the extent 388 that mission requirements and vendor policies permit. 389

3.3. Hours of Operations: The hours of operation will be defined in the TOs. 390

3.4. Security Requirements: The following information is provided on security related 391 matters. These requirements reflect the minimum requirements for the TO and further 392 requirements regarding security will be defined within individual TOs. 393

3.5. Security Program: If the TO states work occurs in a classified environment, then 394 vendor personnel performing work under this TO must be eligible or have a SECRET 395 clearance at time of the proposal submission and must maintain the level of security 396 required for the life of any TO awarded under the MATOC IDIQ. The security 397 requirements are IAW with the DoD Contract Security Classification Specification (DD 398 Form 254). 399

3.6. Personnel Security Clearance Requirements: If the TO states work is in a 400 classified environment, then vendor personnel performing work must have an active 401 personnel security clearance at the SECRET level in the Defense Information System 402 for Security (DISS) at time of the proposal submission or for new hires within 30 days of 403 TO award, and they must maintain the level of security required for the life of the 404 contract. The security requirements are IAW the DoD Contract Security Classification 405 Specification (DD Form 254). The vendor will ensure that employees and subcontractor 406 employees performing services comply with FAR 52.204-2 Security Requirements when 407 the employee has access to information classified “Confidential,” “Secret,” or “Top 408 Secret.” The vendor will ensure the employee complies with the DoD Security 409 Agreement (DD Form 441), and the NISPOM rule at 32 Code of Federal Regulation 410 (CFR) Part 117, effective 24 Feb 2021. The NISPOM is the National Industrial Security 411 Program Operating Manual to which contractors must implement and comply. 412

3.7. Installation Access: If the TO states that work requires access to U.S. 413 Government installations, buildings and controlled areas, personnel must meet 414 authorization and security criteria. Failure to submit required information/data and obtain 415 required documentation or clearances will be grounds for denying access to U.S. 416 installations, buildings, and controlled areas. The vendor will ensure that any 417 subcontractors comply with these requirements and that all employees, of both the 418 vendor and any subcontractor utilized by the vendor, are made aware of and comply 419 with these requirements. The vendor will be aware of and comply with the requirements 420 associated with Installation Access Control. The Government is not liable for any costs 421 associated with performance delays due solely to a firm’s failure to comply with 422 Installation Access Control System (IACS) processing requirements. The vendor will 423 return installation passes to the issuing IACS office when a contract’s Period of 424 Performance (PoP) ends or when a contractor employee no longer requires access. 425

3.8. Individual Termination or Expiration of Employment: The vendor will collect 426 the installation access passes and Government credentials and, if applicable, 427 Government Furnished Property (GFP) the same day employment of an individual has 428 expired or has been terminated and will return them to the issuing office within one (1) 429 to five (5) business days. 430

3.8.1. Contract Termination or Cancellation: Upon termination or cancellation of a TO, 431 the vendor will collect all outstanding installation access passes and return them to the 432 issuing office within ten (10) days. 433

3.8.2. Common Access Cards (CAC) and CAC Log: The vendor will provide 434 the following information: Last, First and Middle Name, Social Security Number, date of 435 birth, primary email address (this email address will be used to contact the individual) 436 and any other necessary information required to obtain a CAC or installation access 437 card, to the Contracting Officer’s Representative (COR) via email within five (5) days 438 after award. The contractor will not be issued a CAC if their time on this effort is less 439 than 50%. If the contractor possesses a non-Army CAC from another contract effort, the 440 contractor must surrender that CAC before an Army CAC will be issued for an ADP 441 contract effort. 442

3.9. Background Checks: Applicable to Continental United States (CONUS) and 443 Outside Continental United States (OCONUS) (includes Alaska and Hawaii) 444 requirements, the Requiring Activity (RA) will consult with the responsible Security 445 Office and Activity Manager applicable to location(s) associated with this PWS and 446 identify the level of background check required, supported by the applicable 447 regulation(s). 448

3.9.1. U.S. Citizen: The RA Manager will determine the extent of background checks 449 required. The vendor employee may begin performance on a contract after receiving a 450 favorable local background check. The vendor agrees to replace the employee should 451 the results of the background check, if required, be unfavorable as determined by the 452 RA Manager. The vendor’s replacement of the employee with the 453 unfavorable background check will be within a timeframe provided by the RA Manager. 454 The vendor will also replace employees whose background check, during their tenure of 455 employment, renders them with an unfavorable local or stateside background check, as 456 determined by the RA Manager. The vendor will forward a copy to the Contracting 457 Officer (KO) via the COR and the RA Manager of each favorable background check 458 within five (5) days of receipt by the vendor, identifying such with the appropriate 459 contract number. The Contractor will forward a copy to the KO via the COR and the RA 460 Manager of each unfavorable background check within two (2) days of receipt by the 461 vendor, identifying such with the appropriate contract number. When the Government 462 awards a non-personal services contract directly to an individual, the failure of the 463 individual to provide a favorable background check is grounds for termination. 464

3.10. Physical Security: The vendor will safeguard all Government 465 equipment, information, and property provided for vendor use. If performing work in a 466 Government facility, the facilities, equipment, and materials will be secured at the close 467 of each work period IAW the Army Physical Security Program (AR 190-13). 468

3.11. Operations Security (OPSEC) Requirements: vendor personnel will adhere 469 to facility security policies and restrictions. The vendor will immediately report 470 suspicious activities to security personnel. 471

3.12. Personally Identifiable Information (PII): vendor personnel will adhere to 472 Privacy Act of 1974, DoD Instruction 8500.2 and complete DoD Cyber Exchange 473 training. Any breach of PII will be reported within (1) one hour to US-CERT at 474 http://www.us-cert.gov. 475

3.13. Security Incidents and Violations: The vendor will notify the Government 476 Contracting Activity and the Government Security Manager within 48 hours of any 477 incident involving the actual or suspected compromise/loss of classified information to 478 enable the Government to conduct immediate assessments of potential impact pending 479 formal inquiry/investigation. Actual or suspected compromise of Covered Defense 480 Information will be reported IAW DFARS Clause 252.204-7012. 481

3.14. Key Control: vendor will establish and implement methods of making sure all 482 keys and/or CAC cards issued to the vendor by the Government are not lost or 483 http://www.us-cert.gov/ misplaced and are not used by unauthorized persons. NOTE: All references to keys 484 include CAC and key cards. No keys issued to the vendor by the Government will be 485 duplicated. The vendor will develop procedures covering key control that will be 486 included in the vendor’s Security Plan with CDRL DI-ADMIN-81373 and the Quality 487 Control Plan (QCP). Such procedures will include turn-in of any issued keys by 488 personnel who no longer require access to locked areas. The vendor will immediately 489 report any incidents of lost or duplicate keys to the KO. The vendor will prohibit the use 490 of Government issued keys and/or CAC cards by any persons other than the vendor’s 491 employees. The vendor will prohibit the opening of locked areas by vendor employees 492 to permit entrance of persons other than vendor employees engaged in the 493 performance of assigned work in those areas, or personnel authorized entrance by the 494 KO. The vendor will establish and implement methods of ensuring that all lock 495 combinations are not revealed to unauthorized persons. The vendor will ensure that 496 lock combinations are changed when personnel having access to the combinations no 497 longer have a need to know such combinations. These procedures will be included in 498 the QCP (DI-ADMN-81373), CDRL 002- Operations Security Plan. 499

3.15. Post Award Conference/Periodic Progress Meetings: The vendor will attend 500 any post award conference convened by the contracting activity or contract 501 administration office IAW FAR Subpart 42.5. The KO, COR, and other Government 502 personnel may meet periodically with the vendor to review the vendor's performance. At 503 these meetings the KO will apprise the vendor of how the Government views the 504 vendor's performance, and the vendor will apprise the Government of problems, if any, 505 being experienced. Appropriate action will be taken to resolve outstanding issues. 506 These meetings will be at no additional cost to the Government (DI-ADMN-81505), 507 CDRL-001 Integrated Program Management Data and Analysis Report. 508

3.15.1. The vendor will attend, participate in, and furnish input to scheduled 509 and unscheduled meetings, conferences, and briefings that relate to the functions and 510 services herein as required by the Government to provide effective communication and 511 impart necessary information. The Contract Manager or designated representative will 512 attend meetings as requested by the Government. Meeting attendees will at times 513 include vendor managerial, supervisory, and other personnel knowledgeable of the 514 subject matter. Meetings may start or end outside of regular duty hours. 515

3.16. Contracting Officer’s Representative (COR): Refer to Part 6 of this PWS for 516 the definition of a COR. As determined by the KO, a COR will be appointed at the TO 517 level and identified by letter of designation, a copy of which will be provided to the 518 vendor by the KO. The designation letter states the responsibilities and limitations of the 519 COR. The COR is not authorized to change any of the terms and conditions of the 520 resulting order. The COR monitors all technical aspects of the contract and assists in 521 contract administration. The COR is not authorized to obligate the Government. If the 522 work is not written/modified into the contract, the COR is not authorized to request new 523 work. The COR will have oversight of the following functions (but not limited to): 524 ensuring that the vendor performs the technical requirements of the 525 contract; performing inspections necessary in connection with contract performance; 526 maintaining written and oral communications with the vendor concerning technical 527 aspects of the contract; issue written interpretations of technical requirements, including 528 Government drawings, designs, and specifications; monitoring Contractor's 529 performance and notifying both the KO and vendor of any deficiencies; coordinating 530 availability of Government property; and coordinating site entry of vendor personnel. 531

3.17. Identification of Contractor Employees: All vendor personnel attending 532 meetings, answering Government telephones, and working in other situations where 533 their contractor status is not obvious to third parties must identify themselves, to include 534 proper marking of signature blocks in correspondence, to avoid creating an impression 535 in the minds of members of the public that they are Government officials. The vendor 536 will ensure that all documents or report, produced by contractors are suitably marked as 537 contractor products or that contractor participation is appropriately disclosed. 538

3.18. Contractor Travel: The vendor may be required to travel to an alternate place 539 of business, CONUS or OCONUS, to attend meetings, conferences, or support mission 540 requirements. The vendor may be authorized travel expenses at rates no higher than 541 the substantive provisions of the Federal Travel Regulation (FTR), IAW FAR Part 542 31.205-46, and the limitation of funds specified in this contract. All travel requires 543 Government approval and authorization within ten (10) days prior to scheduled travel, 544

(DI-ADMN-81308A). 545

3.19. Other Direct Costs (ODCs): If a vendor verifies that they have an Approved 546 Purchasing System, the U.S. Government may recommend a threshold for the COR to 547 approve. Above that approval threshold, KO concurrence is required. An approved 548 purchasing system means a vendor’s purchasing system has been reviewed and 549 approved IAW FAR Part 44. For charges to be invoiced, deliverable services must have 550 been performed in direct support of a requirement. The Government does not have an 551 employer/employee relationship with vendor employees and therefore is not authorized 552 to grant administrative leave or expend Government resources to compensate vendor 553 employees for hours expended on activities not within scope of the TO. Under these 554 circumstances, vendor employees must comply with individual company policy that is 555 IAW that company’s compensation system. Submission of an invoice for payment of 556 non-billable charges are not authorized and constitutes a false claim, which may lead to 557 criminal sanctions, fines, suspension, or debarment. 558

3.20. Data Rights: The Government has unlimited rights to all documents, materials, 559 and data produced under this contract. All documents, materials, data, source code 560 of software, or any source code, software, or transforms generated by the system or 561 through a low-code/no-code solution, hereafter referred to as “materials”, produced 562 under this contract will be Government owned and are the property of the Government 563 with all rights and privileges of ownership and copyright belonging exclusively to the 564 Government. These materials may not be used or sold by the vendor without written 565 permission from the KO. All materials supplied to the Government will be the sole 566 property of the Government and may not be used for any other purpose. This right 567 does not abrogate any other Government rights. 568

3.21. Non-Disclosure Requirements: Performance under this contract may require 569 the vendor to access materials proprietary to a government agency, 570 another Government vendor, or of such nature that its dissemination or use other than 571 as specified in this work statement would be averse to the interests of the Government 572 or others. The vendor and vendor personnel will not divulge, or release materials 573 developed or obtained under performance of this PWS, except to authorized by 574 Government personnel or upon written approval of the KO. The vendor will not use, 575 disclose, or reproduce proprietary materials other than as specified in this PWS. All 576 documentation showing individual names or other personal information will be controlled 577 and protected under the provisions of the Privacy Act of 1974, Public Law 93-579, 5 578 United States Code (U.S.C.) Section 552a (TACOM Clause 52.215-4405). 579

3.22. Protection of Government and Contract Information: Per Public Use Notice 580 of Limitations stated by Defense Imagery Management Operations Center and 581 contained at www.dimoc.mil/resources/limitations/, the vendor will not cite any 582 information (e.g., contract information, pictures, locations, etc.) obtained through this 583 contract on any hard copy or digital marketing tools to include its company website. 584

3.23. Non-Disclosure Statements: The vendor will provide signed Non-Disclosure 585 Agreements (NDAs) to the COR no later than seven (7) days prior to commencement of 586 work for a TO issued under this contract. Disclosure of information by vendor personnel 587 may result in removal from this contract. 588

3.24. Organizational Conflict of Interest (OCI): vendor and subcontractor 589 personnel performing work under this contract may receive, have access to or 590 participate in the development of proprietary or source selection information (e.g., cost 591 or pricing information, budget information or analyses, specifications, or work 592 statements, etc.) or perform evaluation services which may create a current or 593 subsequent OCI as defined in FAR Subpart 9.5. The vendor will notify the KO 594 immediately whenever it becomes aware that such access or participation may result in 595 any actual or potential OCI and will promptly submit a plan to the KO to avoid or 596 mitigate any such OCI. The vendor’s OCI Mitigation Plan will be determined to be 597 acceptable solely at the discretion of the KO. In the event the KO unilaterally 598 determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may 599 affect other remedies deemed necessary, including prohibiting the vendor from 600 participation in subsequent contracted requirements which may be affected by the OCI. 601

3.25. Required Training: The following provides information on training requirements. 602 This is not inclusive to all training requirements for all personnel. Any additional vendor 603 training requirements will be stated in follow on TOs. All vendor employees, including 604 subcontractors, will complete Level I OPSEC 1.23.1 OPSEC Training within one (1) day 605 of employment under this contract. Verification of the training will be provided to the 606 COR within one (1) day after completion of the training. OPSEC Level I training is 607 available at 608 https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=EUC&course_number=-ECJ6-609 110-N.610 http://www.dimoc.mil/resources/limitations/ https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=EUC&course_number=-ECJ6-110-N https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=EUC&course_number=-ECJ6-110-N

3.25.1. Information Security Program (INFOSEC) Training: If applicable, 611 vendor employees, including subcontractors, will complete INFOSEC training within one 612

(1) day of employment under this contract. Verification of the training will be provided to613 the COR within one (1) day after completion of the training. INFOSEC training is 614 available at https://securityawareness.usalearning.gov/. 615

3.25.2. Cybersecurity Training: 616

3.25.3. All vendor employees, including subcontractors, requiring access to Government 617 information systems will complete the DoD Cybersecurity/Cyber Awareness Training 618 prior to CAC issuance. Verification of the training will be provided as part of the CAC 619 request. 620

3.25.4. All vendor employees, including subcontractors, working Information Technology 621 (IT)/Information Assurance (IA) functions will comply with DoD and Army training 622 requirements per Cybersecurity Training Certification and…