A03_Revised_PWS.pdf

DRAFT

PERFORMANCE WORK STATEMENT

Defense Finance and Accounting Service (DFAS)

System Administration and Maintenance for Non-Appropriated Funds Central Payroll System (NAFCPS)

1. GENERAL: NAFCPS pays Army and DoD Non-Appropriated Funds employees. NAFCPS is the Automated Information System (AIS) used to perform the following functions related to NAF Funds; NAF Civilian Pay, Debt and Claims, Garnishments and, Tax and Disbursing Reports.

NAFCPS calculates pay and leave in accordance with applicable laws, regulations and union agreements on a biweekly basis for a variety of types of employees with differing pay and entitlements. NAFCPS provides users with detailed reports concerning taxes, benefits, garnishments, allotments, leave information and expenses by General Ledger Account Code (GLAC) after each payroll processes. The system prepares quarterly IRS Form 941 and annual W- 2 forms for all mission essential civilian employees.

1.2 Background: The Non-appropriated Funds Central Payroll System (NAFCPS) Configuration Management IBM iSeries Server Infrastructure requires a System Administrator to conduct Security Administration and Maintenance functions on two IBM iSeries Power10 Servers.

Below is an overview of the architecture and hardware of NAFCPS.

1.2.1 System Architecture

1.2.2 Hardware

NAFCPS is hosted on the following two IBM iSeries Servers:

• Production/DISA San Antonio: IBM iSeries Server 10.

• DEV/COOP/DISA Oklahoma City: IBM iSeries Server 10.

1.3 Objectives: The objective is to provide IBMi System Administration and Configuration

(Management Service Provider Services) and Application Administration for the NAFCPS infrastructure. The contractor shall perform Installation, Configuration, and Maintenance of server hardware and software. The contractor shall manage user accounts, monitor system performance, perform backups, update and patch software, application administration, and security administration. All contractor efforts should support minimizing server slowdown and downtime while maximizing reliability, ensuring a secure server environment, and maintaining the ability to scale servers and related operations to meet the needs of DFAS over time.

1.4 Scope: The contractor will provide all necessary personnel, management, administrative, licensing and technical services to meet the requirements outlined in this PWS. In carrying out such efforts, the contractor will complete the following items:

1.4.1 Installing, Configuring, and maintaining server hardware and software

1.4.2. Managing user acct permissions and access controls

1.4.3. Monitoring system performance and troubleshooting issues

1.4.4. Performing regular backups and disaster recovery planning

1.4.5. Updating and patching software

1.4.6. Collaborating with other IT teams to support overall infrastructure

1.4.7. Security Administration

1.4.8 Program Management

1.4.9. Application Administration

1.4.10. Training

1.5 Period of Performance: The period of performance shall be for one year (12) months from the date a contract is fully executed plus four (12) month option periods.

April 1, 2024 – March 31, 2025 April 1, 2025 – March 31, 2026 April 1, 2026 – March 31, 2027 April 1, 2027 – March 31, 2028 April 1, 2028 – March 31, 2029

1.6. Place of Performance:

The work to be performed under this PWS can be performed either remotely or at DISA San Antonio Data Center or DISA Oklahoma City Data Center, or at other locations agreed to by DFAS and the contractor. Travel may be required to CONUS locations to support NAFCPS customers at their place of business. CONUS sites are predominantly military bases or other Government installations.

DISA Data Center, San Antonio Address:

3326 General Hudnell Dr.

San Antonio, TX 78226-1834

DISA Data Center, Oklahoma City Address:

8705 Industrial Blvd.

Tinker AFB, Oklahoma City 73145

When performing at DFAS sites, the contractor shall require their employees to follow the regulations as if their contractor employees were DFAS employees, unless relieved of that responsibility by the Contracting Officer.

• DFAS 2000.1-I

• DFAS 5200.1-I

• DFAS 5200.8-I and

• DFAS 5200.10-I

1.7. Additional Information

1.7.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which it assures itself that the work complies with the requirement of the PWS. The program should take into consideration the Tasks listed in Part 4 and the Performance Requirements Summary (PRS) (See Section 6.1 Attachment 1 Performance Requirements Summary).

1.7.2 Quality Assurance Plan: The Government shall evaluate the contractor’s performance under each Call Order in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance and the minimum acceptable level of support.

1.7.3 Travel: All travel shall be pre-approved by the COR. Costs incurred by Contractor personnel on official company business are subject to the limitations contained in FAR 31.205-46, Travel Costs, and FAR 31.201-3, Determining Reasonableness. Costs incurred for travel must be reasonable.

Typically, costs incurred are considered reasonable if these costs do not exceed the maximum rates within the Federal Travel Regulation (FTR), Joint Travel Regulation (JTR), and the Standardized Regulation (SR).

1.7.3.1 Contractor Travel:

Performance under this Task Order (T.O.) may require travel by contractor personnel to CONUS locations. The contractors shall be required, as requested by the Government, to travel for meetings, system discussions, presentations, presentation of deliveries, and task exit interviews. If travel is required, then the contractor is responsible for making all needed arrangements for their personnel.

1.7.3.2 Travel Policy:

The Government will reimburse the contractor for allowable travel cost incurred by the contractor in performance of the contract in accordance with FAR 31.205-46. Overhead, profit and Other Direct Costs are not an allowable travel cost for this requirement. The contractor will only be reimbursed for allowable direct labor costs.

Travel must be approved by the COR prior to any travel being made. When travel is required, the contractor is responsible for making all needed arrangements for their personnel. Actual travel costs will be reimbursed IAW FAR 31.205-46.

The contractor shall provide a trip report five (5) days after each trip associated with a travel approval. The contractor shall maintain a summary of all approved travel, to include at a minimum, the name of the traveler, location of travel, duration of trip, total cost of trip. The contractor shall confirm travel requests in writing and shall provide the COR with names of travelers, expected duration of travel, travel locations, cost estimates and labor effort associated with the travel prior to travel period. No travel is expected outside the continental United States (OCONUS).

Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence, or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, to include parking expenses. A CLIN will be used for contractor travel reimbursement.

1.7.4 Interaction with Contractor Personnel: The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate a training schedule with the COR that does not cause undue delays to Task Order (T.O.) performance.

The prime contractor official representative (including subcontractor’s personnel, when applicable) shall provide the COR, within 30 days after T.O. award/exercise of an option, a written report identifying:

(1) Contractor employees required to take the training

(2) Contractor employees who completed the training

(3) Contractor employees who are delinquent

Contractor personnel shall direct their questions or concerns to their contractor management chain and/or company representative.

1.7.5 Recognized Holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth Independence Day

1.7.6 Hours of Operation: The contractor shall conduct business between the hours of 6:00AM and 6:00PM, Monday thru Friday except the Federal holidays listed in 1.6.4 or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for any of the above reasons. The contractor must also be available for after-hours support/on call for Severity 1. The contractor must respond within 30 minutes of when the initial call is received.

1.7.7 Extended/Emergency Hours: When mission needs dictate, at the request of or upon coordination with the COR, Contracting Officer Technical Representative (COTR), the contractor staff shall be available outside facility duty hours (i.e. will work nights and weekends) to support the types of work described within the PWS. This includes availability for after-hours support/on-call for Severity 1 listed at Section 6.5- Attachment 5-Monitoring System Performance and Troubleshooting Issues.

1.7.8 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The COR, and other Government personnel, as appropriate, will meet on a monthly basis with the contractor to review the contractor's performance. At these meetings the COR will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.7.9 Contracting Officer Representative (COR):

The COR is the primary point of contact for the contractor. The COR shall interface with DFAS Information and Technology (IT) Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656

Follow the link titled “Site Specific Force Protection/Security Services” in the Additional Points of Contact section near the top right side of the Web page.

The COR is responsible for monitoring all technical aspects of the award and assisting in contract administration. COR duties include:

• Ensure contractor performs the technical requirements of the award.

• Perform inspections necessary in connection with contract performance.

• Maintain written and oral communications with the contractor concerning technical aspects of the award.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656

• Monitor contractor’s performance and notifies both the CO and contractor of any deficiencies.

• Coordinate availability of Government furnished property and site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.7.10 Type of Contract: The award will be a Labor Hour (LH) contract type with a Time and Material CLIN for travel only.

1.7.11 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contract personnel will be issued Government Common Access Cards (CACs) identifying them as a contractor after favorable security adjudication.

Contractor employees must wear CAC’s while in the facility.

1.7.12 Data Rights: This requirement is covered by the data rights clauses included in the Task Order. In the event Data or Application Code is required that was developed exclusively at private expense of the contractor DFARS Clause 252.227-7015 is applicable. In the event Data or Application Code is developed during performance of this requirement using government funds DFARS Clauses 252.227-7013, 252.227-7016, 252.227-7017, 252-227-7030, and 252-227-7037 is applicable.

1.7.13 Section 508 Compliance:

• Requirements for accessibility based on Section #508 of the Rehabilitation Act of 1973 (29

U.S.C. 794d) are determined NOT to be relevant for the following program need: “NAF Configuration Management Server Migration.”

• Requirements for accessibility based on Section #508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) do not apply based on the claim of the following exception founded in Federal Acquisition Regulation (FAR) 39.204:

o Section 508 back office exception based on CFR D1194.3 (f) “Products located in spaces frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment are not required to comply with this part.” Justification for this claim is documented by the following: “NAF server and host applications reside on server hardware located in a controlled access data center. End-users have no direct access to NAF server hardware in DFAS data centers.”

1.7.14 Alternate Worksite Authorization:

The Contractor may be authorized to work at an alternate worksite under the subject task order, on a case by case basis, only with prior authorization from either the COR or CO. Each alternate worksite effort will be for a definitive period of time as agreed upon by both parties.

PART 2

SECURITY REQUIREMENTS

2.1 Security Requirements.

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required. IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days)*. A Declaration for Federal Employment (OF-306) should then be submitted to the Contracting Officer Representative (COR), who will submit this form along with a Contractor Request for Investigation (CRI) (DFAS Form 9035) to DFAS Personnel Security as soon as possible, but not less than fifteen (15) calendar days prior to the intended start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat

Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), COR, and the DFAS Personnel Security Office.

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the COR, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that person’s delinquent on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS

Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1- I. Contractor personnel shall also complete all required contractor training requirements identified in this

SOW/PWS.

Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI).

The DFAS manager of the requiring office will determine what CUI contractor personnel are given access

to. CUI may not be disclosed to contractor personnel unless required for contract performance.

Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/

Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Level I Antiterrorism Awareness Training. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

https://public.cyber.mil/training/cyber-awareness-challenge/ https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training:

Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://securityawareness.usalearning.gov/cui/index.html https://securityawareness.usalearning.gov/disclosure/index.html https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

- Contractor employees required to take the training

- Contractor employees who have completed the training

- Contractor employees who are delinquent

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT (GFE), INFORMATION (GFI) AND

SERVICES

3. GOVERNMENT FURNISHED INFORMATION, EQUIPMENT, SPACE OR FACILITIES.

3.1 Government Furnished Equipment: Laptops shall be furnished by DFAS and shipped to the remote working locations of those fulfilling the activity of the contract. All software resident on the computers required to complete the tasks will be made available to the contractor after Desktop Management Initiative (DMI) and Cyber Security Service Contractor (CSSP) approval. Only DFAS Government furnished equipment shall be connected to the DFAS Enterprise Local Area Network (ELAN). The contractor shall be fully responsible for maintaining the inventory, providing physical security and returning the equipment and materials to the Government in the same condition in which they were received, after completion of the period of performance.

Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI.

All computer software required to complete the tasks will be made available to the Contractor. Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI. Vendor’s employees will be provided standard issue DMI laptop Operations. For Contractor personnel working at alternate locations agreed upon by DFAS and the Contractor, logon ID’s will be provided to access to the required platforms. The Contractor shall provide the access network connection via the Pulse Secure for any personnel not working at the physical DFAS site.

Government Furnished Property (GFP) is subject to the following clauses that have been included in this Request for Quote (RFQ) by full text.

FAR 52.245-1 Government Property DFARS 252.245-7003 Contractor Property Management System Administration DFARS 252.245-7005 Management and Reporting of Government Property

The awardee of this contract must have an acceptable Property Management System, per DFARS 252.245-7003 and 52.245-1(f) in place in order to be able to receive GFP. The contractor shall provide sufficient information as part of their offer in order for the Contracting Officer to determine the Contractor’s Property Management System is acceptable. Reporting requirements are defined in the provisions/clauses above.

GFP on this contract will be in the form of DFAS formatted laptops in which the contractor shall need to remove the laptops from a Government Controlled Facility in order to perform the tasks that are required on the contract at an alternate location. If laptops are issued, personnel shall obtain a property pass when removing laptops from a Government facility.

3.2 DFAS IT Policy Concerning Contractor Furnished Equipment (CFE).

In accordance with Chapter 3 of DFAS Regulation 8400.1-R, personally owned workstations, laptop computers, software and printers, including computers connected remotely will not be connected to the DFAS Enterprise Local Area Network (ELAN). This prohibition is a security requirement to protect the

ELAN from the spread of malicious logic (viruses and Trojan Horse programs) and to protect sensitive but unclassified (SBU) information from being compromised.

PART 4

SPECIFIC TASKS

4. SPECIFIC TASKS:

The specific tasks that the contractor shall perform are identified in the Performance Requirement Summary (PRS), which is attached hereto and fully incorporated herein. It sets forth how the contractor’s activities will be monitored and measured. The tasks required are organized into the following system lifecycle categories: program management, requirements management, technical analysis and design, software programming, testing, and production implementation activities. Each category of work has specific detailed tasks that set forth the results the contractor must accomplish and the performance measures for each. A more general description of the work required to be performed and expectations governing how that work will be performed are provided below.

4.1 Program Management, Performance Analysis and Reporting

4.1.1 Weekly Status Reports: The contractor shall prepare and deliver a weekly Status Report to the COR. The contractor shall report by project/system that details the system, Government team leader, contractor(s) assigned, and summary of activities for the week, progress, problems encountered, any newly identified vulnerabilities, risks, solutions to the problems and any other pertinent information. The contractor shall ensure the following topics are available for discussion: the management of contract activities, scheduling, costs, and technical status.

4.1.2 Monthly Performance: The contractor shall prepare and deliver a monthly Performance and a Summary Project Status Report to the COR and the Project Manager no later than the 10th working day of each month.

The Contractor shall maintain and report the following in accordance with the Government approved Structure Summary Report:

• The status of the ongoing task order

• Relevant information regarding problem areas and course of action taken in their resolution

• Potential problems anticipated

• Significant activities and work progress

• Analyses

• Status in accordance with the Government-approved Work Breakdown Structure (WBS).

• Achievements of contractor personnel

4.1.3 Weekly Meetings: Required meetings with DFAS NAFCPS Team: Bi-weekly calls unless there is an issue with the server in which case there will be daily calls to discuss and report on the health of the environment. The contractor shall also attend 30-minutes daily scrum meetings from Monday through Friday.

4.2 Installing, Configuring, and Maintaining Server Hardware and Software:

4.2.1 Daily OS System Administration and Configuration.

4.2.2 IBMi Message Support and Response.

4.2.3 IBMi Enterprise Extenders management/Configuration Management/Establish SFTP.

4.2.4 IBMi Library management.

4.2.5 Turn on/off ports; use of IBMi Access Client Navigator.

4.2.6 Turning on Journaling, Retrieving and Interpreting Reports.

4.2.7. Documenting configurations, procedures and incidents for future reference.

4.2.8 Monitor and maintain hardware and software. Monitor the system after software and security patches; and OS upgrades. Troubleshoot and provide technical support to users and customers. Ensure the highest level of systems and infrastructure availability. Support troubleshooting of server issues with hardware and the implementation of replacement parts involving the hardware warranty. Also support the troubleshooting and any configuration changes due to the replacement of hardware.

4.2.9 Assist in the testing of Security Technical Implementation Guides (STIGs) and the finding of solutions and resolution of open/non-compliant STIGs and ACAS findings; and provisioning of artifacts.

4.2.10 Provide Systems Engineering and Server Administration support. Monitor and update the server to make sure it is running properly and without errors. This includes a continuous collection of information about the server, its periodic analysis, and a regular set of actions necessary to avoid problems that may occur or fix them.

4.2.11 Evaluate the existing systems and provide technical direction to the NAF team. Staying on top of hardware life cycles. Optimize hardware performance by adjusting the configuration of hardware. Conduct regular hardware maintenance which will help to avoid unforeseeable issues like hardware damage and significant data loss.

4.2.12 Update critical service packs and software updates to restore normal server operations following the detection of an issue or anomaly. Scan for vulnerabilities.

4.2.13 Verify storage utilization at least on a weekly basis. Review server resource usage at least on a weekly basis. Update software applications as required. Verify network utilization for network capacity (server loads).

4.2.14 Verify Operating System Updates. Check logs for hardware errors on a daily basis.

Check server logs daily for errors and unauthorized usage. A logged error might identify a hardware issue that you can fix before it fails.

4.2.15 Server maintenance refers to the systemic and regular tasks undertaken to ensure the optimal performance, reliability and security of server infrastructure. It encompasses a wide array of activities, from hardware diagnostics and software updates to security audits and data backups. Installing and configuring computer hardware, software, systems, networks, printers and scanners. Responding in a timely manner to service issues and requests. Providing technical support across the teams.

4.2.16 Examine and utilize remote management tools. Utilize management tools designed to track the status of the critical IT applications, networks and infrastructure which will offer real time alerting, generate critical reports, monitor and assess performance and operating effectiveness and provide smart analytics that help understand the data. We need to send event data logs to a central location for storage to comply with audit requirements. The tool will allow the ability to monitor if server is up and running on the network and provides the ability to see if jobs are running correctly (are the internal IBM iSeries jobs being completed or have they shut down?) among other things. This tool will helps us improve response times, improve computing processes and manage the performance and availability of the application.

4.2.17 Utilize SysLog Tool. Tool that can generate Syslog data that can be easily understood by the Enterprise System Information and Event Management (SIEM) called Microsoft Sentinel currently in use at DFAS. This tool will provide a centralized logging system to track events and log data on server. System Logging Protocol will facilitate the transfer of information from network devices to a central server in a particular message format. This logging protocol is a crucial part of network monitoring as it helps track the overall health of network devices by simplifying log message management. It should allow a system administrator to monitor and manage logs from different parts of the system, to track events and errors, as well as provide information about system performance.

4.2.18 Assist in the testing of Security Technical Implementation Guides (STIGs) and the finding of solutions and resolution of open/non-compliant STIGs. Relocate servers to a new location in the case of data center closures.

4.2.19 Relocate servers to a new location when required due to DFAS/DISA requirements.

4.3 Managing User Account Permissions and Access Control:

4.3.1 Manage user access. Create user accounts and assign roles. Review the user account list periodically and remove any user accounts no longer needed. Check account permissions, to make sure they are appropriate for each user. It involves creating, modifying, and deleting accounts, assigning roles and privileges, and enforcing security policies. Manage resources and organize users according to their needs and roles. Identify user access control requirements. Establish a user access review process. Monitor user access activities. Ensure user access is revoked.

4.3.2 Create user profiles.

4.3.3 Reset passwords.

4.3.4 Generate and review reports.

4.3.5 Request and install new DoD SSL Certificate for the access to the system due every three (3) years; this should start happening in Mar 2027.

4.3.6 Establish and maintain user access policies and procedures. Review password security and policy and ensure the application of it. Implement security protocols.

4.4 Monitoring System Performance and Troubleshooting Issues:

4.4.1 Establish a baseline.

4.4.2 Set up notifications and reports.

4.4.3 When a new application or security change needs to happen, develop directions on how to setup and configure needs. Enhance performance optimization. Assist in identifying patterns indicative of imminent system failures.

4.4.4 Problem troubleshooting and support. Developing, documenting and testing recovery and problem procedures is required to minimize outage periods.

4.4.5 Operating System Monitoring. Track, measure, or observe the processes and operations on the servers. Monitor consistently. Use the collected data to draw conclusions about the health and condition of the server and ensure it reaches optimal performance. Monitor tape libraries. Monitor Journals. Monitor message queue. Track key metrics.

4.4.6 Use a monitoring tool of our selection that detects issues and begin to triage the issue without DFAS having to alert them of the problem. Determine how to respond based on the severity of the issue. Please see Attachment 5.

4.5 Performing Regular Backups and Disaster Recovery Planning

4.5.1 IBMi BRMS backup management/Backing Up and Restoring IBMi servers

4.5.2 Configuring/Defining iSeries Certificates

4.5.3 Monitoring Tape Backup

4.5.4 Implement IBM enterprise extenders.

4.5.5 Monitor system backups, enterprise extenders and recovery. Keep servers and line-of-business applications up to date and protected from data loss. Test backups on a scheduled basis to ensure that the data is backed up, secured, and replicated onsite and offsite for maximum security.

4.6 Updating and Patching Software

4.6.1 OS System Updates and software patches

4.6.2 Install software. Stay on top of software life cycles to ensure latest patches are done on a timely manner.

4.7 Collaborating with other IT teams to support overall infrastructure

4.7.1 Assist DFAS and DISA with any technical IBMi OS support from Vendors.

4.7.2 Call meetings and support troubleshooting efforts. Provide support directly to end users, and may also serve as a liaison between internal teams and external teams like DISA, DFAS Network Team and CSSP. Brainstorm and collaborate with various stakeholders to play an active role in the selection, configuration, and implementation of application systems.

4.8 Security Administration

4.8.1 Manage the server’s security policy. Evaluate server security policies to make sure that they are current and functioning and suggest changes as necessary. Ensure compliance with regulations.

4.8.2 Installs, configures, troubleshoots, and maintains server…