APO PWS_29 Sept 2026.pdf

FINANCIAL SYSTEMS BRANCH PROGRAM

MANAGEMENT OFFICE (PMO) AFLCMC/GBGQ

WPAFB, OH 45433-5755

PERFORMANCE WORK STATEMENT (PWS)

FOR THE

AUTOMATED PROJECT ORDER (APO) SYSTEM

CONTRACT NUMBER: TBD

29 September 2026

TABLE OF CONTENTS

1.0 DESCRIPTION OF SERVICES AND GENERAL INFORMATION

1.1 INTRODUCTION

1.1.1 Organization

1.1.2 Mission

1.1.3 Background

1.1.4 Operating Environment

1.1.5 Scope of Work

1.2 PROGRAM MANAGEMENT

1.2.1 Program Management Plan (PMP)

1.2.2 Kickoff Meeting

1.2.3 Monthly Status Report (MSR)

1.2.4 Integrated Master Schedule (IMS)

1.2.5 Meeting Minutes

1.3 APPLICATION SUSTAINMENT

1.3.1 Help Desk Support

1.3.2 Issue Tracking and Reporting

1.3.3 Software Releases

1.4 TECHNICAL REQUIREMENTS

1.4.1 Technical Reviews and SEP Documentation

1.4.2 Technical Interchange Meetings (TIMs)

1.4.3 Briefings

1.4.4 System Integration and Specifications

1.4.5 System Testing

1.5 DOCUMENTATION/PRODUCT SUPPORT

1.5.1 Data Accession List (DAL)

1.5.2 Technical Reports (Study/Services)

1.6 CYBERSECURITY

1.6.1 Information Technology Cybersecurity

1.6.2 Application Cybersecurity

1.6.3 Personnel Information Assurance

1.7 EXPERTISE

1.7.1 APO Sustainment Skills

1.7.2 Technical Stack and Platform Expertise

1.8 ADMINISTRATIVE CONSIDERATIONS

1.8.1 Security Compliance

1.8.2 Contractor In-Processing

1.8.3 System and Network Authorization Access Requests (SAAR)

1.8.4 Access to Government Facilities

1.8.5 Points of Contact

1.8.6 Place of Performance

1.8.7 Hours of Work

1.8.9 Contractor Performance Assessment Report (CPAR)

1.8.10 Transition Plan

1.9 GENERAL INFORMATION

1.9.1 Deliverable Submission and Quality

1.9.2 Service Contract Reporting (SCR)

1.9.3 Delivery Instructions

1.9.4 Inspection and Acceptance

1.9.5 Procedures for Payment

1.9.6 Combating Trafficking in Persons

1.9.7 Emergency Operations

1.9.8 Mission Essential Services Determination

1.9.9 Safety and Voluntary Protection Program (VPP)

2.0 SERVICES SUMMARY (SS) MATRIX

3.0 DEFENSE INFORMATION SYSTEMS AGENCY (DISA) SERVICES

3.1 Facilities and Environment Access

3.2 Automated Project Order (APO/J025A) System Environments

3.2.1 Production Environment

3.2.2 Test Environment

3.2.3 Development Environment

3.3 Federal and Industry Standards

4.0 APPENDICES

APPENDIX 1: CONTRACT DATA REQUIREMENTS LIST (CDRL)

APPENDIX 2: INFORMATION ASSURANCE REFERENCES

APPENDIX 3: ACRONYMS

1.0 DESCRIPTION OF SERVICES AND GENERAL INFORMATION

1.1 INTRODUCTION

1.1.1 Organization

The requesting organization is the Business Enterprise Systems Directorate, Core Financial Systems

Branch, Air Force Life Cycle Management Center (AFLCMC)/GBGQ, 4225 Logistics Avenue, Wright-

Patterson Air Force Base (WPAFB), OH 45433-5755.

1.1.2 Mission

The Automated Project Order (APO) system, designated as J025A, electronically processes Air Force

Materiel Command (AFMC) Project Orders for the Air Logistics Complexes (ALCs).

1.1.3 Background

APO automates the AFMC Project Order process (AFMC Form 181). It establishes Cost Authority (CA) and is utilized by the Defense Finance and Accounting Service (DFAS) to validate fund availability to obligate Depot Purchased Equipment Maintenance (DPEM) appropriated funds. The system ensures financial integrity by verifying that sufficient budgetary authority and customer funding are available before work is accepted at the ALCs.

APO interfaces with the Base Level General Accounting and Finance System (GAFS/BQ) to signal authorized users to commit and obligate funds and secures confirmations from the executing financial systems. It also interfaces with the Defense Industrial Financial Management System (DIFMS), the Job

Order Production Master System (G004L/JOPMS), and the Execution and Prioritization of Repairs

Support System (D087X/EXPRESS). APO provides web-based data access to approximately 400 authorized users at HQ AFMC, the ALCs, the Aerospace Maintenance and Regeneration Group

(AMARG), and DFAS operating locations.

1.1.4 Operating Environment

APO resides on an IBM mainframe hosted at the Defense Information Systems Agency (DISA) Defense

Enterprise Computing Center (DECC) in Ogden, Utah. Additionally, an Air Force-maintained web service at WPAFB provides help files and application menus. The APO system architecture utilizes IBM

JCL, COBOL, CA-IDEAL, HTML, and JavaScript, supported by a CA Datacom database.

1.1.5 Scope of Work

The Contractor shall provide system operations, maintenance, sustainment, testing, configuration management, software documentation, error correction, Tier I and Tier 2 help desk support for the APO system.

The Contractor shall:

• The Contractor shall participate in each Functional Review Board and shall assist the

Government in performing configuration audits of APO. When necessary, the Contractor shall participate in discussions involving Baseline Change Request (BCR), System Change Request

(SCR) and Deficiency Reports (DR) to development a Corrective Action Plan (CAP) to address which methods/steps will be used to implement/correct the issue.

• Provide qualified technical staff with expertise in CA-IDEAL, COBOL, HTML, JavaScript, and

IBM JCL, as well as the functional business processes of the APO.

• Implement and maintain Configuration Management (CM) for all software assets in accordance with the AFLCMC/GBB Configuration Management Plan (CMP) and the APO CMP Addendum.

• Formulate and deliver all required Systems Engineering Process (SEP) documentation across all phases of the system lifecycle (Define Need, Design, Build & Test, Release & Support), as tailored by the Systems Engineering Process (SEP) Tailoring Worksheet for Sustainment for

Automated Project Order (APO) (J025A) System.

• APO resides on a DISA mainframe and is accessed via the Non-Secure Internet Protocol Router

Network (NIPRNet). The Contractor shall coordinate with DISA personnel to troubleshoot system interruptions

• Conduct Component Validation and Integration (CV&I) testing of all impacted software modules prior to delivery to Government Acceptance Testing (GAT).

Support Risk Management Framework (RMF) cybersecurity compliance, Financial

Improvement and Audit Readiness (FIAR) audits (as required), and system vulnerability remediation activities under the direction of the Government Information System Security

Manager (ISSM). When necessary, the Contractor shall assist in the development of a Corrective

Action Plan (CAP) to address which methods/steps will be used to correct the issue.

• Transition and Decommissioning Plans. APO has a planned sunset date, if the system sunsets before the completion of the requirements of this PWS, the contractor shall provide/support the government’s efforts to shut down and migrate system data into the gaining system . The contractor shall support decommissioning plans and efforts that accommodate APO.

• Mission Essential: Not Applicable

• Foreign National Workers: Prohibited

1.2 PROGRAM MANAGEMENT

1.2.1 Program Management Plan (PMP)

The Contractor shall develop, implement, and maintain a comprehensive Program Management Plan

(PMP). The PMP shall detail the Contractor's methodology for project planning, resource control, Quality

Assurance (QA), risk management, and requirements change management.

• Deliverable: Program Management Plan (CDRL A001)

1.2.2 Kickoff Meeting

Within 30 calendar days of the contract effective date, the Contractor shall participate in a kickoff meeting with the Government PMO. The Contractor shall prepare and deliver technical presentation materials to clarify the scope of work, outline initial schedules, and introduce key personnel.

• Deliverable: Presentation Materials (CDRL A002)

1.2.3 Monthly Status Report (MSR)

The Contractor shall deliver a written Monthly Status Report (MSR) summarizing contract activities. The report shall detail:

• Work performed during the reporting period and plans for the subsequent month.

• Status of deliverables, action items, risks, and financial execution.

• Help Desk metrics (total calls, severity level categorization, resolution times, and outstanding tickets).

• Deficiency Reports (DRs) and Action Items opened in the Information System Management Tool

(ISMT).

• As part of contract closeout, a comprehensive inventory of all Government-furnished property and Contractor-developed materials in the Contractor's possession.

• Deliverable: Monthly Status Report (CDRL A003)

1.2.4 Integrated Master Schedule (IMS)

The Contractor shall establish, maintain, and deliver an Integrated Master Schedule (IMS) capturing all discrete tasks, milestones, resource assignments, and dependencies required for software releases and documentation baselines.

• Deliverable: Integrated Master Schedule (CDRL A004)

1.2.5 Meeting Minutes

The Contractor shall document proceedings, decisions, and action items for all official meetings and reviews, distributing approved minutes to all attendees within three business days.

• Deliverable: Meeting Minutes (CDRL A017)

1.3 APPLICATION SUSTAINMENT

1.3.1 Help Desk Support

The Contractor shall provide Tier 2 help desk support for the APO application during core hours (0800–

1700 ET, Monday through Friday, excluding federal holidays), utilizing the official Government-provided

APO support email. Tier 1 support (e.g., password resets) will be managed by DISA.

The Contractor shall respond to all user inquiries within two hours of receipt during core operating hours.

Technical support requests are categorized as follows:

• Critical (Severity 1): Issues severely degrading or disabling core APO functions (e.g., processing failures, system unavailability, or interface transfer blocks). The Contractor shall resolve Critical issues within three calendar days of initial identification.

• Non-Critical (Severity 2): Functional issues where a work-around exists. These requests will be scheduled for resolution in a future software release.

1.3.2 Issue Tracking and Reporting

The Contractor shall utilize the Government-furnished ISMT to record, track, and manage all system discrepancies and deficiency reports. The Contractor shall maintain complete and accurate records within the tool, including technical descriptions, severity ratings, assignment details, actions taken, and supporting diagnostic artifacts (such as screenshots).

1.3.3 Software Releases

The Contractor shall plan, build, test, and deliver one annual software release to production no later than the third quarter of each contract year.

1.4 TECHNICAL REQUIREMENTS

1.4.1 Technical Reviews and SEP Documentation

The Contractor shall prepare technical content and present system maturity at designated milestones in accordance with the Systems Engineering Process (SEP) Tailoring Worksheet. Mandatory reviews and associated documentation baselines include:

• Define Need Phase (Systems Requirements Review - SRR): Draft Software Requirements

Specification (SRS) and Requirements Traceability Matrix (RTM).

• Design Phase (Preliminary & Critical Design Reviews - PDR/CDR): Software Design

Description (SDD), updated SRS, updated RTM, and Software User Manual (SUM).

• Build & Test Phase (Test Readiness Review - TRR): Software Test Description (STD), finalized RTM, Computer Software Product End Item Documentation (CSPEID), and draft

Software Test Report (STR).

• Release & Support Phase (Full Deployment Decision - FDD): Finalized versions of all system and lifecycle documentation.

• Deliverable: Presentation Materials (CDRL A002)

1.4.2 Technical Interchange Meetings (TIMs)

The Contractor shall participate in TIMs, Integrated Product Team (IPT) reviews, and Working Groups with Government stakeholders and external partners to align technical designs with system requirements.

1.4.3 Briefings

The Contractor shall prepare and deliver technical briefings and status updates to the PMO during all milestone reviews and scheduled technical meetings.

• Deliverable: Presentation Materials (CDRL A002)

1.4.4 System Integration and Specifications

1.4.4.1 Requirements Traceability Matrix (RTM)

The Contractor shall develop and maintain an RTM verifying that all system requirements are mapped to design elements, software modules, and testing procedures.

• Deliverable: Requirements Traceability Matrix (CDRL A005)

1.4.4.2 Software Requirements Specification (SRS)

The Contractor shall deliver a detailed SRS for each release, uniquely identifying and defining all functional, interface, and system requirements.

• Deliverable: Software Requirements Specification (CDRL A006)

1.4.4.3 Software Design Description (SDD)

The Contractor shall deliver an SDD detailing the architectural and database changes required to satisfy approved Software Change Requests (SCRs) and Deficiency Reports (DRs).

• Deliverable: Software Design Description (CDRL A007)

1.4.4 System Testing

1.4.4.1 Software Test Plan (STP)

The Contractor shall document the overarching verification, validation, and testing methodology in a

Software Test Plan.

• Deliverable: Software Test Plan (CDRL A008)

1.4.4.2 Software Test Description (STD)

The Contractor shall provide detailed test cases, test scripts, and expected outcomes specific to each release prior to commencing formal testing.

• Deliverable: Software Test Description (CDRL A009)

1.4.4.3 Software Test Report (STR)

The Contractor shall perform Component Validation and Integration (CV&I) and regression testing, support Government Acceptance Testing (GAT) test case preparation, and document all test results and delivery recommendations in a STR.

• Deliverable: Software Test Report (CDRL A010)

1.4.4.4 Computer Software Product End Item Documentation (CSPEID)

The Contractor shall deliver the physical software delivery package, containing all modified source code, final release documentation, and logical/physical database schemas.

• Deliverable: Computer Software Product End Item Documentation (CDRL A011)

1.4.4.5 Software Version Description (SVD)

The Contractor shall deliver an SVD detailing the precise inventory of software components, changes, and operational workarounds included in each release.

• Deliverable: Software Version Description (CDRL A012)

1.4.4.6 Software User Manual (SUM)

The Contractor shall maintain and deliver updated electronic SUM files and help documentation prior to each application release.

• Deliverable: Software User Manual (CDRL A013)

1.5 DOCUMENTATION/PRODUCT SUPPORT

1.5.1 Data Accession List (DAL)

The Contractor shall maintain and deliver a cumulative Data Accession List (DAL) cataloging all internal technical data, studies, and engineering assets generated under this contract, and shall deliver indexed files upon Government request.

• Deliverable: Data Accession List (CDRL A014)

1.5.2 Technical Reports (Study/Services)

The Contractor shall conduct engineering studies, technology evaluations, and process analyses as directed by the PMO, delivering findings in structured technical reports.

• Deliverable: Technical Reports (CDRL A015)

1.6 CYBERSECURITY

All activities, systems, and software delivered under this contract shall comply with the latest versions of

Federal, Committee on National Security Systems (CNSS), Department of Defense (DoD), and

Department of the Air Force (DAF) cybersecurity directives and publications, including NIST SP 800-

Series Special Publications, CNSSI 1253, DoD 8500-Series Publications, and Air Force 17-Series

Publications.

The Contractor shall integrate cybersecurity requirements into the overarching Systems Engineering

Process (SEP), ensuring full traceability of cybersecurity controls within the RTM and aligning security https://csrc.nist.gov/publications/sp https://csrc.nist.gov/publications/sp https://www.cnss.gov/CNSS/issuances/Instructions.cfm engineering milestones with the IMS.

1.6.1 Information Technology Cybersecurity

The Contractor shall support the Assess and Authorize (A&A) and Assess Only processes in compliance with AFI 17-101 (Risk Management Framework for Air Force IT). The Contractor shall input security design parameters, interface definitions, and security control implementation data into the Enterprise

Mission Assurance Support System (eMASS).

The Contractor shall:

1. Implement and document all applicable DISA Security Technical Implementation Guides

(STIGs) and Security Requirements Guides (SRGs) for all system components. Authoritative

STIG requirements shall be retrieved from the DISA DoD Cyber Exchange.

2. Coordinate with DISA and host enclave administrators to implement, verify, and troubleshoot security patches, Time-Compliance Network Orders (TCNOs), Information Assurance

Vulnerability Alerts (IAVAs), and Critical Patch Updates (CPUs) in compliance with Technical

Order 00-33A-1109.

3. Ensure all deliverables meet standard Public Key Infrastructure (PKI) and Public Key (PK)

Enabling mandates in accordance with DoDI 8520.02.

4. Support incident response workflows in accordance with AFI 17-203 (Cyber Incident Handling) and remanence security compliance under DAFMAN 17-1301 Computer Security

(COMPUSEC).

1.6.2 Application Cybersecurity

The Contractor shall ensure all software deliverables comply with the DISA Application Security &

Development STIG. The Contractor shall:

1. Perform static code analysis (source code analysis) and dynamic testing using Government-approved automated tools.

2. Ensure software integrity by performing one-way hashing of software components utilizing FIPS

140-2 compliant cryptographic algorithms to prevent unauthorized modification.

3. Map all automated security tool findings directly to DISA STIG identifiers within the delivered test documentation.

1.6.3 Personnel Information Assurance

The Contractor shall ensure all personnel performing cybersecurity or system administration functions maintain active, industry-standard certifications in accordance with DoDM 8140.03 (Cyber Workforce

Framework (DCWF)) and DAFMAN 17-1305

Specific training and certification requirements include:

1. Cybersecurity Workforce (DCWF): All personnel assigned to Information Assurance

Technical (IAT) or Information Assurance Management (IAM) positions must meet baseline and operating system certification requirements prior to being granted system access.

http://www.e-publishing.af.mil/ https://public.cyber.mil/stigs/ http://www.e-publishing.af.mil/ http://www.e-publishing.af.mil/ https://public.cyber.mil/stigs/

2. Software Developers/Programmers: Personnel in non-senior development roles shall complete

40 hours of annual training covering cybersecurity and relevant programming languages.

3. Senior Technical Roles: Personnel designated as senior software developers, consultants, or senior testers shall be certified as Information Assurance System Architect and Engineer (IASAE)

Level II in accordance with DoDM 8140.03

1.7 EXPERTISE

1.7.1 APO Sustainment Skills

The Contractor shall provide personnel possessing the professional credentials, technical skills, and functional business experience required to:

• Analyze, design, implement, and maintain the APO system.

• Translate functional business processes into technical specifications.

• Conduct unit testing, regression testing, and document test scenarios.

• Author and update all engineering, technical, and user documentation.

• Develop, maintain, and modify complex financial and database reports.

1.7.2 Technical Stack and Platform Expertise

Contractor personnel shall possess documented, active proficiency in the following technologies:

• Hardware: IBM Mainframe Systems, Microsoft Windows Web Servers.

• Operating Environments & Platforms: CICS, MVS, TSO.

• Languages & Database Systems: COBOL, IBM JCL, CICS, QUIKJOB, CA-IDEAL, CA

Datacom-DB, DATAQUERY, JavaScript, and HTML.

1.8 ADMINISTRATIVE CONSIDERATIONS

1.8.1 Security Compliance

The Contractor shall ensure all personnel possess the required SECRET security clearances and favorably adjudicated background investigations prior to performing work.

1. Physical and Logical Access: Access to federal facilities, sensitive data, and DoD information systems requires a favorably adjudicated Tier 1 investigation (formerly National Agency Check with Written Inquiries - NACI) at a minimum, which is also required for Common Access Card

(CAC) issuance.

2. IT Level Classifications: Personnel requiring IT Level designations above Level III shall comply with DoDM5200.02/DAFMAN 16-1405 Department of the Air Force Personnel Security

Program. and Defense Information System for Security (DISS) regulations.

3. Non-U.S. Citizens: Network and installation access by non-U.S. citizens is prohibited.

4. Adjudication Failures: If an employee’s investigation is unfavorably adjudicated, the Contractor shall immediately revoke system access and return all Government-furnished equipment, identification, and data assets to the Government Security Office.

1.8.2 Contractor In-Processing

The Contractor's Facility Security Officer (FSO) shall submit Visit Authorization Requests (VARs) via the Defense Information System for Security (DISS) to SMO Code WE1MFHYN6 for classified efforts, or via company letterhead to the AFLCMC/GB Security Office for unclassified efforts, prior to personnel reporting for duty.

1.8.2.1 Common Access Card (CAC)

The Government will issue CACs to Contractor personnel who require routine physical access to WPAFB or logical access to the DAF network.

• Contractor personnel shall wear and prominently display their CAC badges at all times while on

Government installations.

• Contractor personnel shall identify themselves as contractors in all communications (emails, phone calls, meetings).

• Upon employee separation or contract completion, the Contractor shall return the issued CAC to the local Government Security Office within seven business days.

1.8.3 System and Network Authorization Access Requests (SAAR)

Contractor personnel requiring logical network access shall submit a completed DD Form 2875 (System

Authorization Access Request - SAAR) along with proof of completed annual cybersecurity training.

1.8.4 Access to Government Facilities

Unescorted access to Government facilities is prohibited until a favorable background investigation is adjudicated or a commander-signed waiver is executed. Contractors are prohibited from escorting other contractor personnel.

1.8.4.1 Operations Security (OPSEC)

The Contractor shall implement and maintain an OPSEC program throughout the contract lifecycle. The

Contractor shall ensure all personnel participate in the unit’s OPSEC training and protect critical information assets identified on the Government-provided Critical Information List.

1.8.4.2 Mandatory Training

The Contractor shall ensure all personnel complete the following mandatory Government training courses annually, or as prescribed by DAF directives:

• CyberAwareness Challenge (Course ZZ133098)

• Force Protection Training (Course ZZ133079)

• Controlled Unclassified Information (CUI) Training (Course ZZZ2021CUI)

1.8.5 Points of Contact

• Program Manager (PMO): AFLCMC/GBGQ, 200E Moore Dr., B856 Room 201, Maxwell

AFB- Gunter Annes, Montgomery, AL 36114

• Contracting Office (CO): AFLCMC/GBKGF, 1900 Founders Drive, Kettering, OH 45420

1.8.6 Place of Performance

Primary performance shall be at WPAFB, OH. Alternative performance at Maxwell AFB, Gunter Annex, AL, or via telework may be authorized by the Government Program Manager. The Government will provide standard workspace, telephone, and a standard desktop configuration (SDC) computer system for on-site personnel.

1.8.7 Hours of Work

Core working hours are Monday through Friday, 0700–1800 EST or 0600–1700 CST, excluding federal holidays.

1.8.8 Special Provisions

1.8.8.1 Section 508 Compliance

All Electronic and Information Technology (EIT) deliverables under this contract shall comply with

Section 508 of the Rehabilitation Act (20 U.S.C. § 794d) and 36 CFR Part 1194, unless explicitly exempted by the Government due to undue burden or specific operational conditions.

1.8.8.2 Contractor Identification

Contractor personnel shall wear standard corporate identification badges indicating their name and employer while on Government installations, and clearly identify themselves as contractors in all professional interactions.

1.8.9 Contractor Performance Assessment Report (CPAR)

In accordance with RFO 42.1102, the Government will evaluate Contractor performance using the

Contractor Performance Assessment Reporting System (CPARS).Go. Key evaluation criteria include

Quality of Product or Service, Schedule Adherence, Business Relations, and Management of Key

Personnel.

1.8.10 Transition Plan

The Contractor shall deliver a Transition Plan to ensure seamless service continuity during phase-in and phase-out periods.

• Deliverable: Transition Plan (CDRL A016) https://www.section508.gov/

1.9 GENERAL INFORMATION

1.9.1 Deliverable Submission and Quality

All deliverables shall be submitted on the Prime Contractor’s letterhead in a format fully compatible with the Government’s Standard Desktop Configuration (SDC). The Contractor shall proactively report technical or schedule risks to the Contracting Officer’s Representative (COR) and PMO.

1.9.2 Service Contract Reporting (SCR)

In accordance with 10 U.S.C. § 2330a and RFO subpart 4.303, the Contractor shall report all required service contract data annually via the System for Award Management (SAM) at www.sam.gov for all service portfolios exceeding $3,000,000.00.

1.9.3 Delivery Instructions

All CDRL deliverables shall be submitted electronically with a formal cover letter to the Government

PM, Contracting Officer (CO), and COR in accordance with the schedules and instructions specified on the DD Form 1423.

1.9.4 Inspection and Acceptance

The Government will inspect, review, and accept or reject all CDRL deliverables in accordance with the specific criteria set forth on the DD Form 1423.

1.9.5 Procedures for Payment

Billing and invoicing shall be submitted monthly in accordance with the contract terms and processed via the Wide Area Work Flow (WAWF) system. All invoices must be accompanied by COR-certified acceptance documentation and receipts for authorized expenses.

1.9.6 Combating Trafficking in Persons

The Contractor shall strictly adhere to FAR Clause 52.222-50 (Combating Trafficking in Persons). The

COR will monitor compliance, and any infractions shall be reported immediately to the CO. Additional information is available on the DoD Inspector General website.

1.9.7 Emergency Operations

In the event of a declared emergency or modified base operating status at WPAFB, the Contractor shall implement alternate work schedules as directed by the CO or COR, not to exceed a 40-hour work week unless formally authorized.

1.9.8 Mission Essential Services Determination

In accordance with DoDI 3020.37, this requirement has been determined to be non-essential; services are not required to continue during a crisis.

https://www.sam.gov/ http://www.dodig.mil/Inspections/IPO/combatinghuman.htm

1.9.9 Safety and Voluntary Protection Program (VPP)

The Contractor shall comply with all OSHA regulations and coordinate safety practices with the installation's Voluntary Protection Program (VPP). Detailed guidelines are available on the OSHA VPP

Portal.

http://www.osha.gov/dcsp/vpp/index.html http://www.osha.gov/dcsp/vpp/index.html

2.0 SERVICES SUMMARY (SS) MATRIX

The Contractor's performance will be measured against the following critical Performance Objectives, Standards, and Acceptable

Quality Levels (AQLs), which will serve as the basis for the Government’s Quality Assurance Surveillance Plan (QASP).

Performance

Objective

Performance Threshold/ Standard PWS

Paragraph

Reference

Remedies

Timeliness of

DELIVERABLES

(T)

All deliverables delivered on time per the

PWS

Excellent: 99% ≤ T ≤ 100%

Satisfactory: 97% ≤ T < 99%

Unsatisfactory: T < 97%

Refer to Section 4, APPENDIX A:

Contract Data

Requirements

List

The Contractor achieves an excellent performance rating when the CDRLs are delivered before the due dates listed in the applicable Contract Data Requirements List.

Deliverables at T<97% remedy requires submission within 4 days unless waived by

Government.

Contractor performance may be reflected in the CPAR

Quality of

DELIVERABLES

1. Complete

2. Accurate

3. Correct

Format

Performance is excellent when ≥96% of total deliverables meet quality standards and the entire remainder are updated and delivered as specified by the Contracting

Officer.

Performance is satisfactory when ≥94% of total deliverables meet quality standards and the entire remainder are updated and delivered as specified by the

Contracting Officer.

Performance is unsatisfactory when

<94% of total deliverables meet quality standards or any of the remainders are not updated and delivered as specified by the

Contracting Officer.

Refer to Section 4, APPENDIX A:

Contract Data

Requirements

List

The Contractor achieves an excellent, satisfactory or unsatisfactory performance rating when the performance standard identified in 2nd column in this table is met.

When the Deliverables quality falls below

94%, the remaining 6% must be updated and delivered within 7 days or unless waived by the

Government.

Contractor performance may be reflected in the

CPAR.

Help Desk Trouble

Ticket

Performance

Standard (HD)

1. Problem

Reporting

2. Problem

Correction

3. Timely

Response

Respond to user help desk request within 2 hours during normal help desk hours

Level 1 tickets closed within 2 working days.

Level 2 tickets closed within 3 working days.

Level 3 tickets closed within 30 working days.

Excellent: HD = 100%

Satisfactory: 95% ≤ HD < 100%

Unsatisfactory: HD < 95%

1.3, 1.2.3 The Contractor achieves an excellent, satisfactory or unsatisfactory performance standard when the performance standard identified in 2nd column in this table is met.

When the Help Desk performance standard quality falls below 95%, the remaining 5% must be corrected within 7 days or unless waived by the Government.

Contractor performance may be reflected in the

CPAR.

Software Release(s)

(R)

Performance is excellent when at least One release is deployed to production no later than

3rd quarter of each Contract year and one or more additional releases is deployed within the same

Contract year

Performance is satisfactory when One release is deployed to production no later than 3rd quarter of each Contract year

Performance is unsatisfactory when a release has not been deployed to production no later than 3rd quarter of each Contract year

1.3.3 The Contractor achieves an excellent, satisfactory or

unsatisfactory performance when the performance standard identified in 2nd column in this table is met.

Release(s) deployed later than the 3rd quarter of a contract year are given up to two additional weeks after the 3rd quarter ends to deploy into production unless waived by Government.

Contractor performance may be reflected in the

CPAR.

Software Quality (Q) Performance is excellent when a release is deployed to production with no priority 1, 2, or

3 Deficiency Reports (DRs)

Performance is satisfactory when a release is deployed to production with no priority 1 or 2

DRs and no more than 2 priority 3 DRs

Performance is unsatisfactory when a release is deployed to production with a priority 1 or 2 DR, or more than 2 priority 3 DRs.

1.3.3 The Contractor achieves an excellent, satisfactory or

unsatisfactory performance rating when the performance standard identified in 2nd column in this table is met. If a release is deployed into production with a rating less than satisfactory, the Contractor quality level has within two weeks after the actual release date of each Contract year to be fixed unless waived by Government to deploy a release at or above

“no priority 1 or 2 DRs and no more than 2 priority 3

DRs”

3.0 DEFENSE INFORMATION SYSTEMS AGENCY (DISA) SERVICES

3.1 Facilities and Environment Access

The Government will provide the Contractor with supervised and unescorted logical access to all necessary computing environments, databases, and physical facilities required to perform the tasks defined in this contract, subject to the timely submission of security and access documentation.

3.2 Automated Project Order (APO/J025A) System Environments

3.2.1 Production Environment

The Contractor is authorized logical access to the APO production environment for system operations, maintenance, and approved software deployments. All production access shall be scheduled and coordinated through the Government PM and COR.

3.2.2 Test Environment

The Contractor is authorized access to the APO test environment to perform integration testing, validation, and support

Government Acceptance Testing (GAT) in alignment with the release schedule.

3.2.3 Development Environment

The Contractor is authorized to access the APO development environment to design, write, unit-test, and update software modifications and fixes.

3.3 Federal and Industry Standards

The Contractor shall perform all work in strict accordance with the Systems Engineering Process (SEP), AFMC policies, DoD software development standards, Federal Information Processing Standards (FIPS), and applicable IEEE software engineering standards.

4.0 APPENDICES

APPENDIX 1: Contract Data Requirements List (CDRL)

The following CDRLs details the specific deliverables, references, and Data Item Descriptions (DIDs) required under this contract.

CDRL # Title PWS Reference DID Number

A001 Program Management Plan (PMP) 1.2.1 DI-MGMT-8004A

A002 Presentation Materials 1.2.2, 1.4.1, 1.4.3

DI-ADMN-81373

A003 Monthly Status Report (MSR) 1.2.3 DI-MGMT-80368A

A004 Integrated Master Schedule (IMS) 1.2.4 DI-MGMT-81650

A005 Requirements Traceability Matrix (RTM) 1.4.4.1 DI-IPSC-81433A/T

A006 Software Requirements Specification (SRS) 1.4.4.2 DI-IPSC-81433A

A007 Software Design Description (SDD) 1.4.4.3 DI-IPSC-81435A

A008 Software Test Plan (STP) 1.4.4.1 DI-IPSC-81438A

A009 Software Test Description (STD) 1.4.4.2 DI-IPSC-81439A

A010 Software Test Report (STR) 1.4.4.3 DI-IPSC-81440A

A011 Computer Software Product End Item (CSPEID) 1.4.4.4 DI-MCCR-80700

A012 Software Version Description (SVD) 1.4.4.5 DI-IPSC-81442A

A013 Software User Manual (SUM) 1.4.4.6 DI-IPSC-81443A

A014 Data Accession List (DAL) 1.5.1 DI-MGMT-81453A

A015 Technical Reports 1.5.2 DI-MISC-80508B

A016 Transition Plan 1.8.10 DI-IPSC-81429A

A017 Meeting Minutes 1.2.5 DI-ADMN-81505

APPENDIX 2: Information Assurance References

The Contractor shall adhere to the latest publications of the following regulatory guidelines:

AFI 10-701 Operations Security (OPSEC)

AFI 16-1404 Air Force Information Security Program.

AFI 17-101 Risk Management Framework (RMF) for Air Force IT

AFI 17-201 Command and Control (C2) for Cyberspace Operations

AFI 17-203 Cyber Incident Handling

AFI 33-332 Air Force Privacy and Civil Liberties Program

DAFMAN 17-

Computer Security (COMPUSEC)

DoDM

5200.02/DAFMAN

16-1405

Department of the Air Force Personnel Security Program.

DoDM 5220.32

Vol 1/ DAFMAN

16-1406 Vol 1

National Industrial Security Program: Industrial Security

Procedures for Government Activities

DAFMAN 17-

DAF Cyberspace Workforce Cybersecurity Workforce

Management

DoDM 8140.03 Cyber Workforce Framework

DoDD 8500.01 Cybersecurity

DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling

FIPS Pub 140-3 Security Requirements for Cryptographic Modules

DISA STIGs Security Technical Implementation Guides

APPENDIX 3: Acronyms

ACOR Assistant Contracting Officer Representative

AFMC Air Force Materiel Command

AIS Automated Information System

AMARG Aerospace Maintenance and Regeneration Group

APO Automated Project Order

CAC Common Access Card

CCB Configuration Control Board

CDR Critical Design Review

CDRL Contract Data Requirements List

CMMI Capability Maturity Model Integration

CO Contracting Officer

COR Contracting Officer Representative(s)

COTS Commercial off The Shelf

CV&I Component Validation and Integration

CVS Contractor Verification System

DAA Designated Approving Authority

DDL Data Definition Language DECC Defense Enterprise Computing Center

DFAS Defense Finance and Accounting Service

DID Data Item Description

DIFMS Defense Industrial Financial Management System

DISA Defense Information Systems Agency

DPEM Depot Purchased Equipment Maintenance DR Deficiency Report

ECP Engineering Change Proposal

EXPRESS Execution and Prioritization of Repairs Support System

FIAR Financial Improvement and Audit Readiness

FISCAM Financial Information Systems Control Audit Manual

FISMA Federal Information Security Management Act

FM Financial Management

FMO Functional Management Office (AFMC/FMF)

FRB Functional Review Board

FRR Field Readiness Review

GAFS/BQ General Accounting and Finance System/BQ

GAT Government Acceptance Testing

GFE Government Furnished Equipment

HTML Hyper Text Markup Language

IA Information Assurance

IBM International Business Machines Corporation

IPT Integrated Product Team

ISCP Information System Contingency Plan

ISMT Information System Management Tool

ISSM Information System Security Manager

IAVM Information Assurance Vulnerability Management

JCL Job Control Language

JOPMS Job Order Production Master System

NAC National Agency Check

NACI` National Agency Check with Written Inquiries

NDAA National Defense Authorization Act

NIPRNet Non-Secure Internet Protocol Router Network

ODC Other Direct Cost

OI Operating Instruction

PDR Preliminary Design Review

PKI Public Key Infrastructure

PM Program Manager

PMO Program Management Office (AFLCMC/HIBQ)

PoP Period of Performance

PWS Performance Work Statement

QT&E Qualification, Test and Evaluation

RMF Risk Management Framework

ROM Rough Order of Magnitude

SAAR System Access Authorization Request

SaaS Software as a Service

SCR Software Change Request

SDC Standard Desktop Configuration

SEI Software Engineering Institute

SEP System Engineering Process

SFIS Standard Financial Information Structure

SLOA Standard Line of Accounting

SQL Structured Query Language

SRS Software Requirements Specification

STIG Security Technical Implementation Guide

TIM Technical Interchange Meeting

TRR Test Readiness Review

VAR Visit Authorization Request

WAWF Wide Area Work Flow

WPAFB Wright-Patterson Air Force Base