Atch 1_Draft PWS.docx

Program Executive Office USTRANSCOM (PEO-T)

Performance Work Statement (PWS)

For

TRANSCOM “Medical” Regulating and Command & Control Evacuation System (TRAC2ES)

11 May 2020 Version Number 1.0

UNCLASSIFIED

Table of Contents

iv

UNCLASSIFIED

1. Description of Services Background The United States Transportation Command (USTRANSCOM) provides global air, land, and sea transportation for the Department of Defense (DoD), both in times of peace and war through its Transportation Component Commands (TCCs): Air Mobility Command (AMC); Surface Deployment and Distribution Command (SDDC); and Military Sealift Command (MSC). USTRANSCOM provides synchronized transportation, distribution, and maintenance. Additionally, USTRANSCOM projects and maintains national power with the highest efficiency, the greatest speed and agility, and the most reliable level of trust and accuracy.

DOD Instruction (DoDI) 6000.11, Patient Movement, assigns the Commander of USTRANSCOM as the single manager for global patient movement and directs USTRANSCOM to develop and implement integrated patient movement regulation and evacuation processes. Joint Publication (JP) 4-02 provides the doctrinal foundation for the patient movement system and clarifies DoD policy for patient movement of contaminated, contagious, or potentially exposed casualties. USTRANSCOM Instruction (USTCI) 90-9, Roles and Functions, further assigns theatre patient movement requirements center processes and responsibilities to the USTRANSCOM Surgeon (TCSG) and clarifies USTRANSCOM policy for patient movement of contaminated, contagious, or potentially exposed casualties.

The TRANSCOM “Medical” Regulating and Command & Control Evacuation System (TRAC2ES) combines relevant doctrine, policies, processes, and procedures along with an automated decision support system to manage the DOD global patient movement process. TRAC2ES provides for patient movement monitoring, forecasting, and planning to support both fixed and deployable operations and includes medical regulating and patient evacuation. TRAC2ES provides in-transit visibility (ITV) and command & control decision support. TRAC2ES supports the Assistant Secretary of Defense for Health Affairs, the Joint Staff, Combatant Commanders, and USTRANSCOM during war, peace, contingencies, and operations other than war.

Objective The objective of this requirement is to provide software development support and expertise for TRAC2ES Non-Secure Internet Protocol Router (NIPR) & Secure Internet Protocol Router (SIPR) environments. This includes all software code and associated components and integrations. Software development support shall include any phase of the Software Development Lifecycle (SDLC), including concept development, planning, requirements elicitation and analysis, systems design and development, coding and testing, deployment, implementation, integration, troubleshooting, security posture, documentation, and software application maintenance and sustainment.

Responsibilities include managing the code baseline, the hosted environment, and system interfaces. The code baseline may change as a result of user preference, latent defects, change requests, security requirements, or updates to Commercial Off The Shelf (COTS) products used by the system. Additionally, the Contractor shall provide production support to include troubleshooting and resolving user problems as well as identifying opportunities to improve the system. Overall, software development support shall include all aspects of the SDLC necessary to sustain and modify the system baseline. The Contractor shall work closely with other members of the team to include Government Product Owners, engineers, security, and end-users.

Scope The purpose of this contract is to provide sustainment in order to maintain the existing TRAC2ES capabilities and ensure TRAC2ES remains operationally viable through its end of life. The Contractor shall utilize Agile software development methodology in support of TRAC2ES. The Contractor shall provide solution consulting and programming to: (1) sustain deployed capabilities by rapidly troubleshooting and repairing software issues (i.e. correct software defects); (2) provide technical expertise to ensure high availability of the application to meet the USTRANSCOM mission; (3) receive and respond to problems reported by system users (i.e. correct incidents); (4) improve the system’s security posture; (5) implement new system capabilities; and (6) implement change requests. The Contractor shall provide support in achieving the discipline of Development/Security/Operations (DevSecOps). This support shall include expertise in Continuous Integration/Continuous Deployment (CI/CD) and the use of software build pipelines.

Further, the Contractor shall provide expertise to maintain the TRAC2ES development environment in the USTRANSCOM NIPR cloud enclave and maintain the TRAC2ES non-production, and production environments in the USTRANSCOM NIPR cloud enclave.

The Government may require surge support during the base or any option period. Surge modifications will be within the scope of the contract and provide increased support for all the defined task areas of this PWS. This will be a priced optional task to expand the scrum team(s), and can be awarded in six (6) month increments. Surge support over the life of this contract will not exceed 20% of the Contractor’s total proposed cost/price for the base and all of the options, excluding any six (6) month extension of services pursuant to FAR 52.217-8.

The Contractor shall plan for all tasks (including Optional Tasks) identified in this PWS and gather all pertinent information. Contractor estimates and timelines shall be determined based on the deliverable due dates specified in Section 1.6. The Contractor shall coordinate with the Government to ensure that all activities are well synchronized and integrated with other USTRANSCOM and distribution management efforts. All reports, studies or policies identified in the PWS shall be prepared and submitted for Government approval or acceptance. All functions and activities shall be task driven and work performed shall be in accordance with (IAW) all applicable regulations and guidelines.

References All references to include electronic libraries can be found in Attachment 1, References. and is included with the Government Furnished Information (GFI).

Performance Requirements The Contractor shall use a Government owned Application Lifecycle Management (ALM) tool (e.g. Jira) to effectively manage and execute the Agile Scrum methodology to analyze requirements, decompose large requirements into logical sub artifacts, create user story level artifacts and technical specifications (i.e. Epics or large features must be decomposed into user stories), coordinate with the appropriate subject matter experts (both technical and functional) to receive approved acceptance criteria for Epic/Task/Subtask level artifacts, set story points and establish a waterline to, develop and test software, create test scripts and implement User Acceptance Testing (UAT), and keep artifact statuses updated (artifacts are the method for identifying a change with software which will be deployed into Production). To maintain predicable velocity, the developers should complete the artifacts they commit in each software sprint, and team members are encouraged to collaborate towards requirements completion. User stories and design documentation shall be maintained within the government provided ALM tool. The technical release documentation shall document all changes and procedures necessary to promote a release into production.

The Government will assign requirements to the Contractor for fulfillment via the Government provided ALM tool. Each assigned requirement will have one or more associated artifacts.

The software development sprint length will be mututally agreed to by the Government and result in software releases. The release cycle length shall not exceed 4 week durations/eight (8) weeks.

Task Area 1: Task Order Management

The Contractor shall provide the planning, direction, coordination, and control necessary to accomplish all requirements in this PWS. The Contractor shall designate key personnel responsible for the cost, schedule, and technical performance for the contract and shall serve as a primary Point of Contact (POC) for both management and technical matters. In addition, the Contractor shall participate in Program Management Reviews where the status of the work and associated deliverables are reviewed in the context of the business processes supported by the system.

Deliverables:

Task Order Management Plan (TOMP). The Contractor shall prepare a TOMP describing the technical approach, organizational resources, and management controls to be employed to meet requirements.

Product Roadmap. The Contractor shall maintain a product roadmap to plan out new system capabilities, functionality changes, system maintenance, and/or product upgrades. The product roadmap shall include current sprint, sprint+1, and sprint+2 at a minimum. The Contractor shall collaborate with the Government Product Owner to obtain the Government’s priority on software features and product updates.

Kick-Off Meeting (KOM) The Contractor shall attend a KOM with all partners to establish a baseline of understanding after the contract award or as directed by the Contracting Officer (KO) at a location to be determined by the COR within ten (10) business days of contract start. Participants will include Program Manager (PM), Government Technical Lead, KO, COR, and other key Contractor personnel and Government staff to include the TRAC2ES Functional Manager. At the KOM, the Contractor shall present the details of its intended approach and approximated project schedule for review and approval by the COR. The KOM will serve to resolve strategic questions, refine goals, define success, and explore the biggest challenges and breakthrough opportunities for the Government. This will be the beginning of a dialogue between the Government and the Contractor to ensure successful execution of this contract by the Contractor. The Contractor shall coordinate the agenda for the KOM and include, as a minimum, the following:

Introduction of management and technical teams Presentation of management plans and reports, technical issues, resolutions, and mitigation strategies Establishment of common understanding of the contract (i.e., Agile implementation, sprint length, etc.)

Other relevant items may be introduced at the discretion of the Contractor and/or the Government Deliverables:

KOM Agenda KOM Briefing Materials KOM Action Item Lists KOM Minutes Monthly Status Report (MSR) The Contractor shall provide an MSR that includes by task the financial, performance, system availability, and schedule status. The MSR will include proposed changes to the schedule as detailed in the management plan as well as property accountability, technical accomplishments, issues and risks, and planned activities for the next reporting period. Any issue requiring Government response or action shall be brought to the Government’s attention immediately upon identification, and status captured in monthly reports.

This report will contain the calls and artifacts received and the actions taken during the reporting period. It shall correlate actions taken to other tasks or solutions that address resolving the reason for the artifact. Since the artifacts are assigned via the Government ALM tool, and the Contractor will enter results into the Government ALM tool, metrics associated with the responsiveness, quantity, and duration of the artifacts will be extracted directly from the Government ALM tool. The status report shall include a cumulative tally of all artifacts assigned to the most recently completed release that have not been previously reported. This tally shall include the release identifier, total number of artifacts assigned to a release per category, the category (e.g. established within the ALM tool such as Requirement, Change Request (CR), Defect), and a total sum of total artifacts across all categories. Further, the report shall contain a sum of artifacts (per category and overall total) that were planned for each sprint (i.e. above the waterline after sprint planning using story points), as well as the sum of artifacts that are accepted in User Acceptance Testing (UAT) (per category and overall total) and placed into production with the scheduled release.

Deliverable:

Monthly Status Report (MSR) Integrated Product Team (IPT) Meetings The Contractor shall participate in IPT meetings at the place of performance or via telephone conference when directed by the Government (expected every two weeks). Meeting topics include, but are not limited to, updates on work in progress, requirements management, help desk issues, metrics, schedule updates, upcoming calendar events, and other pertinent issues. The Contractor shall provide IPT presentation material in a format compatible with Microsoft Office in a manner directed by the Government.

The Contractor shall:

a. Conduct Program Reviews. Meet with the TRAC2ES Program Manager quarterly to review status of work in progress, discuss any problems with current tasks, discuss assignment of future tasks, and obtain Government decisions or guidance necessary to facilitate or improve Contractor performance.

b. Conduct Technical Exchange Meetings. The Contractor shall schedule, facilitate and participate in technical exchange meetings (TEM) with the TRAC2ES Mission Partners or other interested parties. The focus of the meetings will be to convey technical/functional information regarding TRAC2ES capabilities, discuss identified issues with the existing operational baseline, or gather information to support enhancements/develop of new capabilities. The Contractor shall prepare agendas, presentation slides to aid discussions and minutes.

c. Deliver agenda, minutes, and presentation slides for all meetings the Contractor facilitates/leads or as directed by the Government. At a minimum, the minutes shall reflect meeting date, location, attendees, a record of current and planned activities, decisions made, and action items. Meeting agendas and slides shall be delivered to the Government within two business days prior to the meeting. If the Government determines revisions are necessary, the Contractor shall redeliver within five business days following Government request.

Contract Transition Prior to contract expiration, or in the event of a different Contractor winning a follow-on contract, the Contractor shall meet all transition requirements to include, at a minimum, all materials and support necessary to accomplish a seamless and expeditious transition of the tasks identified in this PWS to the incoming Contractor. The Contractor shall include electronic copies of the following: all in-progress working files, Concept of Operations (CONOPS) procedures, and final phase out meeting with Government, incumbent, and the new Contractor. The Contractor shall support a formal contract closeout process, including the documenting of lessons learned throughout the life of the contract. All deliverables shall be provided forty-five (45) business days before the end of the contract period of performance.

Deliverables:

Transition Plan In-Progress Working Files Concept of Operations (CONOPS) Procedures Lessons Learned System for Award Management (SAM) The Contractor shall report ALL direct Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract for USTRANSCOM via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address: https://beta.sam.gov/.

Reporting inputs will be for the labor executed during the period of performance during each Government Fiscal Year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each year. Contractors may direct questions to the help desk at: https://beta.sam.gov/.

The manpower reporting site associated with this contract is https://beta.sam.gov.

The Command of the Requiring Activity is AFELM USTRANSCOM.

The Unit Identification Code (UIC) for this requirement is FF0BD0.

The Federal Service Code for this contract is [TBD - depending on contract vehicle and work].

Task Area 2: Software Development Support This task includes responding to requirements that are generated by the Government through change requests, program, security, production support, or trouble reporting mechanisms. ALM artifacts are the method for identifying software changes, which will be deployed into the Production environment. The Contractor shall properly record user stories, associated acceptance criteria, issues, and software solutions to create a knowledge base within the Government’s ALM tool. The Contractor shall use Agile methodology and industry best practices such as test driven development, refactoring, and continuous integration. Applicable artifacts may include, but are not limited to requirements elicitation and decomposition, completion of user stories and specifications, software development, security code scans, unit testing, integration testing, and UAT. The Contractor shall use a microservices architecture for new code, and decouple monolithic legacy code when appropriate (e.g. failure isolation, multiple rates of change, simplify external dependencies, etc.) for long-term usability and scalability of the application. Additionally, the Contractor shall automate testing, security updates, configuration management, the software build process, etc. necessary to achieve CI/CD.

Deliverables:

Software. The primary deliverable of this task is software code, system configurations, database schemas, etc. All software code, system configurations, database schemas, etc. associated with this contract shall be the property of the Government and shall not contain any company proprietary markings, logos, or any distribution restrictions. Software code shall be installed on the Government’s Staging and Production servers and provided as a tagged code segment via the Government managed code repository and/or delivered on other mutually agreed upon format.

Release Documentation. As a minimum, this shall include a work plan with recurring updates, static code scans (e.g. Fortify scans), release test plan with results, UAT plan with test scripts, and contractor inputs to minor mod checklists (i.e. release notes), which include all artifacts with associated descriptions and solutions, and deployment instructions.

Updated Project Documents. Documentation sufficient to install, operate, and maintain the system shall be provided and maintained. These documents shall include updates to the product roadmap, COTS products, training manuals, user manuals, system installation procedures, and any supporting documents necessary for the Government to sustain the system.

Updated System Documents, Security Documents, White Papers. All solution changes shall be documented as user stories, technical specifications and/or diagrams, interface control documents, system configuration documents, and/or Department of Defense Architecture Framework (DoDAF) architectural artifacts. Additionally, documentation will be generated and maintained to support Static Code Analysis, the Risk Management Framework (RMF), Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), DoDI 8530.01, and the DoD Cloud Computing Security Requirements Guide.

Agile Software Development Support The Contractor shall respond to ALM artifacts to change the system, as prioritized and assigned by the Government Product Owner. The Contractor shall participate in and/or lead the Scrum process and other meetings to define, build, test, document, and deploy updates to the system baseline. The Contractor shall ensure ample lead-time for understanding and responding to unique change requests. The planning for requested functionality may include the Contractor’s recommendations to minimize rework and cost. If a change is beyond the Contractor’s capacity to complete within one sprint, the Contractor shall decompose the Epic and/or Features into smaller user stories, and update the schedule (i.e. product roadmap). Complex tasks may require additional planning before coding. These tasks are assigned to a sprint for development of a specification prior to the implementation sprint. The Contractor shall work with subject matter experts to create, and receive approval on, user stories and associated acceptance criteria, functional specifications and/or technical specifications. The Contractor shall support UAT for releases to ensure proposed changes are acceptable to users; and, when required, host release reviews for functional users to illustrate system changes. The Contractor shall assist with minor mod checklists (i.e. release notes); and shall provide necessary support to maintain and document the security posture of the application as required by RMF or applicable DoD accreditation processes.

Software Defect Support The Contractor shall immediately respond to escalated production support issues that cause work stoppage or operational problems with the system and ensure the Production system operates without interruption to functional users within the contractor’s span of control. Software defects that result in a work stoppage or impact to business operations shall result in an unplanned software Hot Fix. Correcting defects identified through production support that do not result in a work stoppage shall be prioritized and assigned to current sprint or a future sprint by the Government depending on the impact to business operations. The Contractor shall assist the production support activity in identifying the root cause of production support malfunctions and creating ALM artifacts (i.e. software code changes) to permanently resolve or prevent them. The Contractor shall input all actions taken to resolve artifacts into the Government ALM tool. The Contractor shall coordinate with production support to ensure minimal rework and downtime during software changes, and to ensure the production support activity understands planned system changes.

Commercial off the Shelf (COTS) Support The Contractor shall provide support services for changes in COTS products to include patches (e.g. application, operating system, database), upgrades, and/or migration to newer technologies. This will involve analyzing the system for incompatibilities and deprecated features. Once prioritized by the Government, the Contractor shall refactor the necessary code to ensure continued system stability. The refactoring shall be assigned to sprint(s) and follow the Agile SDLC process for integration and testing of refactored code.

Deployment Pipeline Support Once TRAC2ES is migrated and operational in the TRANSCOM [Unclassified or Classified] Government Cloud (TC-UGC or TC-CGC), the Contractor shall provide the expertise required to operate and maintain the Development, Non-Production, and Production environments to reliably and efficiently compile, build, test, and deploy code. This shall include maintaining virtual machines and components, such as servers, memory, firewalls, load balancers, and storage (i.e. databases). Additionally, the Contractor shall maintain and update the Ports, Protocols, and Services (PPS) information. This shall include ports for internal and external traffic as well as the source and destination IP Addresses information. Air Force Department of Defense (AF-DoD) approved PPS worksheet will be used; available on the PPS Management at http://intelshare.intelink.gov/sites/ppsm.

Static Application Security Testing (SAST) Support The Contractor shall run static code scans on the entire application using a Government approved code scan tool (e.g. Fortify) to prevent security vulnerabilities from being deployed into the production environment. The Contractor shall analyze code scan results, and remediate findings or provide rationale on false positives.

DOD Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) Compliance Support The Contractor shall register with the DISA STIG library https://cyber.mil/stigs/ to receive notifications for updates to ensure the application and supporting application technology (i.e. operating system, database, servers, etc.) complies with the most up-to-date version of the DODDoD SRGs and Application Security and Development STIGs. The Contractor shall remediate any non-compliant checklist items. The Contractor shall enter open STIG findings, along with fix actions, into the Government ALM tool.

Task Area 3: Implement New Operational Capability The Contractor shall respond to ALM artifacts (i.e. new requirements) to implement new capabilities in the system (i.e. different than implementing change requests to existing capabilities). New capabilities will focus on creating new/additional system operational activities. This task shall include all Agile SDLC activities to support implementing new capabilities. The Contractor shall properly record user stories, associated acceptance criteria, issues, and software solutions to create a knowledge base within the Government’s ALM tool. The Contractor shall use the Scrum framework, extreme program engineering practices, and a microservices architecture when completing artifacts to include: requirements elicitation and decomposition, completion of user stories and specifications, software development, unit testing, integration testing, and UAT.

Deliverables:

Software. The primary deliverable of this task is software code, system configurations, database schemas, etc. resulting from this task. All software code, system configurations, database schemas, etc. associated with this contract shall be the property of the Government and shall not contain any company proprietary markings, logos, or any distribution restrictions. Software code shall be installed on the Government’s Staging and Production servers and provided as a tagged code segment via the Government managed code repository and/or delivered on other mutually agreed upon format.

Release Documentation. At a minimum, this shall include a work plan with recurring updates, static code scans (e.g. Fortify scans), release test plan with results, UAT plan with test scripts, and minor mod checklists (i.e. release notes) which include all artifacts with associated descriptions and solutions, and deployment instructions.

Updated Project Documents. Documentation sufficient to install, operate, and maintain the system shall be provided and maintained. These documents shall include updates to the product roadmap, COTS products, training manuals, user manuals, system installation procedures, and any supporting documents necessary for the Government to sustain the system.

Updated System Documents, Security Documents, White Papers. All solution changes shall be documented as user stories, technical specifications and/or diagrams, interface control documents, system configuration documents, and/or DODAF architectural artifacts. Additionally, documentation will be generated and maintained to support Static Code Analysis, the RMF, DISA STIGs, DoDI 8530.01, DOD 8570.01-M (Information Assurance Workforce Improvement Program), and the DOD Cloud Computing Security Requirements Guide.

Design and Plan The Contractor shall provide a project plan, and once directed by the Government employ the Scrum process to design the necessary capability. This design shall include all necessary artifacts, with appropriate sizing/complexity documented in the Government ALM, required for planning, development, and testing. The project plan shall include logical milestones (i.e. Epics/Features) for the deployment, which will result in a Minimal Viable Product (MVP), as well as additional functionality and/or enhancements.

Build and Deploy The Contractor shall employ the Scrum process and industry engineering best practices to define, build, test, document, and deploy updates to the system using a microservices architecture. This process agility shall support system change frequency for each government defined sprint cycle. Each new capability plan shall include checkpoints for milestones to include acceptance for design, build, test, and deploy. Checkpoints are inherent in the Agile development process; however, it is extremely important that new capability software components be uniquely identified during the process. User stories (i.e. functional specifications) shall capture features to be deployed and will be used by the Government as a basis for testing and acceptance.

Static Application Security Testing (SAST) Support The Contractor shall run static code scans using a Government approved code scan tool (e.g. Fortify) to prevent security vulnerabilities from being deployed into the production environment. The Contractor shall analyze codes for scan results, and remediate findings or provide rationale on false positives.

Task Area 4: Monitoring and Production Application Maintenance and Operations Support This task includes monitoring and troubleshooting production applications and responding to incidents that are generated by system users. Production support tickets shall be generated within the Government ALM tool. Production support tickets are the method for tracking and resolving incidents (i.e. specific issues), as well as processing user account requests. Incidents may involve generating software defect artifacts (i.e. for systemic problems requiring code changes), which will be prioritized by the Government. The Contractor shall document incidents and systemic problems for accurate reporting, metrics, and to provide a knowledge base within the Government ALM tool. The Contractor shall be responsible for ensuring the description and resolution for incidents they resolve are documented clearly.

Deliverables:

· System Performance Report. This report shall contain all open tickets listed in order of priority starting with highest priority, and further sorted so the earliest ticket of a given priority is at the top of that priority grouping. This report shall contain the ticket number, priority, associated tickets, descriptions, corrective action, date opened and closed with the user, as well as trend and other pertinent data. It shall correlate actions taken to other tasks or solutions that resolved similar tickets. If the Contractor has detected a trend, this report shall include a brief summary of the trend, associated tickets, pertinent distribution of causes, and recommended corrective action to prevent similar troubles. The Contractor shall use their expertise to recommend changes to software code, queries, data validations, etc. The Government will review these recommendations and provide guidance when appropriate. Since the production support tickets are managed via the Government ALM tool, metrics associated with responsiveness, quantity, and duration of tickets shall be extracted directly from the ALM tool and summarized in the report.

· Cyber Intrusion Incident Report. This report shall provide details identifying the root cause, impacts, and actions taken to resolve and prevent the vulnerabilities. The Initial Cyber Intrusion Incident Report is due within four (4) hours of the event. The Cyber Intrusion Incident Report Update is due within twenty-four (24) hours of the event.

Monitoring Support The Contractor shall monitor current health, performance statistics, recent errors, full logs, and key metrics. The Contractor shall ensure the system is working normally; and report and resolve any breaches, security attacks, or anomalies in activity. The Contractor shall use log collection, monitoring, and analysis to understand the relationship between network, infrastructure, servers, application framework, and user behavior to gain a comprehensive view across all activity, across all sources, servers, and locations. In the event of a Cyber incident or intrusion, the contractor shall conform to the policy outlined in the TRAC2ES Incident Response Plan. The Contractor shall report any detected cyber intrusions. Cyber incidents shall be documented in a Cyber Intrusion Incident Report. The incident report shall document and report loss/compromise, suspected compromise, suspicious contact, or activity involving systems accredited to process classified information. It may be used as a preliminary response to supplement national reporting requirements and provide a resource to document initial or first response to a Cyber incident.

Production Support The Contractor shall respond to and resolve operational problems with the system. This task includes responding to incidents, analyzing and correcting specific incidents, creating software development artifacts for systemic problems requiring code changes, and following escalated tickets to resolution. Typical incidents to be resolved under this task include database updates for specific records with incorrect data, which involves determining the cause of the issue, correcting the database, and determining whether a code fix is necessary. Failover and recovery times are described in Table 1:

Table 1: Failover and Recovery Times

Production Support Analysis The Contractor shall analyze problems and solutions to detect and report trends and “worst actor” features and/or processes. These recommendations shall consider the simplest solutions first. For example, a trend in user errors for entering data might be resolved by adding help text or changing data validations. On the other hand, recurring errors may require changes to functionality or the database. The Contractor’s expertise must be sufficient to support such analysis and provide concise, actionable recommendations. For complex recommendations, the Contractor may have to collaborate with the Government or other Contractor personnel to create change specifications. Support analysis may also result in recommending changes to system documentation or training material.

Cybersecurity Analysis The Contractor shall monitor and analyze Information Assurance Vulnerability Management (IAVM) Notices, Defense Information System Agency (DISA) Security Technical Implementation Guide (STIG), Joint Force Headquarters (JFHQ) Department of Defense Information Network (DODIN), United States Cyber Command (USCYBERCOM), USTRANSCOM Security Notifications, United States Computer Emergency Readiness Team (US-CERT), and vendor security advisories. The Contractor shall determine system impact, identify mitigating factors, and provide recommendations to the Government regarding potential courses of action. The Contractor’s recommendations shall be compliant with DoD security requirements and industry best security practices. The Contractor shall ensure that cybersecurity remediation, patch deployments, and other significant security activities are considered in the Product Roadmap.

Cybersecurity Service Provider (CSSP) Support The Contractor shall provide Host Based Security System (HBSS) and Assured Compliance Assessment Solution (ACAS) scans weekly; and shall participate in one (1) Continuity of Operations (COOP) exercise (i.e. Intrusion Assessment or Incident Response) annually.

Interoperability Certification Support The Contractor shall ensure TRAC2ES maintains interoperability certification by the Joint Interoperability Test Command (JITC) in accordance with Chairman Joint Chiefs of Staff (CJCS) Instruction (CJCSI) 5123.01H, Charter of The Joint Requirements Oversight Council (JROC) And Implementation of The Joint Capabilities Integration And Development System (JCIDS). All documentation delivered also must meet recommendations and guidelines defined in DoDI 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS). The Contractor shall comply with the most current version of each reference. The Contractor shall review and provide inputs (if applicable) to the DoDAF artifacts provided by the USTRANSCOM enterprise architecture team and review the Enhanced Information Support Plan (e-ISP).

Platform/Infrastructure Support Until TRAC2ES is migrated to the (TC-UGC or TC-CGC), the Contractor shall provide System Administration (SA) and Database Administration (DBA) support focusing on architecting, deploying, maintaining and documenting TRAC2ES infrastructure in the current hosting environment. This includes, but is not limited to, the following activities: supporting the TRAC2ES infrastructure, promoting software deployments, security patching, incident and problem management, monitoring resource usage, application performance, and managing all system accounts. This position shall maintain a current Secret Clearance, with a current T-5 background investigation (See Attachment 6), and current IAT I or IAT II certification. (See Attachment 3) Task Area 5: Risk Management Framework (RMF) Support The Contractor shall be responsible for creating and maintaining System Security Assessment and Authorization documentation for RMF security authorization. The Contractor shall develop documentation in accordance with (IAW) DOD Instructions 8500.01 and 8510.01, and National Institute of Standards and Technology (NIST) SP 800-18 and SP 800-53a. In addition, the Contractor shall support existing system security documentation to facilitate security authorization in accordance with DOD Risk Management Framework (RMF).

Along with the System Security Plan (SSP), the Contractor shall submit a plan and timeline to create any missing cybersecurity supporting artifacts IAW Attachment 2_Compelling Evidence Standards. The contractor shall participate in TRAC2ES assess and authorize (A&A) activities. The contractor shall manage and update existing system security documentation developed to facilitate TRAC2ES security authorization IAW RMF procedures. The Contractor shall conduct security certification activities as required to maintain current authorization and support follow-on authorizations.

The government will be responsible for providing policy requirements associated with the program, while the developer will be responsible for building and incorporating the language into the required artifacts.

Deliverables:

· System Security Plan (SSP) & Plan for Cybersecurity Support Artifacts The Contractor shall develop an SSP IAW DOD Instructions) DoDI 8500.01, Cybersecurity and DoDI 8510.01, and National Institute of Standards andRisk Management Framework (RMF) for DoD Information Technology (NIST) SP 800-18 and SP 800-53a.IT). The SSP will be a formal document that provides an overview of the security requirements for the system and describes the security controls in place or plans for meeting those requirements. The information gathered in paragraph 1.5.5.1 will be included in the SSP as it becomes available so that TRAC2ES remains continuously up to date.

Cybersecurity Planning Support The Contractor shall perform Assessment and Authorization and RMFactivities to maintain system authorization and support follow-on activities. The Contractor shall ensure compliance by providing documentation of applicable RMF Controls, Assessment Procedures (APs), and Control Correlation Identifiers (CCIs). This involves coordination with the Government, and other Government appointed Contractors, such as System Administration, Security Engineer, Information System Security Manager, Information System Security Officer, and Functional Subject Matter Expert teams. The Contractor shall use the 18 RMF templates provided by the Government as part of the Government Furnished Information (GFI) to convey the necessary information. This requires narrative information in addition to “yes” or “no” answers for an AP or CCI, completion of relevant tables, and other artifacts.

Additionally, the Contractor shall provide compelling evidence to demonstrate compliance with the requirements of the APs or CCIs, such as screen shots, audit logs, messages, completed forms, signed letters or other documentation, etc. Acceptable compelling evidence per requirements, APs, and CCIs are documented in Attachment 2-Compelling Evidence Standards. After contract award, the Government will provide the Contractor a list of the current controls, APs, and CCIs relevant to the TRAC2ES system. The Contractor shall contribute artifacts to demonstrate compliance with the requirements of the APs or CCIs. Some of the security controls within each control family may be inherited from the hosting environment or a third party provider.

Artifacts may include, but are not limited to:

Logical Diagram

Network Diagram Data Flows (PPS) External Interfaces Type of Data Exchange Firewall Rules Authenticated Scans Protection Mechanism(s) Hardware and Software Inventory Lists Memorandums of Agreement/Understanding (MOA/MOU), Service Level Agreements (SLA), Interface Control Agreement (ICD) Acceptable Use Policy Surge Support (Priced Optional Task) The Government may require surge support during the base year and/or any option period. Surge modifications will be within the scope of the contract and provide increased support for this PWS.

Task Area 6: Cloud Migration Support (Optional Priced Task) Once the (TC-UGC or TC-CGC) is available, the The Contractor shall migrate TRAC2ES from its current cloud hosting environment into the (TC-UGC or TC-CGC)new USTRANSCOM cloud enclave to utilize cloud computing for the Development, Test, Staging, and Production environments. The (TC-UGC or TC-CGC) is the portion of a Cloud Service Offering (CSO) within the security authorization boundaries of USTRANSCOM. The TC-UGCCloud Service Provider (CSP) is currently Amazon Web Services (AWS) USTC GovCloud, but that may change in the future. The CSP for the TC-UGC and TC-CGC are pending a future contract award. The Contractor shall utilize USTRANSCOM enterprise capabilities and cloud native services when available. The period of performance for this task shall not exceed twelve (12) months. The Contractor shall provide pricing for this optional task per FYas available.

Enterprise capabilities currently provided within the (TC-UGC or TC-CGC) include: Domain Name System (DNS), Microsoft Active Directory, Network Time Protocol (NTP), Simple Mail Transfer Protocol (SMTP), Online Certificate Status Protocol (OCSP), Secure Socket Shell (SSH) File Transfer Protocol (SFTP), Palo Alto Firewall, Splunk, Windows Server Update Services (WSUS), Yellowdog Updater Modified (YUM), Centrify, GEOINT Access and Information Sharing (GEOAxIS), RedLock, GitLab, Jenkins, Chef, Artifactory, Fortify Static Code Analyzer (SCA), Fortify Software Security Center (SSC), SonarQube, Nessus Security Manager, Eclipse, Maven, JIRA/Confluence. Additional enterprise capabilities will be added as (TC-UGC or TC-CGC) evolves. Current enterprise capabilities may be replaced or sunsetted as the USTRANSCOM cloud enclave evolves Cloud native services currently available within the (TC-UGC or TC-CGC) environment include: Virtual Private Cloud (VPC), Elastic Compute Cloud (EC2), Elastic Block Store (EBS), Simple Storage Service (S3), Identity and Access Management (IAM), Relational Database Service (RDS), Lambda, Simple Workflow Service (SWF), Elastic Load Balancer (ELB), CloudWatch, CloudTrail, DynamoDB, ElastiCache, RedShift, CloudFormation, Config, Trusted Advisor, Simple Notification Services (SNS), and Simple Queuing Services (SQS). The specific cloud services approved at each DoD Cloud Computing Security Requirements Guide (DoD CC SRG) Impact level (IL) is listed in the DoD Provisional Authorization (PA) for that IL. The TRAC2ES environments (i.e. Development, Test, Staging, Production) require IL5. The DoD cloud services catalog is located at https://disa.deps.mil/ext/CloudServicesSupport/Pages/Catalog-DoD-Approved-Commercial.aspx.

Access to the (TC-UGC or TC-CGC) environment and all the services mentioned above is provided via the USTRANSCOM Common Development Environment Virtual Desktop Infrastructure (CITRIX/VDI). It requires a CITRIXCDE/VDI account and a DoD CAC with a Non-Secure Internet Protocol Router Network (NIPRNET) email.

Deliverables:

· Cloud Architecture

· Application Migration Strategy

· Application Deployment Blueprints

· Cloud Migration After Action Report (AAR) Design Cloud Migration Architecture The Contractor shall provide a loosely coupled architecture while leveraging native cloud services (e.g., Elastic Load Balancing, Auto Scaling, Relational Database Services, etc.) that can be easily ported (e.g. AWS to Azure). The proposed cloud architecture shall include operating system instances, storage, network topology, and Government-specific security controls. The Contractor shall take into consideration a microservices-based architecture, stateless application, serverless computing, containerization, automated application and infrastructure deployment, automated scaling, high availability, and cost optimization. The Contractor shall ensure the cloud architecture enables software deployments from the Development environment through the Production environment. The Contractor shall document scaling procedures for operational scenarios that would necessitate a change in compute or storage for up to 500 concurrent users. The Contractor shall develop the proposed cloud architecture in coordination with the appointed Government Technical Subject Matter Experts to attain final Government approval.

Develop Application Migration Strategy The Contractor shall develop a detailed application migration strategy, which will include the target environment, migration approach, data migration plan, resource plans from both the Government and Contractor, timelines, dependency diagram, risks/issues, estimated costs, test strategies, and Government-specific security controls. The Contractor shall ensure the migration plan identifies and remediates gaps or discrepancies between the current and end state environment, if applicable. The Contractor shall develop the application migration strategy in coordination with the appointed Government Technical Subject Matter Experts to attain final Government approval.

Application Refactoring Support The Contractor shall perform any necessary refactoring so the application works effectively and efficiently in the cloud. The Contractor shall consider a service-oriented architecture, the number of running instances to allow dynamic scaling, and dynamic-cloud capabilities.

Build Cloud Enclave Environments The Contractor shall adopt the operating procedures…