Atch_1_ TransViz ReCompete Draft PWS V3.pdf

UNCLASSIFIED

Program Executive Office USTRANSCOM (PEO-T)

Performance Work Statement (PWS)

For

Transportation Visualizer (TransViz)

5 Sept 2024 Version 3 i

Table of Contents

1 Description of Services Background Objective Scope References Performance Requirements

Task Area 1: Provide Task Order Management Task Area 2: Software Development Support Task Area 3: Implement New Operational Capability USTRANSCOM – Secure Development Task Area 4: Provide Monitoring and Production Application Support Task Area 5: Provide Risk Management Framework (RMF) Support Task Area 6: Build Development Environment (DELETED) Task Area 7: Cloud Migration Support USTRANSCOM – Cyberspace Workforce Management

Delivery Schedule Warranty Inspection Final Acceptance

2 Performance Standards 3 Government Furnished Equipment (GFE), Government Provided Software (GPS), and

Government Furnished Information (GFI) Government-Furnished Equipment (Computers) Contractor Business Owned Computers

Access to Government Services Information Services

Government Furnished Information (GFI) Secret Internet Protocol Router Network (SIPRNET)

4 General Information Place of Performance Account Management Travel and Other Direct Costs (ODC)

Travel ii

Other Direct Costs Requirements Period of Performance Specialized Skills Required Velocity Latent Defects Identification of Security and Non-Disclosure Requirements Quality Assurance

Standards 5 Security

Physical, Personnel, Information, Antiterrorism/Force Protection and Industrial USTRANSCOM Protection Programs Division Points of Contact Operations Security (OPSEC) Security Regulation Compliance

Appendix A: List of Government Furnished Information Appendix B: Acronyms Appendix C: Contractor Cyberspace Workforce Management Training and Certification

1 Description of Services Background

Transportation Visualizer (TransViz) is a web-based analysis tool that provides graphic visualization of Joint Operation Planning and Execution System (JOPES) data in support of distribution strategic planning, deliberate planning, crisis action planning, theater level planning, and manipulation of Unit Line Numbers (ULNs) to time phase requirements, ensuring transportation feasibility and port throughput capability. TransViz provides an environment for collaboration among Combatant Commands (CCMDs), their component commands, supporting commands, USTRANSCOM and its components to quickly agree on proposed changes in support of making force movement decisions and writeback to JOPES. It provides the user the ability to data mine, identify trends, problems, and opportunities to improve movement options for requirements, as well as assisting in the flow of force requirements.

Objective The objective of this requirement is to provide software development support, IT security, administration, and expertise for TransViz. This includes all software code and associated components and integrations. Software development support shall include any phase of the Software Development Lifecycle (SDLC), including concept development, planning, requirements elicitation and analysis, systems design and development, coding and testing, deployment, implementation, integration, troubleshooting, security posture, documentation, and software application maintenance. Responsibilities include managing the code baseline, the hosted environment, and system interfaces. The code baseline may change as a result of user preference, latent defects, change requests, security requirements, or updates to Commercial Off The Shelf (COTS) products used by the system. Additionally, the Contractor shall provide production support to include troubleshooting and resolving user problems as well as identifying opportunities to improve the system. Overall, software development support shall include all aspects of the SDLC necessary to sustain and modify the system baseline. The Contractor shall work closely with other members of the team to include Government Product Owners, engineers, security, and end-users.

Scope The Contractor shall provide software development support for TransViz. The Contractor shall provide solution consulting and programming to: (1) implement new system capabilities; (2) implement change requests; (3) sustain deployed capabilities by rapidly troubleshooting and repairing software issues (i.e. correct software defects); (4) provide technical expertise to ensure high availability of the application to meet the USTRANSCOM mission; (5) receive and respond to problems reported by system users (i.e. correct incidents); (6) support security documentation and continuous monitoring; and (7) improve the system’s security posture. The Contractor shall provide support in achieving the discipline of Development/Security/Operations (DevSecOps).

This support shall include expertise with CoMotion® Application Development Kit Framework (the CoMotion® platform is a desktop that contains various tools such as charts, tables, and customized appliances specific to the application), Java Software Development Kit (SDK), Oracle Procedural Language/Structured Query Language (PL/SQL), Type Script, Java Script, React/Redux, Websocket, Cesium Maps, and Selenium.

Further, the Contractor shall provide expertise to build and maintain the TransViz development environment in the TRANSCOM Cloud Optimal DevSecOps Ecosystem (TCODE); and build and maintain the TransViz Non-Production and Production environments in the USTRANSCOM approved Classified cloud environment when appropriate and available. In preparation for cloud migration, the Contractor shall have IAT II certification for the Program Lead Developer and the Program Cloud Developers. See Attachment 3_IAT Levels for USTC Environments for details.

The Contractor shall provide an IAM III Certified Information Systems Security Professional (CISSP) to support all task areas.

References All references, including electronic libraries, can be found in Attachment 1_References.

Performance Requirements The Contractor shall use a Government owned Application Lifecycle Management (ALM) tool

(e. g., Jira) to effectively manage and execute the Agile Scrum methodology to analyze requirements, decompose large requirements into logical sub artifacts, create user story level artifacts and technical specifications (i.e. Epics or large features must be decomposed into user stories), coordinate with the appropriate subject matter experts (both technical and functional) to receive approved acceptance criteria for Epic/Task/Subtask level artifacts, set Story Points and establish a waterline, develop and test software, create test scripts and implement User Acceptance Testing (UAT), and keep artifact statuses updated (artifacts are the method for identifying a change with software which will be deployed into Production). To maintain predictable velocity, the developers shall complete the artifacts they commit to in each software sprint IAW paragraph 4., and team members are encouraged to collaborate towards requirements completion. User stories and design documentation shall be maintained within the government provided ALM tool. The technical release documentation shall document all changes and procedures necessary to promote a release into Production.

The Government will assign requirements to the Contractor for fulfillment via the Government provided ALM tool. Each assigned requirement will have one (1) or more associated artifacts.

The software development sprints are defined by the Government. Sprints are planned for four

(4) weeks in length but may change at the Government’s direction. Sprints may be at minimum two (2) weeks but not to exceed four (4) weeks in length, and result in software releases.

Task Area 1: Provide Task Order Management FFP (Fiscal Year (FY) 26-30 T-OPS) The Contractor shall provide the planning, direction, coordination, and control necessary to accomplish all requirements in this PWS. The Contractor shall designate key personnel responsible for the cost, schedule, and technical performance for the contract and shall serve as a primary Point of Contact for both management and technical matters. In addition, the Contractor shall participate in Program Management Reviews where the status of the work and associated deliverables are reviewed in the context of the business processes supported by the system.

Deliverables:

• Task Order Management Plan (TOMP). The Contractor shall prepare a TOMP describing the technical approach, organizational resources, and management controls to be employed to meet requirements.

• Product Roadmap. The Contractor shall maintain a product roadmap to plan out new system capabilities, functionality changes, system maintenance, and/or product upgrades.

The product roadmap shall include current sprint, sprint+1, and sprint+2 at a minimum.

The Contractor shall collaborate with the Government Product Owner to obtain the Government’s priority on software features and product updates.

1.5.1.1 Monthly Status Report (MSR)

The Contractor shall provide an MSR that includes by task the financial, performance, system availability, and schedule status IAW Attachment 7 TransViz Key Performance Parameters (KPPs). The TransViz KPPs (identified in Attachment 7) are for reporting purposes under the MSR only and do not constitute acceptance criteria under the terms of Sections 1.6 & 2.0. The MSR will include proposed changes to the schedule as detailed in the management plan as well as property accountability, technical accomplishments, identify issues and risks with recommendations to mitigate, and planned activities for the next reporting period. Any issue requiring Government response or action shall be brought to the Government’s attention immediately upon identification, and status captured in monthly reports.

This report will contain the calls and artifacts received and the actions taken during the reporting period. It shall correlate actions taken to other tasks or solutions that address resolving the reason for the artifact. Since the artifacts are assigned via the Government ALM tool, the Contractor will enter results into the Government ALM tool, metrics associated with the responsiveness, quantity, and duration of the artifacts will be extracted directly from the Government ALM tool. The status report shall include a cumulative tally of all artifacts assigned to the most recently completed release that have not been previously reported. This tally shall include the release identifier, total number of artifacts assigned to a release per category, the category (e. g., established within the ALM tool such as Requirement, Change Request (CR), Defect), and a total sum of total artifacts across all categories. Further, the report shall contain a sum of artifacts (per category and overall total) that were planned for each sprint (i.e. above the waterline after sprint planning using story points), as well as the sum of artifacts that are accepted in UAT (per category and overall total) and placed into Production with the scheduled release. The bottom of the table shall include totals for each column. A notional example is provided below:

Table 1 – Notional Example

Waterline Deployed Release CR Defect Requirement Total CR Defect Requirement Total

10.3 17 4 9 30 17 5 7 29

10.3.1 3 3 3 3

10.4 22 9 4 35 22 9 4 35

Totals 39 16 13 68 39 17 11 67

Deliverable:

• Monthly Status Report (MSR)

1.5.1.2 Contract Transition

Prior to contract expiration, or in the event of a different Contractor winning a follow-on contract, the Contractor shall provide, at a minimum, all materials and support necessary to accomplish a seamless and expeditious transition of the tasks identified in this PWS to the incoming Contractor. The Contractor shall include electronic copies of the following: all in-progress working files, Concept of Operation (CONOPS) procedures, and final phase out meeting with Government, incumbent and the new Contractor. The Contractor shall support a formal contract closeout process, including the documenting of lessons learned throughout the life of the contract. All deliverables shall be provided forty-five (45) business days before the end of the contract period of performance.

Deliverables:

• Transition Plan

• In-Progress Working Files

• Concept of Operations (CONOPS) Procedures

• Lessons Learned

1.5.1.3 System for Award Management (SAM)

The Contractor shall report in the System for Award Management (SAM): 1) the total dollar amount invoiced for services performed during the previous Government fiscal year under the contract; 2) the prime contractor direct labor hours expended on the services performed during the previous Government fiscal year; and 3) if applicable Tier 1 subcontract number, including DUNS number/Unique Entity Identifier (UEI) and name, and the number of subcontractor direct labor hours expended under the contract. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30.

Task Area 2: Software Development Support FFP (FY26-30 T-OPS) This task includes responding to requirements that are generated by the Government through change requests, program, security, production support, or trouble reporting mechanisms. ALM artifacts are the method for identifying software changes, which will be deployed into the Production environment. The Contractor shall properly record user stories, associated acceptance criteria, issues, and software solutions to create a knowledge base within the Government’s ALM tool. The Contractor shall use the Agile Scrum Framework; along with extreme programming practices such as test-driven development, refactoring, and continuous integration; when completing artifacts to include requirements elicitation and decomposition, completion of user stories and specifications, software development, security code scans with analysis, unit testing, integration testing, and UAT. The Contractor shall use a microservices architecture for new code (e.g. newly developed or upgraded features), and decouple monolithic legacy code only when appropriate (e. g., failure isolation, multiple rates of change, simplify external dependencies, etc.) for long-term usability and scalability of the application. This would exclude any COTS products. Additionally, the Contractor shall automate testing, security updates, configuration management, the software build process, etc. necessary to achieve Continuous Integration/Continuous Delivery (CI/CD).

Deliverables:

• Software. The primary deliverable of this task is software code, system configurations, database schemas, etc. resulting from this task. All software code, system configurations, database schemas, etc. associated with this task shall not contain any company proprietary markings, logos, or distribution restrictions and provide the Government with unlimited rights. Software code shall be installed on the Government’s Staging and Production servers and be provided as a tagged code segment via the Government managed code repository and/or delivered on other mutually agreed upon format.

• Release Documentation. As a minimum, this shall include a work plan with recurring updates, static code scans (e. g., Fortify scans with analysis), release test plan with results, UAT plan with test scripts, and minor mod checklists (i.e. release notes), which include all artifacts with associated descriptions and solutions, and deployment instructions.

• Updated Project Documents. Documentation sufficient to install, operate, and maintain the system shall be provided and maintained. These documents shall include updates to the product roadmap, COTS products, training manuals, user manuals, system installation procedures, and any supporting documents necessary for the Government to sustain the system.

• Updated System Documents, Security Documents, White Papers. All solution changes shall be documented as user stories, technical specifications and/or diagrams, interface control documents, system configuration documents, and/or Department of Defense Architecture Framework (DODAF) architectural artifacts. Additionally, documentation will be generated and maintained to support Static Code Analysis, the Risk Management Framework (RMF), Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), DODI 8530.01, and the Department of Defense (DOD) Cloud Computing Security Requirements Guide.

1.5.2.1 Agile Software Development Support

The Contractor shall respond to ALM artifacts to change the system, as prioritized and assigned by the Government Product Owner. The Contractor shall participate in and/or lead the Scrum process and other meetings to define, build, test, document, and deploy updates to the system baseline. The Contractor shall ensure ample lead-time for understanding and responding to unique change requests. The planning for requested functionality may include the Contractor’s recommendations to minimize rework and cost. If a change is beyond the Contractor’s capacity to complete within one sprint, the Contractor shall decompose the Epic and/or Features into smaller user stories; and update the schedule (i.e. product roadmap). Complex tasks may require additional planning before coding. These tasks are assigned to a sprint for development of a specification prior to the implementation sprint. The Contractor shall work with subject matter experts to create, and receive approval on, user stories and associated acceptance criteria, functional specifications and/or technical specifications. The Contractor shall support UAT for releases to ensure proposed changes are acceptable to users; and, when required, host release reviews for functional users to illustrate system changes. The Contractor shall assist with minor mod checklists (i.e. release notes); and shall provide necessary support to maintain and document the security posture of the application as required by the RMF or applicable DOD accreditation process.

1.5.2.2 Software Defect Support

The Contractor shall respond to escalated production support issues that cause work stoppage or operational problems with the system and ensure the Production system operates without interruption to functional users. Severity one (1) issues shall be acknowledged within four (4) business hours and resolution provided within one (1) business day. Severity two (2) and three

(3) issues shall be acknowledged within one (1) business day and resolution provided within five

(5) business days per Table 5 – Severity Definitions. Software defects that result in a work stoppage or impact to business operations shall result in an unplanned software Hot Fix.

Correcting defects identified through production support that do not result in a work stoppage shall be prioritized and assigned to current sprint or a future sprint by the Government depending on the impact to business operations. The Contractor shall assist the production support activity in identifying the root cause of production support malfunctions and creating ALM artifacts (i.e.

software code changes) to permanently resolve or prevent them. The Contractor shall input all actions taken to resolve artifacts into the Government ALM tool. The Contractor shall coordinate with production support to ensure minimal rework and downtime during software changes, and to ensure the production support activity understands planned system changes.

1.5.2.3 Commercial off the Shelf (COTS) Support

The Contractor shall provide support services for changes in COTS products to include patches

(e. g., application, operating system, database), upgrades, and/or migration to newer technologies. This will involve analyzing the system for incompatibilities and deprecated features. Once prioritized by the Government, the Contractor shall refactor the necessary code to ensure continued system stability. The refactoring shall be assigned to sprint(s) and follow the Agile SDLC process for integration and testing of refactored code. This will not involve change-over in technology (i.e. instead of Java, use .NET), but shall include patching upgrades so TransViz will not require extended support.

1.5.2.4 Deployment Pipeline Support

Once TransViz is migrated and operational in the TCODE Classified cloud environment, the Contractor shall provide the expertise required to operate and maintain the Development, Non- Production, and Production environments to reliably and efficiently compile, build, and deploy code. This shall include maintaining virtual machines and components, such as servers, memory, firewalls, load balancers, and storage (i.e. databases). Additionally, the Contractor shall maintain and update the Ports, Protocols, and Services (PPS) information. This shall include ports for internal and external traffic as well as the source and destination IP Addresses information. Air Force Department of Defense (AF-DOD) approved PPS worksheet will be used; available on the PPS Management at http://intelshare.intelink.gov/sites/ppsm.

1.5.2.5 Static Application Security Testing (SAST)

The Contractor shall run static code scans on the entire application using a Government approved code scan tool (e. g., Fortify) to prevent security vulnerabilities from being deployed into the Production environment. The Contractor shall analyze code scan results and remediate findings or provide rationale on false positives. To access the Government approved code scan tool, the Contractor shall provide documentation for an IAWIP package, which includes Security+ CE training renewed every three (3) years. Account management will be detailed and executed upon contract award.

1.5.2.6 DOD Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) Compliance Support The Contractor shall register with the DISA STIG library https://cyber.mil/stigs/ to receive notifications for updates to ensure the application and supporting application technology (i.e.

operating system, database, servers, etc.) complies with the most up-to-date version of the DOD http://intelshare.intelink.gov/sites/ppsm

SRGs and Application Security and Development STIGs. The Contractor shall remediate any non-compliant checklist items. The Contractor shall enter open STIG findings, along with fix actions, into the Government ALM tool.

1.5.2.7 Surge Support (Priced Optional Task for the BY Only) (Deleted)

1.5.2.8 Provide TransViz Software Maintenance (ODC Priced-Separately) TransViz is built on COTS, CoMotion® (version 3.5). The Contractor shall purchase CoMotion® Software license, maintenance, and support agreement to ensure security and supportability of the CoMotion® software product, which provides the visualization layer for TransViz. Each proposal must provide a quote from the vendor with pricing for each year of the contract.

The Contractor shall coordinate with the CoMotion® vendor to create ALM artifacts for any CoMotion®-related bugs/issues, to stay abreast of changes in upcoming releases and their affects on TransViz, and to ensure TransViz utilizes a supported version of CoMotion®.

The Contractor shall ensure the TransViz software maintains compatibility and interoperability with USTRANSCOM architecture standards, security requirements, and current operating system, web server, and database versions.

Task Area 3: Implement New Operational Capability LH (Task FY26-30 T- CAP) The Contractor shall respond to ALM artifacts (i.e. new requirements) to implement new capabilities in the system (i.e. different than implementing change requests to existing capabilities). New capabilities will focus on creating new/additional system operational activities. This task shall include all Agile SDLC activities to support implementing new capabilities. The Contractor shall properly record user stories, associated acceptance criteria, issues, and software solutions to create a knowledge base within the Government’s ALM tool.

The Contractor shall use the Agile Scrum Framework; along with extreme programming practices such as test-driven development, refactoring, and continuous integration; and a microservices architecture when completing artifacts to include: requirements elicitation and decomposition, completion of user stories and specifications, software development, unit testing, integration testing, and UAT. The Government will request a quote for this option to be awarded.

Deliverables:

• Software. The primary deliverable of this task is software code, system configurations, database schemas, etc. resulting from this task. All software code, system configurations, database schemas, etc. associated with this task shall not contain any company proprietary markings, logos, or distribution restrictions and provide the Government with unlimited rights. Software code shall be installed on the Government’s Staging and Production servers and be provided as a tagged code segment via the Government managed code repository and/or delivered on other mutually agreed upon format.

• Release Documentation. As a minimum, this shall include a work plan with recurring updates, static code scans (e. g., Fortify scans with analysis), release test plan with results, UAT plan with test scripts, and minor mod checklists (i.e. release notes) which include all artifacts with associated descriptions and solutions, and deployment instructions.

• Updated Project Documents. Documentation sufficient to install, operate, and maintain the system shall be provided and maintained. These documents shall include updates to the product roadmap, COTS products, training manuals, user manuals, system installation procedures, and any supporting documents necessary for the Government to sustain the system.

• Updated System Documents, Security Documents, White Papers. All solution changes shall be documented as user stories, technical specifications and/or diagrams, interface control documents, system configuration documents, and/or DODAF architectural artifacts. Additionally, documentation will be generated and maintained to support Static Code Analysis, the RMF, DISA STIGs, DODI 8530.01, DOD 8570.01-M (Information Assurance Workforce Improvement Program), and the DOD Cloud Computing Security Requirements Guide.

1.5.3.1 Design and Plan

The Contractor shall provide a project plan, and once directed by the Government employ the Scrum process to design the necessary capability. This design shall include all necessary artifacts, with appropriate sizing/complexity documented in the Government ALM, required for planning, development, and testing. The project plan shall include logical milestones (i.e.

Epics/Features) for the deployment, which will result in a Minimal Viable Product (MVP), as well as additional functionality and/or enhancements.

1.5.3.2 Build and Deploy

The Contractor shall employ the Scrum process and extreme programming engineering practices to define, build, test, document, and deploy updates to the system using a microservices architecture. This process agility shall support system change frequency for each ~4-week sprint cycle. Each new capability plan shall include checkpoints for milestones to include acceptance for design, build, test, and deploy. Checkpoints are inherent in the Agile development process;

however, it is extremely important that new capability software components be uniquely identified during the process. User stories (i.e. functional specifications) shall capture features to be deployed and will be used by the Government as a basis for testing and acceptance.

1.5.3.3 Static Application Security Testing (SAST) Support

The Contractor shall run static code scans on the entire application using a Government approved code scan tool (e. g., Fortify) to prevent security vulnerabilities from being deployed into the Production environment. The Contractor shall analyze code scan results and remediate findings or provide rationale on false positives. To access the approved Government approved code scan tool, the Contractor shall provide documentation for an IAWIP package, which includes Security+ CE training renewed every three (3) years. Account management will be detailed and executed upon contract award.

USTRANSCOM – Secure Development

1.5.4.1 Secure Software

The Contractor shall meet all Government specifications for design, development and implementation of secure applications and configurations through applying secure software development processes and secure coding practices with each Software Release Candidate.

These include but are not limited to applicable DoD Security Technical Implementation Guide (STIGs), Security Requirements Guide (SRGs), industry best practices, vendor security guidance and applicable product security patches.

1.5.4.2 Contractor software will not contain programming errors listed on the current approved version of the Common Weakness Enumeration (CWE), the SANS TOP 25 Most Dangerous Software Errors, the Open Web Application Security Project (OWASP) Top Ten or an unsecure configuration found by applying the DISA Application Security and Development Security (ASD) STIG, applicable Enclave Test and Development (T&D) and application STIGs/SRGs.

1.5.4.3 Static Application Security Testing (SAST)

The Contractor shall run static code scans using a Government-approved code scan tools (e.g.

Micro Focus Fortify) to mitigate potential of security vulnerabilities from being deployed into the production environment. Scans will utilize current scan engine and rule pack as determined by release candidate delivery date. If the software code has been redeveloped or refactored (changing the source code without modifying the external functional behavior), new scans must be provided to the Government by the Contractor.

1.5.4.4 The contractor shall provide code scans with every release candidate. The scans will include all application source code written for the application and Third-Party Libraries (TPL) that were modified for inclusion in the application. Non-functional (non-evoked) code within the TPLs will not be included in scan output. When scanned, source code will be in plain text format and encoded components (e.g., base64 images) will not be included.

1.5.4.5 DISA SRGs and STIGs Compliance

The contractor shall run the applicable Enclave T&D and ASD STIGs against their environments and deliver results NLT 60 days after the contract start date and NLT 60 days after the start of each subsequent option period.”

1.5.4.6 The Contractor shall register with the DISA STIG library (https://cyber.mil/stigs/) upon contract award to receive notifications for updates to ensure the application and supporting application technology (i.e. operating system, database, servers, etc.) comply with the most up-to-date version of the DISA SRGs and STIGs. The Contractor shall evaluate each SRG/STIG item, determine applicability based on presence of technology/functionality, and annotate the checklist comment section for each item with statements of review status, applicability, and compliance/non-compliance. In the event of a non-compliant SRG/STIG check, the contractor will annotate open SRGs/STIG findings, along with fix or proposed mitigation actions, on a Plan of Action and Milestones (POA&M) for Government approval.

1.5.4.7 Unsupported Components

The Contractor’s development efforts will not utilize unsupported/extended support hardware, software, firmware or computer code unless specifically agreed upon by the Government.

Contractor will ensure unsupported components are replaced/removed prior to end of life per a Government approved POA&M. The Government approved POA&M will outline the transition to supported components during any extended support period.

1.5.4.8 Flaw Remediation

Contractor software releases will not introduce any unmitigated vulnerabilities unless specifically agreed upon by the Government. The Contractor shall analyze code scan results, remediate findings, provide rationale on false positives. Findings mitigated to a lower severity will be agreed upon by the Government.

1.5.4.9 The Contractor will track all open findings on a Government reviewed and approved POA&M. The Contractor will establish a Burn Down Plan to prioritize remediation actions based on finding severity and Government discretion. The Contractor will assist the Government Information System Security Manager with conducting an annual review of scan findings to ensure the POA&M and Burn Down Plan accurately reflect the current risk posture of the software. The Contractor will provide the results of the review to the Government.

1.5.4.10 Development Security Operations (DevSecOps)

The Contractor will follow the DOD Enterprise DevSecOps Reference Design (https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Refere nce%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583) when developing in USTRANSCOM hosted development environments. The Contractor will adhere to all policies and procedures established for the authorization boundary of USTRANSCOM hosted development environments.

Task Area 4: Provide Monitoring and Production Application Support FFP (FY26-30

T-OPS)

This task includes monitoring and troubleshooting production applications; and responding to incidents that are generated by system users. Production support tickets shall be generated within the Government ALM tool. Production support tickets are the method for tracking and resolving incidents (i.e. specific issues), as well as processing user account requests. Incidents may involve generating software defect artifacts (i.e. for systemic problems requiring code changes); which will be prioritized by the Government. The Contractor shall document incidents and systemic problems for accurate reporting, metrics, and to provide a knowledge base within the Government ALM tool. The Contractor shall be responsible for ensuring the description and resolution for incidents they resolve are documented clearly.

Level one (1) production support will be provided by the TransViz functional team generating tickets within the Government’s ALM tool. Problems which cannot be resolved by level one (1) support will be escalated within the Government’s ALM tool to level two (2) for resolution.

Level two (2) production support will be provided by the Contractor’s SA/DBA. Problems which cannot be resolved by Level two (2) support will be escalated to Level three (3) support for resolution by the Development Team. The Contractor shall interface with the functional team to fully understand the issues and achieve a solution suitable for the functional community. The Contractor shall interface with the SA/DBA to resolve issues and ensure TransViz meets availability expectations. It is anticipated that the Contractor level of support will be approximately four (4) tickets per month with approximately 8 hours per issue.

Deliverables:

• System Performance Report. This report shall contain all open tickets listed in order of priority starting with highest priority, and further sorted such that the earliest ticket of a given priority is at the top for that priority grouping. This report shall contain the ticket #, priority, associated tickets, descriptions, corrective action, date opened and closed with the user, as well as trend and other pertinent data. It shall correlate actions taken to other tasks or solutions that resolved similar tickets. If the Contractor has detected a trend, this report shall include a brief summary of the trend, associated tickets, pertinent distribution of causes, and recommended corrective action to prevent similar troubles. The Contractor shall use their expertise to recommend changes to software code, queries, data validations, etc. The Government will review these recommendations and provide guidance when appropriate. Since the production support tickets are managed via the Government ALM tool, metrics associated with responsiveness, quantity, and duration of tickets shall be extracted directly from the ALM tool and summarized in the report.

• Cyber Intrusion Incident Report. This report shall provide details identifying the root cause, impacts, and actions taken to resolve and prevent the vulnerabilities. The Initial Cyber Intrusion Incident Report is due within four (4) hours of the event. The Cyber Intrusion Incident Report Update is due within twenty-four (24) hours of the event.

1.5.5.1 Monitoring Support

The Contractor shall monitor current health, performance statistics, recent errors, full logs, and key metrics. The Contractor shall report and resolve any breaches, security attacks, or anomalies in activity. The Contractor shall use log collection, monitoring, and analysis to understand the relationship between network, infrastructure, servers, application framework, and user behavior to gain a comprehensive view across all activity, across all sources, servers, and locations. In the event of a Cyber incident or intrusion, the Contractor shall conform to the guidance outlined in Attachment 8_Non-TSP Incident Handling. The Contractor shall report any detected cyber intrusions. Cyber incidents shall be documented in a Cyber Intrusion Incident Report. The incident report shall document and report loss/compromise, suspected compromise, suspicious contact, or activity involving systems accredited to process classified information. It may be used as a preliminary response to supplement national reporting requirements and provide a resource to document initial or first response to a Cyber incident.

1.5.5.2 Production Support

The Contractor shall respond to and resolve operational problems with the system. This task includes responding to incidents, analyzing, and correcting specific incidents, creating software development artifacts for systemic problems requiring code changes, and following escalated tickets to resolution. Typical incidents to be resolved under this task include database updates for specific records with incorrect data, which involves determining the cause of the issue, correcting the database, and determining whether a permanent code fix is necessary.

1.5.5.3 Production Support Analysis

The Contractor shall analyze problems and solutions to detect and report trends and “worst actor” features and/or processes. These recommendations shall consider the simplest solutions first. For example, a trend in user errors for entering data might be solved by adding help text or changing data validations. On the other hand, recurring errors may require changes to functionality or the database. The Contractor’s expertise must be sufficient to support such analysis and to provide concise, actionable recommendations. For complex recommendations, the Contractor may have to collaborate with the Government or other Contractor personnel to create change specifications. Support analysis may also result in recommending changes to system documentation or training material.

1.5.5.4 Cybersecurity Analysis

The Contractor shall monitor and analyze Information Assurance Vulnerability Management (IAVM) Notices, USTRANSCOM Security Notifications, United States Computer Emergency Readiness Team (US-CERT), and vendor security advisories. The Contractor shall determine system impact, identify mitigating factors, and provide recommendations to the Government regarding potential courses of action. The Contractor’s recommendations shall be compliant with DOD security requirements and industry best security practices. The Contractor shall ensure that cybersecurity remediation, patch deployments, and other significant security activities are considered in the Product Roadmap.

1.5.5.5 Cybersecurity Service Provider (CSSP) Support

The Contractor shall provide Host Based Security System (HBSS) and Assured Compliance Assessment Solution (ACAS) scans weekly; and shall participate in one (1) Continuity of Operations (COOP) exercise (i.e. Intrusion Assessment or Incident Response) annually.

1.5.5.6 Interoperability Certification Support

The Contractor shall ensure TransViz maintains interoperability certification by the Joint Interoperability Test Command (JITC) in accordance with Chairman Joint Chiefs of Staff (CJCS) Instruction 5123.01H. All documentation delivered also must meet recommendations and guidelines defined in DOD Instruction 8330.01. The Contractor shall comply with the most current version of each reference. The Contractor shall review and provide inputs (if applicable) to the TransViz DODAF artifacts provided by the USTRANSCOM enterprise architecture team and review the Enhanced Information Support Plan (e-ISP).

1.5.5.7 Provide Platform/Infrastructure Support

The Contractor shall provide onsite System Administration (SA) and Database Administration (DBA) support focusing on architecting, deploying, maintaining, and documenting TransViz infrastructure in the current on-premises Common Production Environment (CPE). This includes, but is not limited to, the following activities: supporting the TransViz infrastructure, promoting software deployments, security patching, incident and problem management, monitoring resource usage, application performance, and managing all system accounts. The Contractor shall provide a backup SA/DBA for emergencies within 8 business hours of the regularly scheduled workday. The Contractor backup SA/DBA shall work 2 hours per month with the SA/DBA FTE to maintain access to the required accounts.

The SA/DBA position is considered a privileged user and requires a current Tier-5 or SSBI background investigation (See Attachment 6), and current IAT II certification. (See Attachment 3). An interim background investigation will not satisfy this requirement. The SA/DBA shall be appointed as the TransViz Information System Security Officer (ISSO).

1.5.5.8 Provide Red Hat Maintenance (ODC Priced-Separately)

Until TransViz is migrated to the USTRANSCOM approved Classified cloud environment, the Contractor shall provide a total of sixteen (16) Red Hat Enterprise Linux (RHEL) licenses for the Development, Test, Staging, and Production environments. This requires twelve (12) server licenses and four (4) data center licenses.

Task Area 5: Provide Risk Management Framework (RMF) Support FFP (FY26-30

T-OPS)

The Contractor shall develop, configure, and/or operate information system components and/or information systems securely in accordance with the current versions of DOD policy, National Institute of Standards and Technology (NIST) Special Publications (SPs), National Security Agency (NSA) publications, Committee on National Security Systems (CNSS) issuances, and United States Cyber Command (USCYBERCOM) tasking orders, and requirements; support improving cyber resiliency for the information system and reducing vulnerability to the DODIN.

Support continuous monitoring and the integration of security and risk management framework (RMF) activities into the systems development lifecycle (SDLC). Documentation/Evidence standards for Section 1.5.6 is defined in Attachment 2.

1.5.6.1 Authorization and Assessment (A&A) Support

The Contractor shall create, edit, update, and maintain information system security assessment and authorization (A&A) documentation/evidence of control compliance for all applicable security control families necessary to achieve an authorization decision (authorization to operate/connect [ATO/ATC] or interim authorization to test [IATT]) and/or support continued authorization in accordance with (IAW) the current version of DOD Instruction (DODI) 8500.01, Cybersecurity, DODI 8510.01, NIST Special Publication 800-37, Risk Management Framework (RMF) for DoD Information Technology (IT), Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling Program, Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National Security Systems, NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, and NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans.

The Contractor will produce evidence/artifacts that validate security control requirements established within NIST SP 800-53, IAW USTRANSCOM published standards and guidance by utilizing the current USTRANSCOM RMF grading rubric. Evidence/artifacts meeting assessment standards of NIST SP 800-53a will be utilized to support an authorization decision according to the normal processing times and the authorization need date.

The Contractor shall support Interim Authorization to Test (IATT) activities for system testing on the operational network or when using live data (data that has not been sanitized to remove operational information) by providing the following documentation: An updated architectural diagram (showing test configuration), proposed ports, protocols, and services (PPS) declaration worksheet, and a comprehensive test plan that describes the test environment, projected specific testing events and schedules, and expected outcomes for remediating existing or future vulnerability.

The Contractor shall have an ongoing responsibility for writing and/or updating supporting evidence/artifacts required by the applicable security controls for all deliverables, as identified in control guidance in eMASS, NIST SP 800-53 series documents, and/or CNSSI 1253. The contractor shall demonstrate requirements compliance, outline non-compliance and mitigations, and justify non-applicable controls to support information system/enterprise continuous monitoring efforts and the USTRANSCOM Digital Modernization Strategy. Deliverable.

The Contractor shall ensure security control evidence/artifacts clearly support compliance or describe non-compliance with the security control within eMASS. Non-compliance will state the raw severity of the risk, mitigations (in place and/or planned), and a recommendation for residual risk to the government. Evidence/artifacts will be specific to the security control and will have annotation within the artifact to call attention to the topic. Evidence/artifacts will be delivered to the government according to the government-specified authorization/reauthorization timeline within eMASS or other government-selected tool.

The Contractor shall provide evidence for applicable security controls, as identified in the current version of NIST 800-53A and NIST SP 800-30, Guide for Conducting Risk Assessments, or as specified in applicable DOD, CNSS, and USTRANSCOM guidance to demonstrate compliance with the requirements of the Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs)/Security Requirements Guides (SRGs), Assessment Procedures (APs), and/or Control Correlation Identifiers (CCIs), such as screen shots, audit logs, messages, Security Content Automation Protocol (SCAP) scans, software code scans (as required by the USTRANSCOM Code Scanning Policy), Assured Compliance Assessment Solution (ACAS) scans, mitigation plans, diagrams, completed forms/checklists, signed letters, and/or other documentation, etc. The Contractor shall automate, whenever possible, and conduct scans and accompanying analyses in accordance with USTRANSCOM RMF, scanning, and continuous monitoring policies. Provide scan results and/or analysis to the government to allow vulnerability remediation.

The Contractor shall run applicable manual and automated DISA STIGs/ SRGs, checklists, and compile for validation within the timeframe specified by the Government using the DISA STIG viewer tool, available on the DOD Cyber Exchange website. The contractor shall develop mitigations for non-compliant controls.

The Contractor shall document security-focused configuration management according to NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems, or as specified in applicable DOD, CNSS, and USTRANSCOM guidance. Employ appropriate configuration settings on commercial information technology (IT) products and conduct/facilitate/support security scanning (SCAP, ACAS, STIGs/SRGs, software code [Fortify or similar government-specified tool]) and the mitigation of findings/vulnerabilities. The Contractor shall develop/maintain remediation (burn-down) plans to resolve findings and mitigate risk according to severity.

The Contractor shall identify planned and implemented countermeasures for risk mitigation with realistic timelines and resources for resolving the non-compliant security. controls.

The Contractor shall update the development/maintenance of the Information System Lifecycle management plan to include software, hardware, and configuration life cycle management to ensure all aspects of the Information system is upgraded/replaced prior to end of life and support the USTRANSCOM Digital Modernization Strategy. The Contractor shall complete reviews quarterly and identify support issues and provide replacement/upgrade recommendations and timelines to the Government. Any such reviews and/or recommendations by the Contractor will be impartial and unbiased, and free from any influence that would reasonably be considered a conflict of interest due to a disclosed or undisclosed relationship or affinity to a particular vendor and/or supplier.

The Contractor shall verify compliance of proposed acquisition of computing hardware and software IAW DODI 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS). Identify product compliance and non-compliance to the government in writing.

The Contractor shall limit the acquisition of IA/IA-enabled commercial off the shelf (COTS) products to those that meet evaluation and validation requirements as outlined in DODI 8500.01, Cybersecurity.