ATT A - Performance Work Statement.pdf

ATTACHMENT A

PERFORMANCE WORK STATEMENT (PWS)

RFP 80TECH23R0002

CONTRACT #TBD

DATE: MARCH 2023

Attachment A

80TECH23R0002

Table of Contents Table of Contents

1 INTRODUCTION AND OVERVIEW

1.1 SCOPE

1.2 GOALS AND OBJECTIVES

1.3 RELATED DOCUMENTATION

2 CONTRACT MANAGEMENT

2.1 ORDERING AND SERVICES DELIVERY

2.2 PROGRAM MANAGEMENT

2.3 FINANCIAL MANAGEMENT

2.4 CONTRACT AND SUBCONTRACT ADMINISTRATION

2.5 CONTRACT ADMINISTRATION SYSTEM

2.6 LIST OF CONTRACTOR PERSONNEL

2.7 REPORTING AND OTHER INFORMATION REQUESTS

2.8 LOGISTICS

2.9 CONTRACT PHASE-IN MANAGEMENT

2.10 PHYSICAL SECURITY MANAGEMENT

2.11 EXPORT CONTROL

2.12 EMERGENCY MANAGEMENT

2.13 SAFETY, HEALTH AND ENVIRONMENTAL (SHE) MANAGEMENT

2.14 SOFTWARE PURCHASES

2.15 RECORDS AND DATA MANAGEMENT

2.16 SOFTWARE ASSURANCE AND SOFTWARE SAFETY

2.17 IT SERVICE MANAGEMENT

2.18 CONFIGURATION MANAGEMENT (CM)

2.19 QUALITY ASSURANCE AND MANAGEMENT

3 TECHNICAL PERFORMANCE MANAGEMENT

3.1 SYSTEM OUTAGE MANAGEMENT

4 CYBERSECURITY SERVICES OVERVIEW

4.1 CYBERSECURITY COMPLIANCE

4.2 SYSTEM ENGINEERING IN SUPPORT OF CYBERSECURITY

4.3 VULNERABILITY SCANNING

4.4 AUDITS, VULNERABILITY ASSESSMENTS, AND PENETRATION TESTING

RESPONSE AND SUPPORT

4.5 ASSESSMENT & AUTHORIZATION (A&A) SUPPORT

4.6 PRIVACY AND CONTROLLED UNCLASSIFIED INFORMATION (CUI)

MANAGEMENT

4.7 INCIDENT RESPONSE SUPPORT

4.8 SYSTEM EVENT AUDIT AND ACCOUNTABILITY

4.9 CONFIGURATION MANAGEMENT

4.10 CONTINGENCY PLANNING

4.11 IDENTIFICATION, CREDENTIAL, AND ACCESS MANAGEMENT (ICAM)

4.12 SYSTEM AND COMMUNICATION PROTECTION

4.13 PERSONNEL SECURITY

4.14 CYBERSECURITY AWARENESS TRAINING AND EDUCATION

5 INNOVATION SERVICES

5.1 COOPERATIVE COMMITMENT

5.2 WORKSHOPS

5.3 REPORTS

6 APPLICATION SERVICES

6.1 GENERAL

6.2 ASSESSMENTS

6.3 DEVELOPMENT SUPPORT

6.4 OPERATIONAL AND MAINTENANCE SUPPORT

6.5 DATABASE SERVICES

7 FIXED PRICE AGILE TEAMS

7.1 AGILE TEAMS AND SCRUM MASTER GENERAL REQUIREMENTS

7.2 AGILE TEAMS

7.3 SCRUM MASTER

7.4 RELEASE TRAIN ENGINEER (RTE)

7.5 AGILE RELEASE TRAIN (ART) TEAMS

7.6 SURGE AND DECREASE OPTIONS

7.7 REPORTING

7.8 FIXED PRICE TEAMS METRICS

7.9 INSPECT AND ADAPT (I&A) EVENTS

8 FIXED PRICE SPRINT DEVELOPMENT AND APPLICATION O&M

8.1 APPLICATION O&M

8.2 APPLICATION DEVELOPMENT UNITS

8.3 INFRASTRUCTURE AND APPLICATION EXTENDED SUPPORT FOR AGENCY

8.4 SHAREPOINT AS A SERVICE (SPaaS)

9 INFORMATION AND DATA ANALYTICS SERVICES (IDAS)

10 IT SERVICES FOR AUTOMATION

10.1 GENERAL

10.2 PROCESS AUTOMATION DISCOVERY

10.3 AUTOMATION DEVELOPMENT

10.4 AUTOMATION O&M

10.5 POWER PLATFORM SUPPORT

11 FINANCIAL SYSTEM MANAGEMENT UPGRADE

12 IDIQ TASK ORDER SERVICES

1 INTRODUCTION AND OVERVIEW

The National Aeronautics and Space Administration (NASA) (also referred to as “the Government,” “Government,” or “the Agency,” or “Agency”) recognizes the criticality and benefit across the enterprise when Information Technology (IT) services are closely integrated, secured, and supported by a strong service delivery framework. The NASA Consolidated Application and Platform Services (NCAPS) contract will provide the necessary support to maintain and evolve NASA’s core collaborative IT services, which are essential to the ongoing success of its missions and projects across NASA’s geographically distributed Centers. The scope of work includes efficient, effective, innovative, and collaborative approaches to IT management and delivery. The Contractor shall ensure the safety, security, and availability of operations with requisite Agency visibility, ensuring NASA and its partners can operate without disruption while maintaining interoperability across NASA’s heterogenous IT environment.

The Office of the Chief Information Officer’s (OCIO) mission is to increase the productivity of its workforce, by responsively and efficiently delivering reliable, innovative, and secure interoperable IT services. It is the intent of the OCIO to consolidate related requirements across NASA’s Centers to leverage the efficiency of centralized IT support services, resulting in the NCAPS contract.

The NCAPS contract will be awarded during a period of significant transformation of mission support services to an enterprise operating model while maintaining mission focus, improving efficiency, recognizing local authority, and valuing the workforce. Mission support services are the functions traditionally managed and operated at each NASA Center and headquarters and include information technology.

The OCIO Transformation is a redesign of the NASA's IT Operating Model in order to more directly enable NASA to achieve mission success and ensure that the OCIO is an organization where our people grow, learn, and thrive.

Notable changes to the IT Operating Model include, but are not limited to:

• The OCIO’s organizational structure,

• Governance boards and processes,

• The IT acquisition strategy and contract management,

• Optimizations to resource and budget management, and

• New approaches to improving customer experiences.

The NCAPS contract will also support the OCIO though transformation and beyond. The contract, work packages ordered, and Task Orders will primarily support the Application and Platform Service (APS) Line transformation and support of the OCIO while some work packages will be directly ordered through the other Enterprise OCIO Service Lines. The work throughout will be executed primarily using Agile based service delivery methodologies, such as the Scaled Agile Framework (SAFe) and Information Technology Infrastructure Library (ITIL) based service management practices. This support and transformational model requires extensive collaboration and integration vital to the planning, design, and development of future mission-related capabilities and technologies.

As NASA focuses its attention on the successful completion of its core mission objectives, it is imperative that all applications and platforms services supported by this contract, interoperate securely, reliably, and efficiently, utilizing recognized industry standards. It is critical that application and platform and development processes incorporate a customer-centric approach to support functions and service delivery. In addition, it is imperative that application and platform services—as supporting functions—are offered to the Agency through lean, scalable, and agile practices leveraging economies of scale, while also conforming to federal governance and agency policies and requirements. Engagement and coordination with the OCIO Enterprise Project Management Office (EPMO) and governing bodies will be required based on the size and scope of the work in accordance with (IAW) NASA Policy Regulation (NPR) 7120.7, NASA Information Technology Program and Project Management Requirements.

1.1 SCOPE

The task of the NCAPS Contractor (hereafter referred to as “The Offeror,” “Offeror,” “the Contractor,” or “Contractor”) is to provide, manage, secure, maintain, and evolve IT services

• Transform how NASA operates using digital capabilities.

• Enable insights from NASA’s data and information.

• Enable flexible and equitable work options and environments to achieve mission success.

Goal 4: Ensure Proactive, Resilient Cybersecurity.

Objectives:

• Simplify, strengthen, and scale NASA’s cybersecurity.

• Reinforce operational resilience through strategic cybersecurity risk management.

• Integrate risk-based cybersecurity into mission development and operations as a shared responsibility.

Goal 5: Develop an Exceptional OCIO Team.

Objectives:

• Attract, hire, and retain a diverse and strategically-aligned OCIO team. (Data Requirements Document (DRD) MA-024, Diversity, Equity, Inclusion, and Accessibility (DEIA) Plan)

• Enhance employee experience by ensuring team members feel included, engaged, and valued.

• Develop team members’ talents and support career development to meet mission needs.

1.3 RELATED DOCUMENTATION

Throughout the PWS, documents are referenced which are directly applicable or contain policies or other directive matters that are binding for the performance of the contract. These documents establish detailed specifications, requirements, and interface information necessary for the performance of the contract. In the event of conflicting requirements between this PWS and the applicable documents referenced herein, the Contractor shall immediately notify the contracting officer and contracting officer’s representative (COR) in writing. The nature of the conflict shall be identified, and the Contractor shall request direction from the Government as to how to proceed. The Contractor shall adhere to the most current version of the policies or other directives.

2 CONTRACT MANAGEMENT

The Contractor shall provide contract management services and functions as defined in this Section.

The Contractor shall enter into Associate Contractor Agreements (ACA) with other contractors providing other enterprise and agency contracts, as applicable, to ensure integrated services delivery. At a minimum, ACAs should be entered into with the Contractors for the following Agency IT Contracts:

• Advanced Enterprise Global IT Solutions (AEGIS)

• Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS)

• NASA End-User Services & Technologies (NEST)

• Enterprise Multimedia & Integrated Technical Services (eMITS)

The Contractor shall review the NCAPS PWS efforts, which are currently being performed as Firm Fixed Price (FFP) under a Fixed Price (FP) Team arrangement and identify elements for conversion to a FP Capacity effort. The Fixed Price Capacity Transition Plan (FPCTP) shall be submitted 6 months after the performance start date of NCAPS, in accordance with DRD MA- 021, Fixed Price Capacity Transition Plan (FPCTP).

2.1 ORDERING AND SERVICES DELIVERY

The PWS provides detailed performance-based requirements that will be defined in standalone work packages or work packages as part of the Annual Work Plan (AWP). Indefinite Delivery/Indefinite Quantity (IDIQ) Task Orders will be issued as performance based, in accordance with Section I.152, NFS 1852.216-80, Task Ordering Procedure, and include more specific performance characteristics (technical, schedule and cost) and deliverable requirements.

The Contractor shall perform all duties remotely, to the maximum extent possible, unless otherwise stated within Work Packages, Task Orders, and/or herein. The requirements of PWS elements 1.0 through 4.0 apply to all products and services delivered in performance of the contract.

The AWP is a plan submitted by the Contractor and approved by the Government that details the Contractor’s overall approach to meeting the Government’s requirements. The AWP establishes the contract year ceiling for current and anticipated Work Packages. DRD MA-025, Annual Work Plan (AWP). This includes:

• Existing, funded requirements

• Known, funded requirements but not ready to begin

• Known, unfunded requirements (seeking funds)

• Anticipated requirements based on historical data/transactions

The AWP is a flexible working document, incorporating changes as needed during the year (with COR concurrence, and CO approval) to accommodate emerging mission and customer requirements. The AWP shall be maintained in iSite.

Unknown requirements, when identified, that can be accomplished within an option period can be defined via Work Package or IDIQ Task Order.

2.2 PROGRAM MANAGEMENT

The Contractor shall perform cost, schedule, risk, and technical management of all NCAPS services, functions, and tasks. The Contractor is responsible for providing management support to all business and management functions necessary to execute and administer the NCAPS contract in compliance with applicable Federal and State laws; and Federal and Agency regulations, requirements, standards, policies, and procedures including, but not limited to, the documents specified in Attachment D, Applicable Documents List. The Contractor shall provide a management team focused on proactively integrating and optimizing all PWS elements to ensure excellent service performance and smooth delivery of services. The Contractor is accountable for the quality and timeliness of the products and services delivered under this contract.

The Contractor shall:

A. Ensure applications are registered using the designated NASA Application Tracking/Registration application, currently the Agency Application Rationalization Tool (AART).

B. Provide, implement, and maintain the Management Plan in accordance with DRD MA-001, Contract Management Plan.

C. Ensure delivery of all NCAPS products and services and that there is ready access to information and support during the Standard Hours of 7:30 a.m. to 5:30 p.m. local time, Monday through Friday, as stated in Attachment M, Service Delivery Standards and Metrics. Variations to the Standard Hours above are stated throughout the PWS for specific requirements and/or in specific catalog offerings.

D. Deliver all products and services within the timeframes defined below of being put on contract or being requested, unless there is an explicit required delivery standard defined in a PWS requirement. Requests for deviations from this timeframe may be submitted to the CO for review and approval.

i. Fixed Work Package, including Sub Work Packages and Task Order, including sub-tasks proposals within 10 business days.

ii. Cost Plus Fixed Fee Work Package, including Sub Work Packages and Task Order, including sub-tasks proposals within 10 business days.

iii. Fixed Price Team (FPT) and Incremental Team Unit (ITU) within 30 calendar days.

iv. Contract modification proposals within 15 business days.

v. Other Directed Costs (ODC) proposals within 10 business days.

vi. All other items where a timeframe is not defined within 60 calendar days.

E. Accomplish the management and technical control of all resources required to fulfill the requirements of this contract.

F. Manage an integrated, comprehensive workforce to provide customer support with the flexibility to respond to surge and unique requirements.

G. Manage all service levels and metrics in accordance with Attachment M, Service Delivery Standards and Metrics. Measure and report the service level objectives and performance for each of the services defined in this PWS in accordance with DRD MA-010, Service Delivery Standards and Metrics Report.

H. Prepare and submit monthly reports of project plans, status, and schedules in accordance with DRD MA-015, NCAPS Monthly Performance Management Review Report.

I. Prepare and conduct monthly Performance Management Reviews (PMR) including presentation and discussion of program priorities, project statuses, significant accomplishments, Risk Management, and problem areas.

J. Provide a monthly report with backup data to the Government on metrics associated with defined service level delivery in accordance with Attachment M, Service Delivery Standards and Metrics.

K. Manage counts for all standard products and services in accordance with Attachment P, Deliverable Products and Services (DPS).

L. Provide a monthly activity report describing the quantities of standard products and services delivered in accordance with DRD CD-002, Deliverable Products and Services (DPS) Report.

M. Officially notify Contracting Officer (CO) and Contracting Officer’s Representative (COR) of issues that adversely affect meeting contract requirements within 5 business days of start of issue and hold follow-on discussion(s) to address Government concerns as needed.

N. Respond to formal letters issued by CO regarding areas of non-compliance:

i. Identify root cause of the problem within 10 business days of receiving letter from CO.

ii. Deliver corrective action plan with milestones within an additional 10 business days.

iii. Obtain Government concurrence. If the corrective action plan is rejected or requires a revision, the Contractor has 5 business days to respond and deliver a new corrective action.

iv. Report on status and milestones weekly.

O. Track and provide status of official communication with the COR such as technical direction, requests for information, and transmittals.

P. Support as needed the NCAPS COR when presenting NCAPS issues and resolutions to the OCIO, other Agency organizations, or other external parties. This support will include such things as travel to meetings, video teleconferences, voice teleconferences, and the development of support documentation.

Q. Ensure Contractor employees utilize NASA-provided equipment to protect all Agency information by ensuring appropriate protection is implemented.

R. Establish, update, provide, and implement a Risk Management Approach in accordance with NPR 8000.4, Agency Risk Management Procedural Requirements.

S. Assist NASA with Risk Management consistent with the requirements defined by NPR 7120.7, NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements (e.g., Risk Management Plan, Analysis, and Tracking Reports).

Additionally, participate in recurring Risk Management meetings, and coordinate with Agency and Center Chief Information Officers (CIOs) in the execution of the Contractor’s responsibilities, as required.

T. Provide a NCAPS primary and alternate NEST Organizational Representative (NOR) to coordinate and approve all Government-furnished End User Services requirements by:

i. Coordinating, reviewing, and approving all orders through the Enterprise Service Desk

(ESD).

ii. Attending the monthly NOR meeting and communicating information internally as needed.

U. Hold a quarterly NCAPS management review with the Government to highlight areas of concern, to include changes to organizations, subcontractor agreements, performance metrics, identification of new risks, end-of-life status, safety and health data, and trends associated with DPS, trouble calls, and risks.

V. Conduct a monthly status review with the Agency CIO, Deputy CIO, or designee regarding contract performance, risks, and issues.

W. Align service processes with the current version of the ITIL Framework utilized by NASA, and current applicable OCIO policies and procedures, to establish common terminology and processes. Furthermore, ITIL is a commonly accepted information technology Service Management framework that provides a cohesive set of public and private sector best practices which are supported by a comprehensive qualifications scheme, accredited training and certification organizations, and implementation and assessment tools.

X. The Contractor shall review proposed changes and submit recommendations to NASA personnel within 10 business days on such things as:

i. Agency and Center IT Policies, architectures, standards, and procedures

ii. Recommend additions, modifications, and deletions as needed to ensure conformity with the NCAPS contract.

iii. Identify any adverse impacts to stability, Cybersecurity, cost, architecture, interoperability, compatibility, or service and recommend mitigation strategies.

Y. Provide a trained workforce that is certified and licensed, IAW Attachment U, Labor Category Positions and Descriptions, to satisfy all contract responsibilities, unless otherwise ordered and negotiated with the Government.

Z. Track and maintain training records, certifications, and licenses for Contractor employees.

AA. Provide an electronic copy of training records, certifications, and licenses to the CO or COR, upon request.

2.3 FINANCIAL MANAGEMENT

The Government intends to manage work performed under the NCAPS contract in Work Packages. Work Packages contain discrete elements of work directly traceable to the PWS but separated in order to facilitate Government approval, tracking, and reporting. Work Packages may contain subtasks as needed to reflect a lower level of tracking and reporting requirement.

The Contractor shall:

A. Perform all business and financial functions necessary to fulfill the requirements of this contract and integrate these functions across all areas of performance.

B. Provide on-going business analysis and respond within 5 business days to requests and inquiries from NASA relating to budget, schedule, Work Year Equivalents (WYE), cost plans, NASA-defined work packages, and cost performance. The Contractor shall not determine NASA budget policy, guidance or strategy but may be asked to provide details on the budget previously established by NASA and may be asked to provide recommendations to NASA on budget issues.

C. Submit all data elements required to produce financial reports, in accordance with DRD MA-013, Financial Management Report (533M, 533Q), and DRD MA-011, Cost Reports into the Government provided Contract Administration System across all PWS elements by Work Package and Task Order, including subtasks.

i. NF533M and 533Q

a. These forms are NASA’s official tools for cost type, price redetermination, and fixed price incentive contracts. Accurate, timely, and complete reporting through these tools will facilitate the Government’s ability to negotiate, if necessary, in a timely manner and in the best interest of the Government and the Contractor.

b. The 533M and 533Q shall be generated using the NASA-provided Contract Administration System. Electronic submission for Contractor data is required.

c. The NF533M shall be delivered no later than the 10th calendar day of each month for the previous calendar month of service performed. If the 10th calendar day of the month falls on a weekend or holiday, invoices will be submitted on the next business day following the weekend or holiday.

ii. Invoice Billing Details Report

a. Monthly invoice details shall be provided to the Government as defined by DRD

MA-011, Cost Reports.

iii. Cost Reports

a. To establish annual cost plans by Government Fiscal Year (GFY) and to provide monthly plan vs. actual reporting. The Cost Reports will be delivered monthly and are intended to provide sufficient insight into the Contractor’s cost performance such that cost analysis and corrective actions, if required, can be conducted in a timely manner.

b. Provide quarterly spend plan vs. actual updates and variance explanations to funding customers with details on current and estimated spend, in accordance with DRD MA-011, Cost Reports and DRD MA-013, Financial Management.

c. Provide input data to the NASA Planning, Programming, Budgeting, and Execution (PPBE) process in accordance with DRD MA-011, Cost Reports. This data shall incorporate annual requirements projections in the form of Spend plans that match the PPBE horizon of the next Execution Year plus 5 years as Budget Year (BY), BY+1, BY+2, BY+3 and BY+4.

D. Provide a cost reporting capability that aligns the NF533 Management Report with the Technology Business Management (TBM) Model https://www.cio.gov/policies-and-priorities/tbm/ in accordance with DRD MA-023, Technology Business Management (TBM) Reporting.

E. Assist in the preparation and status reporting of NASA-defined work packages including Service Requests, customer-funded and/or Center specific requests and services detail IAW DRD MA- 009, Documentation, Item j, Service Request Status Reports.

F. Assist in the preparation of financial data for business cases.

G. Assist in the preparation of Office of Management and Budget (OMB) Agency IT Portfolio data collection activities, as required.

H. Support the Business office with the development, documentation, maintenance, review, and approval by NASA of Service Level Agreements (SLAs) with each NASA Center and with Programs, Projects and Missions that require NCAPS services.

2.4 CONTRACT AND SUBCONTRACT ADMINISTRATION

The Contractor shall provide overall management of the contract requirements and effective, customer-focused contract management that results in consistently high-quality products and services.

The Contractor shall:

A. Implement strategies to establish and sustain amicable relations with labor unions if applicable.

B. Provide a single point of contact with contractual obligation authority to perform all contract administration functions and activities required for this contract. This point of contact shall have access to all contract administration data and information related to contract performance.

C. Provide a single point of contact for all subcontract management activities. This point of contact shall have access to all subcontract administration data and information related to contract performance.

D. Provide online access to contract administration information and other required data to the CO and designated personnel, in accordance with NASA Policy Directive (NPD) 1440.6, NASA Records Management.

E. Provide and maintain complete subcontract award documentation in accordance with the Contractor’s approved purchasing application, to support subcontract consent and subcontract audit activities.

F. Ensure delivery and archival, with accessibility by designated NASA personnel, of all documentation required by this PWS, as well as the documentation required by Attachment B, Data Requirements List and Data Requirements Descriptions. The activity shall include retaining and maintaining support documentation, controlling the documentation, and maintaining a document control list, naming convention, and storage control application.

G. In accordance with DRD MA-013, Financial Management Report (533M, 533Q), separately track all costs associated with contract changes issued by the CO, as well as IDIQ Task Orders, if requested in advance by the CO.

H. Report and document this work and fulfill the requirements of associated DRDs as outlined in Attachment B, Data Requirements List and Data Requirements Descriptions. Determine the data restriction that applies to each data deliverable and mark or transmit the data restriction in accordance with Attachment B, Data Requirements List and Data Requirements Descriptions.

I. Maintain and update the Organizational Conflicts of Interest (OCI) Avoidance Plan in accordance with DRD MA-014, Organizational Conflicts of Interest (OCI) Plan.

J. Prepare, submit, and maintain a Personnel Activity Report in accordance with DRD MA-009, Documentation, Item k, Personnel Activity Report.

K. Provide Small Business and Small Disadvantaged Business concerns the opportunity to receive a fair portion of procurement awards, in accordance with the approved Attachment V, Small Business Subcontracting Plan.

L. Maintain management and technical control of all subcontract and Contractor activities that are used to fulfill contract requirements.

M. Provide a single Point of Contact (POC) with binding contractual authority to perform all contract administration functions and activities required for this contract.

N. Ensure all Contractor personnel data is maintained in NASA Identity Management and Account Exchange (IdMAX) and Center Locator applications.

2.5 CONTRACT ADMINISTRATION SYSTEM

The iSite Contract Management Portal (iSite) will be provided by NASA to facilitate contract administration and oversight for the NCAPS Contract. iSite is a suite of tools which includes configurable workflows, financial reporting, configurable estimates, document repository, and automated email notifications among other functions based on NASA managed security controls.

More information may be found at the vendor’s website https://www.isitellc.com/icmp/.

NASA and the Contractor will use iSite for requesting new work, revising existing work, financial planning, reporting, actuals, deliverable submission, technical performance feedback gathering, and serve as the primary application for communicating financial and funding information to include monthly time phased baseline plans for all Work Packages and Task Orders. iSite will allow for the electronic initiation, receiving, review, approval, issuance, and modification of work under this contract.

The Contractor shall:

A. Use iSite to communicate, at a minimum, estimated costs and fee by month, posting actuals by Work Package, Task Order, and subtask which will inform financial/funding reports, provide technical proposals in response to requests for work, describe labor categories and hours proposed and consumed, and communicate subcontractor costs proposed and consumed during performance of this contract. Contractor will access data contained within iSite, controlled through security group permissions and role-based access.

B. Work with the Government to configure iSite for this contract as part of contract phase-in and ensure that the application is operational prior to the start date of this contract. This includes, but it is not limited to building and configuring workflows within iSite. Please reference Attachment R, CATS (Contract Administration Tools & Services) - iSite Contractor On-boarding Guide, for more details on the necessary information for iSite configuration.

C. Within 5 days of contract award, the Contractor shall provide a primary point of contact for these efforts.

D. Submit contract deliverables for review within iSite.

2.6 LIST OF CONTRACTOR PERSONNEL

The Contractor shall:

A. Maintain an online employee roster, accessible to the COR, and other designees, of individuals who perform work under this PWS as outlined in DRD MA-017, Work Year Equivalent (WYE Reports).

B. Provide a report of all employees working under this contract for cost validation and security reasons.

2.7 REPORTING AND OTHER INFORMATION REQUESTS

A. Respond to data calls and requests for reports and information, including scheduled and ad hoc requests within a Government specified amount of time.

B. Support, participate in, and contribute to OCIO requests such as: Key Performance Indicators and

Objectives and Key Results pertaining to Contractor performance, any similar requests for quantitative service delivery and operational metrics, or any other requests.

2.8 LOGISTICS

Provide support services as detailed throughout the PWS and supporting documents, in accordance with Agency Logistics policies, and Site/Center guidelines. These functions include property/inventory responsibilities as outlined in below.

The Contractor shall:

A. Coordinate with Center Logistics organizations to facilitate the transfer of property, if and when the need arises.

B. Perform property user functions as delineated in NFS 1852.245-71, Installation-Accountable

Government Property and NPR 4200.1, NASA Equipment Management Procedural Requirements.

C. Identify excess and obsolete out-of-service assets, coordinate and obtain concurrence from the relevant Technical Point of Contact (TPOC), and initiate excess request transaction in accordance with Agency, Center, and associated component facility guidelines, policies, and directives.

D. Ensure all items removed from service have all data removed prior to excess, in accordance with the applicable policies and procedures listed in Attachment D, Applicable Documents List (ADL).

E. Not remove the existing property tags or Equipment Control Number (ECN) permanently affixed to all existing assets.

F. Initiate property passes (NF-892) for all Installation Accountable Government Property (IAGP) that will be utilized at off-site locations in accordance with NPR 4200.1 if previously approved by the supported NASA Organization.

G. Support an annual physical inventory of all NCAPS IAGP in coordination with the NASA Supply and Equipment Management Officer (SEMO) for the NCAPS contract.

H. In extreme circumstances where a piece of equipment is not physically accessible due to access restrictions or location (geographical or otherwise), the Contractor may coordinate with the Center SEMO to utilize the process of generating an electronic signal (ping) to validate an asset is active and in use as inventoried. This process shall only be utilized after obtaining approval from the Center SEMO.

i. Documenting the generation and receipt of the electronic signal acknowledgement for the piece of equipment that is not accessible by the Contractor at the time the inventory is required to be conducted.

I. Comply with Agency, Center, and associated component facility guidelines, policies, and directives listed in Attachment D, Applicable Documents List (ADL); NFS 1852.245-71, Installation Accountable Government Property.

J. Ensure that any Contractor-provided storage facilities allow for protection of all items to which NASA has or will obtain title, in accordance with Government policy as listed in item (B.) above.

K. Prepare items for shipping with required documentation in accordance with Government policy as listed in item (I.) above.

L. Document transfer of property between Centers utilizing a Form NF 894, Property Accountability Transfer Form, or other NASA-designated form.

2.9 CONTRACT PHASE-IN MANAGEMENT

A. Provide the services necessary to perform all Phase-In activities in accordance with the schedule delineated in Attachment H, Phase-In Plan, and DRD MA-002, Contract Phase-In Plan.

B. Provide the services necessary to transition, and assume full contractual responsibility for, those

Center services identified for transition after the contract Phase-In period, IAW Attachment H, Phase-In Plan, and DRD MA-002, Contract Phase-In Plan.

2.10 PHYSICAL SECURITY MANAGEMENT

A. The contracted personnel must be able to obtain and maintain the requisite clearance level in accordance with NASA policy and procedures for system, data, or facilities to perform assigned duties when performance starts.

i. All personnel requiring TS and SCI access under this contract/order shall undergo a favorably adjudicated Tier 5 investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. The Tier 5 will be maintained current within 5-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or Phased Periodic Reinvestigation (PPR)) will be initiated prior to the 5-year anniversary date of the previous Tier 5.

ii. All personnel requiring Secret access under this contract shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

iii. Contract personnel found ineligible by the appropriate central adjudication facility for Top Secret or Secret access will not be allowed to support a NASA contract requiring Top Secret or Secret access.

B. All personnel performing on or supporting the NCAPS contract shall meet the requirements and be positively adjudicated for the OPM tiered investigation required for their position.

C. Implement a comprehensive security program consistent with NASA, Department of Defense (DoD), and Center-specific regulations and procedures as listed in Attachment D, Applicable Documents List (ADL), for the performance of the NCAPS mission and the protection of assigned assets and equipment.

D. Provide recurring supplemental reports (initial, change updates, etc.) to the DD 254, Contract Classification Specification to the NASA OPS, personnel security office as referenced in DRD MA-009, Documentation, Item m, Personnel Security Report.

E. Submit Visit Access Requests (VAR) through the NASA Office of Protective Services (OPS) at the visiting location.

F. Ensure Contractor personnel comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

G. Ensure Contractor personnel comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements will require the company to provide the Government with a written remediation/corrective action plan;

furthermore, failure to comply with such requirements can be cause for removal and the Contractor will not be able to provide service on this contract.

i. Contractor personnel with an incident or adverse information report who have had their access to classified information suspended will not be permitted to provide or to fill positions requiring access to classified information on a NASA contract/order.

ii. NASA retains the right to request removal of Contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

H. Observe and comply with the security provisions in effect at the NASA facility. Identification shall be worn and displayed as required.

I. Comply with the provisions of the NASA policy for handling classified material and producing deliverables.

J. Allow the Government access to the Contractor's facilities, installations, operations, documentation, databases, and personnel used in performance of the contract. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of data or to the function of IT systems operated on behalf of NASA or NASA partners, and to preserve evidence of computer crime.

2.11 EXPORT CONTROL

The following identifies the Export Control process support roles and responsibilities that the Contractor shall:

A. Comply with federal acquisition and import/export laws in accordance with the federal requirements codified in Section 514(a) of the Consolidated and Appropriations Act of 2021 and the U.S. export regulations, as governed by NPR 2190.1, NASA Export Control Program Operations Manual, and all other applicable policies, handbooks, specifications, and standards identified in the ADL.

B. Provide recommendations in support of the Export Control Process in accordance with DRD MA- 012, Export Control Plan and Reports.

C. Provide a monthly report of all export control process support activities in accordance with DRD MA-012, Export Control Plan and Reports.

2.12 EMERGENCY MANAGEMENT

Each Center CIO has key responsibilities related to the Center's Continuity of Operations Plan (COOP) in accordance with NPR 1040.1, NASA Continuity of Operations (COOP) Planning Procedural Requirements.

The following identifies the Emergency Management roles and responsibilities that the Contractor shall perform:

A. Provide each Center CIO (or designated representative) with the necessary support to meet COOP requirements by providing related IT materials, equipment, and emergency-essential personnel in support of the COOP.

2.13 SAFETY, HEALTH AND ENVIRONMENTAL (SHE) MANAGEMENT

The following identifies the Safety, Health, and Environmental (SHE) Management roles and responsibilities that the Contractor shall perform:

A. Establish and implement an industrial safety, occupational health, and environmental program that prevents employee fatalities, reduces the number of mishaps or close calls, reduces the severity of employee injuries and illnesses, and protects the environment through the ongoing planning, implementation, integration, and management control of these programs in accordance with DRD SA-001, Safety, Health, and Environmental (SHE) Plan. This includes flowing down requirements to subcontractors and holding subcontractors accountable for SHE performance.

B. Address in the SHE Plan, each of the following SHE core program requirements in detail that are applicable to the contracted effort and include a matrix that identifies where each requirement is addressed:

i. Management leadership and employee involvement.

ii. System and worksite analysis.

iii. Hazard prevention and control.

iv. SHE training.

C. Coordinate with each Center's Safety and Mission Assurance Directorate/Office to ensure compliance with that Center's specific safety, health, and environmental requirements, delineated in Attachment D, Applicable Documents List (ADL), and shall maintain an up-to-date listing of Center Safety Points of Contact to facilitate communications for each NASA Center where work is performed.

D. Report mishaps and safety statistics to the Center's Safety Office in accordance with DRD SA- 002, Mishap and Safety Statistics Reports.

E. Submit directly into the NASA Mishap Information System (NMIS) or use the formats listed in DRD SA-002, Mishap and Safety Statistics Reports, or electronic equivalent to report mishaps and related information required to produce the safety metrics.

F. Ensure that all work, including that which may require exposure to asbestos, is performed in accordance with all Federal, State, Local, and Center-specific safety, health, environment, and fire protection/prevention regulations and procedures, as well as the Contractor's Safety and Health Plan per DRD SA-001, Safety, Health, and Environmental (SHE) Plan, and each Center's applicable asbestos requirements.

G. Provide safety training, and protective equipment, as required by the approved SHE Plan, for Contractor personnel.

H. Provide, implement, and maintain procurement controls, including Contractor policies and procedures governing standards of conduct, procurement processes and practices, and the prevention of waste, fraud, and abuse, in accordance with DRD MA-009, Documentation, Item l, Contractor Code of Conduct Report.

2.14 SOFTWARE PURCHASES

A. Procure and deliver software, IAW DRD MA-009, Documentation, Item f, Commercial IT

Authorizations Report, the FAR, NASA IT Purchasing Guidance and applicable Application Guidance. Ensure all products and vendors are approved through the OCIO’s Commercial IT Request (CITR) application and an IT authorization has been obtained prior to making any purchases. No purchases of IT shall be made prior to authorization. Prepare and submit monthly procurement data in accordance with DRD MA-009, Documentation, Item f, Commercial IT Authorizations Report.

B. Obtain approval in iSite prior to making any purchases.

C. Maintain responsibility for software licenses, and software support contracts as identified in Work

Package or Task Orders.

D. Prepare and deliver the Software License Utilization Report for all purchased and maintained software IAW DRD MA-009, Documentation, Item o, Software License Utilization Report. This report shall include, but is not limited to: purchased versus used, inactive users, license costs, license renewal dates.

E. Maintain purchasing documentation for all software purchased under this contract, to include proof of purchase and license entitlements. Make available to the Government upon request.

F. Negotiate and establish maintenance agreements and software license renewals with vendors and report the status of this activity.

G. Request approval to renew existing software and maintenance agreements in iSite a minimum of 90 days prior to expiration.

H. Track and make available to the Government the status of all individual procurements from purchase request through final purchase order, delivery, and acceptance.

I. Comply with the Agency Supply Chain Risk Management (SCRM) process, NFS 1852.239-74, Information Technology System Supply Chain Risk Assessment, 1852.239-73, Review of the Offeror’s Information Technology Systems Supply Chain, and National Institute of Standards and Technology (NIST) Special Publication 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, J. Ensure that all procured IT meets National Defense Authorization Act (NDAA) Section 889, Prohibition On Certain Telecommunications and Video Surveillance Services or Equipment.

2.15 RECORDS AND DATA MANAGEMENT

The NASA OCIO is responsible for ensuring proper management of the records created in the conduct of the business and missions of the Agency. A community of records management professionals in the Agency provide policy and leadership for Records Management (RM) in accordance with NPD 1440.6, NASA Records Management, NASA Procedural Requirements, and NPR 1441.1, NASA Records Management Program Requirements.

The Contractor shall:

A. Maintain records management in accordance with NPD 1440.6I, NASA Records Management, and NASA Procedural Requirements (NPR) 1441.1E, NASA Records Retention Schedules.

B. Respond to Government records requirements within 10 business days.

C. Maintain the raw data used to create contract metrics in Attachment M – Service Delivery

Standards and Metrics.

2.16 SOFTWARE ASSURANCE AND SOFTWARE SAFETY

The Contractor is responsible for establishing a software assurance and software safety program.

A. Adhere to the requirements as defined in NPR 7150.2, NASA Software Engineering

Requirements, and NPR 7120.7, NASA Information Technology Program and Project Management Requirements.

B. Establish and document software assurance procedures, processes, tools, techniques, and methods to be used for the performance of software assurance activities.

C. Accept responsibility for the full System Development Life Cycle (SDLC) maintenance and updates of custom, Government Off-The-Shelf (GOTS), Commercial Off-The-Shelf (COTS), and open-source software installed on Government-furnished systems and devices such as desktop/laptop computer seats. This includes end of mainstream or regular support.

2.17 IT SERVICE MANAGEMENT

Currently NASA IT Service Management is based on ITIL but, the tools and implementation across the areas of this PWS vary between Service Lines and Centers. Variations of Jira, GitLab, Maximo, ServiceNow, Remedy and other IT Service Management (ITSM) tools are currently used across NASA. The NCAPS contract will be awarded during a period of significant transformation for the NASA Office of the Chief Information Officer. This effort will develop a plan to standardize ITSM process and governance, tools, and the way NASA OCIO delivers services to improve IT efficiency, effectiveness, customer experience, and reduce cost.

The Contractor shall:

A. Continue to support, maintain, and operate the existing ITSM tools and enable the service delivery ITSM process, governance, and tool transition happening within the NASA

OCIO.

B. Support necessary integration and cooperation with the NASA service delivery programs and contractors.

C. Establish an IT Service Management framework in compliance with ITIL and NASA Policies, Directives, and Handbooks.

2.18 CONFIGURATION MANAGEMENT (CM)

The Contractor is responsible for developing and implementing a CM program for all applications, hardware, software, licensing, components, documentation, forms, services, and processes utilized in performance of this contract.

A disciplined CM process ensures that the product definition information and changes to that information are identified, approved, verified, and recorded in sufficient detail to produce and support the product throughout its life cycle; and that the product conforms to the specified requirements. The CM processes result in accurate configuration information to facilitate product interchangeability and reproducibility, and thus contributes to continuous safe and effective product development, production, utilization, support, and retirement.

The Contractor shall:

A. Develop, maintain, and adhere to a Service Asset and Configuration Management (SACM) Plan in accordance with DRD MA-005, Service Asset and Configuration Management (SACM) Plan, for all requirements of the contract.

B. Maintain accurate and current documentation of application, middleware and database configurations, continuously updating all configuration changes, operations procedures, and application-level diagrams that are updated IAW DRD MA-009, Documentation, Item b, Configuration Documentation/ Drawings. All relevant changes shall be made within 20 business days.

2.19 QUALITY ASSURANCE AND MANAGEMENT

The Contractor Shall:

D. Maintain a quality system compliant with ISO 20000, ITIL, and Capability Maturity Model

Integration (CMMI) Level 3.

E. Provide and implement a Quality Plan in accordance with DRD QE-001, Quality Plan, and

Quality Management System (QMS) to ensure consistent and effective delivery of the level of quality performance stipulated throughout the PWS and be fully responsive to Attachment M, Service Delivery Standards and Metrics.

i. Include a systematic approach to maintain and improve operational and service delivery performance to include the establishment of processes and procedures to continually monitor work performance and identify service deficiencies.

ii. Detail and implement planned quality controls.

F. Gauge independently the compliance and the effectiveness of the Quality Plan, customer satisfaction levels, and trends identified through performance metric measurements and report findings to NASA IAW DRD QE-001, Quality Plan.

G. Conduct internal audits to verify whether services are delivered and ensure that corrective actions if needed are taken, issues are fully addressed and documented. Corrective actions shall be consistent with the definitions in NPD 8730.5, NASA Quality Assurance Program Policy.

H. Provide and implement corrective action plans to ensure performance metrics and associated Service Level Agreements are successfully met.

I. Provide reports and recommendations to the COR and Program Management on issue resolutions, performance mechanisms, quality improvement initiatives, etc.

J. Devise and integrate framework/methodology for measuring performance requirements for all areas of the PWS. This includes establishing a continuous improvement program, quality governance structures and processes, audit and surveillance methods, customer feedback mechanisms, data collection and analysis methods, and reporting tools, in accordance with Attachment M, Service Delivery Standards and Metrics.

K. Provide NCAPS support for NASA-led audits in Quality Assurance and Management; monitor implementation and effectiveness of corrective actions.

L. Maintain trusted partnerships and relationships with customers and other major stakeholders to obtain and provide data/customer feedback designed to improve operations

M. Provide independent assurance of the adequacy of quality functions per NPR 7120.7, NASA Information Technology and…