Attach 2. draft_DS_EX_CTO FO SOW_02.23.2026.pdf

DRAFT

DS/EX/CTO Front Office Statement of Work

STATEMENT OF WORK

For

Enterprise Services

To

Bureau of Diplomatic Security

Office of the Chief Technology Officer

Front Office Contract Operations Support

Enterprise Services, ##AQMM##A###, PoP

P a g e | ii

Contents

1.0 Background

2.0 Purpose and Objective

3.0 Scope of Work

3.1 Bureau Information System Security Officer (BISSO)

3.1.1 Cybersecurity

3.1.2 Security Compliance

3.1.3 Security Configuration Management

3.1.4 Enterprise Cyber Risk Management (ECRM)

3.2 Bureau Chief Data Officer BCDO

3.2.1 Data Analytics, AI, and Mission Enablement

3.2.2 Data Governance, Management, and Sharing

3.3 Technology Business Strategy (TBS)

3.3.1 TBS Program Management Office (PMO)

3.3.2 Strategic Planning and Modernization (SPM)

3.3.3 Project and Portfolio Management (PPM)

3.3.4 Customer Business Engagement (CBE)

3.3.5 Enterprise Risk Management (ERM)

3.3.6 Enterprise IT Governance

3.3.7 Procurement and Acquisition Management Support

3.3.8 Independent Assessment Services

3.4 Program Oversight and Advisory Office (POAO)

3.4.1 Administrative Services

3.4.2 Technology Business Management (TBM) Advisory

3.5 Contract Administrative Requirements and Reporting

4.0 Deliverables

4.1 Bureau Information System Security Officer (BISSO)

P a g e | iii

4.1.1 Cybersecurity

4.1.2 Security Compliance

4.1.3 Security Configuration Management

4.1.4 Enterprise Cyber Risk Management (ECRM)

4.2 Bureau Chief Data Officer (BCDO)

4.2.1 Data Analytics, Artificial Intelligence (AI), and Mission Enablement ...16

4.2.2 Data Governance, Management, and Sharing

4.3 Technology Business Strategy (TBS)

4.3.1 TBS Program Management Office (PMO)

4.3.2 Strategic Planning & Modernization

4.3.3 Project and Portfolio Management (PPM)

4.3.4 Customer Business Engagement (CBE)

4.3.5 Enterprise Risk Management (ERM)

4.3.6 Enterprise IT Governance

4.3.7 Procurement & Acquisition Management Support

4.3.8 Independent Security Assessment Services

4.4 Program Oversight and Advisory Office (POAO)

4.4.1 Strategic Planning and Reporting

4.4.2 Technology Business Management (TBM)

4.5 Contract Administrative Requirements and Reporting

5.0 Deliverables Schedule

6.0 Acceptance Criteria and Compliance Standards

6.1 General Compliance Requirements

6.2 Acceptance Criteria

6.2.1 Deliverable Review and Approval

6.2.2 Submission Format

6.2.3 Inspection and Notification

P a g e | iv

6.2.4 Correction of Deficiencies

6.2.5 Contract Closeout

6.3 Performance Standards

7.0 Adherence to Policy or Standards

7.1 Language Requirements

7.2 Data Rights and Ownership

7.3 Nondisclosure Requirements

7.4 Privacy Act Compliance

7.5 Information Assurance and IT Security

7.6 IT Security Training

7.7 Dissemination of Information

7.8 Section 508 Compliance

7.9 Additional Compliance Requirements

8.0 Government-Furnished Equipment / Information

8.1 General Requirements

8.2 Government-Furnished Equipment and Services

8.3 Management and Accountability

8.4 Unique Items and Highlights

8.5 Compliance Requirements

9.0 Standard Work Hours

10.0 Place of Performance

11.0 Security Requirements

11.1 Personnel Security Clearances

11.2 Facility Security Clearance

11.3 Visit Authorization Requests (VARs)

11.4 Building Access and Identification

11.5 Handling Classified and Sensitive Information

P a g e | v

11.6 Foreign National Restrictions

11.7 Mandatory Security Training

11.8 Reporting Requirements

11.9 Compliance Requirements

11.10 Unique Items and Highlights

12.0 Travel

13.0 Point of Contact

14.0 Funding

14.1 Contract Vehicle and Type

14.2 Invoice Approval

14.3 Surge Activities

14.3.1 Key Requirements

14.3.2 Surge Activation Protocol

14.3.3 Coordination and Approval

14.3.4 Execution of Activities

14.3.5 Compliance Monitoring and Reporting

14.4 Other Direct Costs

14.4.1 Separate Contract Line-Item Numbers (CLINs)

14.4.2 Documentation and Compliance

14.4.3 Monitoring and Reporting

14.5 Equipment Procurements

14.5.1 Enterprise IT Component Upgrades and Replacement

14.5.2 Order Level Material (OLM) Provisions

Appendix A – Front Office Performance Work Statement .................................... A1

1.0 Introduction ................................................................................................... A1

2.0 Performance Requirements ........................................................................... A1

2.1 Administrative Deliverables and Actions .................................................. A1

P a g e | vi

2.1.1 Reports .................................................................................................... A2

2.1.2 Project Plans ............................................................................................ A3

2.2 Technical Agile and Software Development Lifecycle (SDLC) Deliverables and Actions ....................................................................................................... A3

3.0 PWS Deliverables/Delivery Schedule ........................................................... A5

4.0 Acceptance Criteria and Compliance Standards ........................................... A9

5.0 Adherence to Policy or Standards ................................................................. A9

6.0 Point of Contact ............................................................................................. A9

Appendix B – Required Resources and Position Descriptions ............................... B1

Position Descriptions ........................................................................................... B4

Tables

Table 1 Deliverables Schedule Table 2 PWS Deliverables Schedule ...................................................................... A5 Table 3 Required Resources ................................................................................... B1

1.0 Background

The U.S. Department of State leads American diplomacy, with the Secretary of State serving as the President’s principal foreign policy advisor. The Department’s workforce includes over 12,000 Foreign Service employees representing the United States abroad, more than 9,000 Civil Service employees providing continuity and expertise, and over 37,000 Foreign Service National Staff supporting operations at overseas posts.

The Bureau of Diplomatic Security (DS) ensures a safe and secure environment for U.S. foreign policy worldwide. DS designs and manages security programs for diplomatic missions, investigates passport and visa fraud, conducts personnel security investigations, and protects the Secretary of State and visiting dignitaries.

Under the Omnibus Diplomatic Security and Antiterrorism Act of 1986, DS is responsible for safeguarding life, property, and information.

Within DS, the Office of the Chief Technology Officer (DS/EX/CTO) drives the Bureau’s mission through technology and data services. Led by the Chief Information Officer (CIO), DS/EX/CTO manages IT program requirements and oversees critical functions, including Application Support, Service Desk Support, Software Development, System Networking, Enterprise Architecture, Strategic Planning, Customer Engagement, Risk Management, and Business Analysis. The office is organized into four divisions: the Front Office (FO), Integrated Systems Division (ISD), Enterprise Production Services Division (EPSD), and Mission Technology Solutions (MTS) 1.

DS/EX/CTO manages over 37 mission-critical applications and 75 concurrent IT projects, integrating cloud-based and on-premises systems to meet evolving security needs. The office collaborates with the Department, other U.S. Government entities, and Intelligence and Law Enforcement communities to ensure seamless operations.

It ensures compliance with federal cybersecurity mandates, implements NIST-compliant policies, and supports the Development, Modernization, and Enhancement (DME) of DS systems. By delivering secure, adaptable, and

1 The organization will undergo a planned organizational change that includes renaming its divisions. While the division names and leadership titles may change, the scope of work, roles, and responsibilities outlined in this document will remain unchanged. Any references to specific divisions or leadership should be understood to apply to their future equivalents under the new naming structure.

P a g e | 2 innovative IT solutions, DS/EX/CTO enables DS to meet mission requirements and advance U.S. diplomacy in all environments.

2.0 Purpose and Objective

The purpose of this contract is to support the Front Office (FO) of the Bureau of Diplomatic Security’s Office of the Chief Technology Officer (DS/EX/CTO) in advancing Bureau-wide IT and data priorities. The Contractor shall provide enterprise services that strengthen governance, collaboration, and modernization across DS/EX/CTO divisions and ensure alignment with Department-level CIO strategies.

The Contractor will deliver support in the following key areas:

• Information Security: Led by the Bureau Information System Security Officer

(BISSO), ensuring compliance with federal security standards, mitigating risks, and protecting DS’s IT systems and sensitive data through security monitoring, safeguards, secure development, and cyber threat response.

• Data and Analytics: Led by the Bureau Chief Data Officer (BCDO), driving mission value through data governance, analytics, Artificial Intelligence (AI) strategies, and fostering a data driven culture and ensuring data assets are accessible, reliable, and secure.

• Technology Business Strategy: Aligning IT investments and capabilities with mission outcomes using business industry frameworks, Capital Planning and Investment Control (CPIC), and evidence-based decision making. This includes modernizing platforms, embedding Zero Trust principles, and rationalizing technology portfolios to reduce technical debt and improve agility and resilience.

• Program Oversight: Providing administrative, programmatic, and strategic advisory services to ensure effective execution of IT activities across

DS/EX/CTO.

The Contractor will deliver flexible, targeted support through dedicated Contract Line-Item Numbers (CLINs) for labor, travel, training, and other services, enabling efficient resource management throughout the Period of Performance (PoP). This contract ensures DS/EX/CTO’s IT and data initiatives advance the mission of safeguarding U.S. diplomatic personnel, missions, and information worldwide.

P a g e | 3

3.0 Scope of Work

The Contractor shall provide comprehensive support for all DS/EX/CTO and CIO functions, including mission technology solutions, integrated technology operations, and organizational initiatives. Services must comply with all applicable federal, Departmental, Bureau, and organizational mandates, policies, and regulations.

The Contractor shall deliver high-impact services that enhances the CIO’s ability to govern, secure, and modernize the technology environment. This includes aligning investments, risk management, data, and service delivery with mission objectives.

The Contractor must demonstrate attention to detail, produce clear and thorough documentation, and effectively lead cross-functional teams. All work must adhere to federal mandates, regulatory requirements, and organizational priorities. Regular communication and reporting are required to ensure transparency and accountability.

3.1 Bureau Information System Security Officer (BISSO)

The Contractor shall provide enterprise-level information security services to ensure that DS/EX/CTO IT systems are secure, compliant, and resilient across all operational environments. Contractor activities shall enable DS to manage risk, maintain regulatory compliance, protect mission-critical systems, and support hybrid IT operations.

3.1.1 Cybersecurity

The Contractor shall:

• Continuously monitor systems and infrastructure for security threats, identify vulnerabilities, and prioritize remediation efforts based on risk.

• Collaborate with development teams to embed security practices into the SDLC and automate security testing in CI/CD pipelines to identify and address vulnerabilities.

• Evaluate changes to system architecture and production environments to identify deficiencies, non-compliance, and risks, providing actionable recommendations for improvement.

• Conduct security testing of applications, systems, and infrastructure to identify weaknesses and provide actionable recommendations for remediation.

• Support protection of sensitive communications and cryptographic materials in alignment with federal policies and requirements.

P a g e | 4

• Provide leadership with actionable insights, awareness briefings, and training to strengthen cybersecurity knowledge and readiness.

3.1.2 Security Compliance

The Contractor shall:

• Ensure DS IT systems and operating environment comply with federal, Department, and Bureau security requirements, including FISMA and NIST RMF mandates.

• Provide leadership with clear documentation demonstrating system compliance, authorization status, and readiness for audits.

• Support risk assessments, Privacy Impact Assessments (PIAs), contingency planning, and accreditation processes.

• Deliver reporting that informs leadership of compliance status, corrective actions, and risk posture.

• Identify opportunities to improve compliance practices and streamline security operations.

3.1.3 Security Configuration Management

The Contractor shall:

• Maintain accurate and compliant inventories of DS IT system components, configurations, and baselines.

• Ensure systems are configured to meet Department security standards and recognize best practices.

• Identify deviations from standards and recommend corrective actions to maintain compliance and operational integrity.

• Provide leadership with insights and reports on configuration compliance, risks, and remediation progress.

3.1.4 Enterprise Cyber Risk Management (ECRM)

The Contractor shall:

• Provide enterprise-wide risk oversight, assessing, documenting, and prioritizing risks to systems, operations, and third-party integrations.

• Advise leadership on residual risk and mitigation strategies to enhance system resilience and operational continuity.

• Monitor trends in enterprise risk and provide actionable reporting to support decision-making.

P a g e | 5

• Ensure alignment of risk management practices with Zero Trust principles, federal directives, and Department policies.

3.2 Bureau Chief Data Officer BCDO

The Contractor shall provide enterprise-level support for data management, analytics, and AI initiatives to ensure DS/EX/CTO maximizes the value of its data assets, fosters a data-driven culture, and supports mission outcomes. Contractor activities shall align with federal, Department, and Bureau policies.

3.2.1 Data Analytics, AI, and Mission Enablement

The Contractor shall:

• Develop and implement strategies that leverage data, analytics, and AI to generate actionable insights and enhance mission effectiveness.

• Support stakeholders in identifying priorities and designing analytic solutions that address operational and strategic challenges.

• Provide measurable outcomes from analytics and AI initiatives, including improvements in decision-making, efficiency, and mission impact.

3.2.2 Data Governance, Management, and Sharing

The Contractor shall:

• Establish governance frameworks that ensure data is accurate, reliable, secure, and traceable.

• Support enterprise-wide data management practices to enhance quality, usability, and compliance with federal and Department policies.

• Facilitate secure data sharing across internal and external stakeholders, while ensuring ethical and responsible use of data and AI.

• Provide leadership with reporting and insights on data quality, availability, and usage to support strategic decisions.

• Support open data initiatives and transparency efforts that promote effective mission outcomes and evidence-based decision-making.

3.3 Technology Business Strategy (TBS)

The TBS Group enables DS/EX/CTO to align IT operations with organizational priorities through strategic planning, portfolio management, risk oversight, governance, and customer engagement. Contractor support shall ensure that DS/EX/CTO initiatives are planned, executed, and monitored in a manner that is transparent, evidence-based, and aligned with Department and federal standards.

P a g e | 6

3.3.1 TBS Program Management Office (PMO)

The Contractor shall:

• Provide centralized program management support that enables planning, governance, reporting, and administrative coordination across DS/EX/CTO.

• Maintain enterprise-level program plans and schedules that capture priorities, deliverables, and milestones for CIO review and approval.

• Provide timely status reporting and executive-level briefings that highlight progress, risks, and required decisions.

• Ensure risks, issues, and decision tracking is integrated with enterprise risk management practices.

• Facilitate governance meetings and maintain supporting records to ensure accountability and traceability.

• Manage authoritative repositories for DS/EX/CTO program artifacts and agreements to preserve accuracy and version control.

• Provide logistical and knowledge management support to ensure effective collaboration and decision-making.

3.3.2 Strategic Planning and Modernization (SPM)

The Contractor shall:

• Develop and maintain DS/EX/CTO’s enterprise IT strategy and execution roadmap aligned with mission outcomes and statutory guidance.

• Support multi-year and annual planning efforts that define priorities, measurable outcomes, and align with available funding.

• Deliver domain strategies (e.g., Cloud, Applications, End-User Computing, Identity) that strengthen modernization, resilience, and risk reduction.

• Incorporate data strategy, governance, and quality practices in support of the

Bureau Chief Data Officer.

• Promote adoption of IT and modernization initiatives through organizational change management, communication, and training.

• Manage the lifecycle of DS/EX/CTO IT policies to ensure relevance, compliance, and accessibility.

• Provide executive-level performance reporting that links investments and initiatives to mission outcomes.

P a g e | 7

3.3.3 Project and Portfolio Management (PPM)

The Contractor shall provide comprehensive project management services supporting both Agile and traditional methodologies based on project needs, complexity, and government direction. The approach shall be flexible to accommodate varying project types, stakeholder requirements, and organizational preferences while ensuring effective delivery of DS initiatives.

• Develop comprehensive project charters, plans, work breakdown structures, schedules, and resource allocation plans for multiple project areas to include software development, operational asset deployments and upgrades as well as other modernization requirements supported by project management disciplines

• Create and maintain project schedules, track milestones, manage dependencies, and report on progress

• Develop project budgets, track expenditure, manage cost baselines, and provide financial reporting

• Identify, assess, track, and mitigate project risks throughout the project lifecycle

• Identify stakeholders, manage communications, facilitate meetings, and ensure stakeholder engagement

• Manage scope changes, assess impacts, and coordinate approval processes

• Ensure deliverables meet quality standards and customer requirements

• Coordinate team assignments, manage resource conflicts, and optimize resource utilization

• Maintain master project schedules using project management tools, ensuring time accounting information is tracked and used to validate contract invoices

• Conduct predetermined control gates as technical and management reviews to ensure project acceptability and progression

• Follow CTO's standard Project Life Cycle (PLC) processes and Change and

Configuration Management processes for IT projects to include but not limited to software development, IT modernization, enterprise level configuration change.

• Control Gates: Control gates are predetermined technical and management reviews conducted during each project to ensure that maintenance, development and implementation activities meet acceptable standards and that the project should proceed.

P a g e | 8

• For all IT projects, the contractor shall follow the CTO’s standard Project Life Cycle (PLC) processes, CTO’s Change and Configuration Management processes, and the DOS MSP methodology.

• The contractor shall adhere to the guidelines, methodologies, and best practices of the following standards organizations to the extent practicable: Project Management Institute (PMI), Software Engineering Institute (SEI), International Organization for Standardization (ISO 9001), Agile Software Development Best Practices.

• Implement Agile practices including SCRUM, KANBAN, and Lean, as appropriate to maximize value for DS customers

• Use scaled Agile approaches to align multiple teams, foster collaboration, and synchronize efforts across the organization

• Administer repositories to track requirements, record estimates for features and user stories, and support CI/CD pipelines

• Facilitate all Agile ceremonies including sprint planning, daily standups, sprint reviews, and retrospectives

• Identify and remove obstacles that prevent teams from achieving sprint goals and deliverables

• Coach development teams on Agile principles, practices, and continuous improvement methodologies

• Lead continuous process improvement initiatives for all Agile practices in collaboration with DS FTEs to enhance team effectiveness and delivery quality

• Facilitate communication between development / implementation teams and stakeholders, ensuring transparency and alignment

• Track and report on team performance, velocity, and sprint progress using Agile metrics

• Mediate conflicts within teams and help resolve issues that impact team performance

• Provide training and mentoring to team members on Agile methodologies and best practices

• Coordinate dependencies and risks among independent Agile teams across multiple projects

P a g e | 9

• Foster collaboration and knowledge sharing between teams working on related initiatives

• Ensure Agile practices integrate effectively with Quality Assurance, Security Auditing, and Management Reporting activities

• Propose tools and processes to manage portfolios using Agile methodologies while encouraging innovation and emerging technologies

• Maintain a schedule in MS Project Server or a similar tool, ensuring project time accounting information is tracked

• Provide Integrated Master Schedule management across all task areas to ensure that workloads and resources are allocated to address the Bureau’s mission priorities

• Stakeholder relationship management

• Provide portfolio management support that prioritizes, plans, and monitors IT investments and initiatives in alignment with CPIC, TBM and Department standards.

• Maintain traceability between investments, costs, and mission outcomes to enable informed decision-making.

• Establish consistent lifecycle standards, review criteria, and success measures for DS/EX/CTO managed projects.

• Support integration of portfolio management data with financial, workforce, and enterprise architecture metrics.

• Maintain a current portfolio inventory that informs application / systems rationalization and modernization decisions.

• Provide capacity and dependency management to enable sequencing of initiatives across DS/EX/CTO.

• Assess benefits realization and ensure lessons learned inform future planning and governance.

• Deliver portfolio-level reporting that captures cost, schedule, risk, performance, and outcomes.

3.3.4 Customer Business Engagement (CBE)

The Contractor shall:

• Operate as the Bureau’s entry point for IT services, converting customer needs and formalized business requirements into prioritized and resourced roadmaps.

P a g e | 10

• Implement structured engagement processes that ensure alignment between customer requirements, governance bodies, and portfolio planning.

• Develop and maintain partnership agreements and service-level expectations to ensure accountability and transparency.

• Establish methods to capture and assess customer feedback, satisfaction, and service effectiveness.

• Support organizational change management to drive adoption of DS/EX/CTO services and modernization efforts.

• Provide reporting on service quality, customer engagement outcomes, and realized benefits.

3.3.5 Enterprise Risk Management (ERM)

The Contractor shall:

• Support a unified enterprise risk management program that integrates business, cybersecurity, supply chain, and privacy risks.

• Ensure risks are assessed, documented, and monitored against approved thresholds and Department standards.

• Provide oversight of security, compliance, and resilience measures, ensuring risks are addressed in a timely and measurable manner.

• Facilitate business continuity and incident response exercises, documenting outcomes and corrective actions.

• Deliver enterprise-level risk reporting that identifies trends, informs governance decisions, and integrates with performance monitoring.

3.3.6 Enterprise IT Governance

The Contractor shall:

• Support the establishment and operation of enterprise IT governance boards and ensure their outputs are transparent, documented, and traceable.

• Integrate governance processes with capital planning, business management, and enterprise architecture standards.

• Maintain authoritative governance and policy repositories that support compliance, oversight, and audit readiness.

• Manage the lifecycle of governance and policy artifacts to ensure alignment with

Department standards.

P a g e | 11

• Provide governance reporting that links risks, budgets, standards, and compliance outcomes in a manner that supports oversight and decision-making.

• Ensure portfolio decisions and approvals are evidence-based, traceable, and available for audit review.

3.3.7 Procurement and Acquisition Management Support

The Contractor shall:

• Deliver IT procurement and acquisition management support that meets compliance requirements and ensures timely execution.

• Provide an IT acquisition forecast that aligns with mission priorities and budget cycles.

• Identify and recommend contract vehicles based on market research and alignment with DS/EX/CTO strategy.

• Prepare Purchase Request (PR) packages, including required documentation such as SOWs, Performance Work Statement’s (PWSs), Independent Government Cost Estimates (IGCEs), evaluation criteria, and compliance materials (e.g., Section 508, NDAA Section 889, Supply Chain Risk Management (SCRM), FedRAMP).

• Facilitate solicitation processes and support non-conflicted evaluations, ensuring proper handling of questions and answers (Q&A), evaluation materials, and sensitive documentation.

• Track and manage contract periods of performance (PoP), renewals, and procurement metrics, including lead times and forecast accuracy.

• Provide tools, templates, and guidance to streamline acquisition processes and improve efficiency.

• Maintain accurate and auditable acquisition records, ensuring traceability and compliance with applicable standards.

3.3.8 Independent Assessment Services

The Contractor shall:

• Provide impartial assessment services that ensure DS IT systems are evaluated against federal standards and Department requirements, supporting risk-based decision-making and compliance with statutory mandates.

• Specifically, the Contractor shall:

P a g e | 12

• Conduct independent security control assessments for DS IT systems in accordance with NIST and Department standards, ensuring impartiality from other cybersecurity and IT operations.

• Provide documented evaluation of system compliance, risks, and deficiencies in a format that supports authorization and oversight processes.

• Deliver reports and recommendations that clearly communicate vulnerabilities, remediation priorities, and residual risk to Authorizing Officials and DS leadership.

• Validate that risk mitigation and remediation actions are effectively implemented and documented to support accreditation and certification activities.

• Provide leadership with metrics and trend analysis on assessment effectiveness and organizational risk posture.

• Upon request, provide independent evaluations in specialized domains, including enterprise architecture, Technology Business Management (TBM)/cost integrity, supply chain software risk, and international certification readiness.

3.4 Program Oversight and Advisory Office (POAO)

The Program Oversight and Advisory Office provides enterprise-level administrative, governance, and advisory support that enables DS/EX/CTO leadership to operate efficiently, comply with federal mandates, and make evidence-based decisions. The Contractor shall ensure activities are conducted in a manner that promotes transparency, accountability, and alignment with organizational goals.

3.4.1 Administrative Services

The Contractor shall:

• Provide enterprise-level administrative support that enables DS/EX/CTO leadership to manage priorities, coordinate tasks, and respond to Department and interagency requirements.

• Ensure leadership has timely access to accurate documents, deliverables, and decision materials.

• Manage the flow of approvals and correspondence to ensure accountability, traceability, and responsiveness.

• Serve as the primary coordination point for internal and external inquiries to ensure effective communication and resolution.

P a g e | 13

• Support leadership participation in strategic planning and annual operating planning efforts by providing consolidated inputs and materials.

• Facilitate travel, logistics, and meeting arrangements to ensure leadership engagement is efficient and effective.

• Provide administrative support that enhances the efficiency of IT program operations and ensures alignment with organizational objectives.

3.4.2 Technology Business Management (TBM) Advisory

The Contractor shall:

• Provide advisory services that ensure DS/EX/CTO’s TBM practices are fully compliant with federal mandates and Department guidance.

• Enable DS/EX/CTO to align IT costs, resources, and investments with mission outcomes through accurate and transparent cost models.

• Support DS/EX/CTO in integrating financial, operational, and IT data to provide leadership with actionable insights into technology spending.

• Ensure TBM reporting and analysis meet FITARA, CPIC, and OMB transparency requirements.

• Provide leadership with timely reports and dashboards that link IT spending to business outcomes, supporting strategic and evidence-based decision-making.

• Enhance collaboration across finance, operations, and IT stakeholders to strengthen accountability and resource optimization.

3.5 Contract Administrative Requirements and Reporting

This section defines the administrative requirements and reporting methods for managing the contract and evaluating Contractor performance throughout the PoP.

It ensures transparency, accountability, and alignment with contract objectives. The Contractor shall:

• Perform contract project administration and project management actions as outlined in the DS/EX/CTO FO PWS, found in Attachment A.

• Execute Agile processes and deliverables integrated into DS/EX/CTO’s daily operations, as specified in Attachment A - FO PWS.

• Fulfill Software Development Lifecycle (SDLC) requirements embedded in

DS/EX/CTO’s routine operations, as detailed in Attachment A - FO PWS.

P a g e | 14

4.0 Deliverables

The Contractor shall provide deliverables that ensure efficient, accurate, and timely execution of all tasks in compliance with contract requirements, federal regulations, and Department of State policies. Deliverables must adhere to applicable standards, including FAR, DOSAR, DOSAM, FITARA, FISMA, CIO Act, PMI, and Agile methodologies, as relevant.

• Ownership and Compliance: All deliverables become Government property and must comply with FOIA requirements unless marked proprietary and approved by the Government.

• Submission Format: Deliverables shall be submitted electronically using Microsoft Office Suite tools unless otherwise directed by the Contracting Officer’s Representative (COR). Hard copies may be requested by the COR.

The DS/EX/CTO FO PWS (found in Attachment A of this document) supplements this SOW by detailing the activities and deliverables required to assess, monitor, and manage contractor performance and contract administration. While this SOW specifies IT-related tasks, technical requirements, and deliverables, the FO PWS outlines oversight and evaluation methods to ensure compliance, quality, and alignment with expectations. The deliverables schedule and acceptance requirements specific to DS/EX/CTO FO are included in this SOW.

4.1 Bureau Information System Security Officer (BISSO)

The Contractor shall provide the following deliverables to ensure effective cybersecurity, compliance, and risk management across DS/EX/CTO systems.

Ownership and accountability for these deliverables rest with the system teams, with BISSO providing support as needed.

4.1.1 Cybersecurity

• Threat Hunting Reports: Deliver monthly reports documenting threat hunting activities, detected threats, risks, and prioritized mitigation actions.

• Continuous Monitoring Reports: Develop and execute plans for control validation, log reviews, and vulnerability scans. Include toolsets (e.g., Tenable, Splunk, SCAP) and provide bi-monthly mitigation reports with evidence of implementation.

P a g e | 15

• Security Testing Reports: Provide results of web application security testing, including identified risks and mitigation recommendations. Integrate security scanning into CI/CD pipelines and support change management processes.

• Risk Assessment Reports: Submit periodic reports identifying threats, vulnerabilities, likelihoods, and impacts, aligned with NIST SP 800-30 practices.

• Incident Response Reports: Document cybersecurity incidents per agency and DHS/CISA protocols, including summaries, lessons learned, proposed improvements, and mitigation follow-ups.

• User Access Review Reports: Conduct monthly or as-needed reviews of user accounts, access privileges, and role appropriateness to support Zero Trust and ICAM requirements.

• COMSEC Management Plan: Develop a plan outlining key management procedures, inventory control, and audit readiness for COMSEC practices.

• Threat Modeling: Collaborate with development teams to create threat models, including diagrams, attack vectors, and countermeasure plans, as needed.

• Security Awareness Presentations: Deliver quarterly cybersecurity awareness presentations on relevant topics to DS/EX/CTO staff.

• Cybersecurity Priorities Roadmap: Develop an annual roadmap outlining future cybersecurity priorities, including automation, metrics, and program needs.

4.1.2 Security Compliance

• ATO Support Packages: Prepare ATO submissions in the Department’s GRC tool, including all required documentation, artifacts, and stakeholder signoffs for full, interim, or continuous ATO efforts.

• POA&M Management Dashboard: Provide an interactive dashboard summarizing open, in-progress, and closed POA&M items, including due dates, responsible parties, and remediation status.

• Asset Compliance Dashboard: Deliver a monthly dashboard tracking IT asset compliance, including assessments, findings, remediation efforts, and closure verification.

• Audit Readiness Repository: Maintain a digital repository of security artifacts (e.g., policies, procedures, logs) for internal and external audits.

• Federal Reporting Repository: Archive completed data call responses and federal security inquiries for traceability and timely access.

P a g e | 16

• FISMA Reporting Repository: Collect and maintain data and narratives supporting CIO/CISO-level FISMA reporting, including system inventory, security posture summaries, and compliance metrics.

4.1.3 Security Configuration Management

• CMDB Reconciliation Report: Deliver quarterly reports reconciling CMDB entries with physical and logical asset scans.

4.1.4 Enterprise Cyber Risk Management (ECRM)

• ECRM Plan: Develop and maintain an annual ECRM Plan outlining the risk management process, roles, and communication flow, aligned with the DS/EX/CTO ERM Plan.

• ECRM Risk Register: Create and maintain a risk register with metrics and visuals for dashboards or reports. Include risk status, owner, impact, likelihood, response, residual risk, and mitigation plans. Update as necessary.

• ECRM Communication Plan: Develop an annual communication plan detailing how ECRM risks, thresholds, mitigations, and issues will be reported, aligned with DS/EX/CTO ERM protocols.

• ECRM IT Risk Assessment Reports: Produce quarterly assessments of enterprise IT risks, including system-level risk scoring, heat maps, and vulnerability trends, aligned with NIST, FISMA, and FITARA.

• ECRM ATO Risk Alignment Matrix: Create a monthly matrix mapping system-level risks and control weaknesses to ATO decisions, including inherited controls, CDM alignment, and Zero Trust progress.

• ECRM Risk Mitigation Action Plan (MAP): Develop MAPs to track actions for resolving identified risks, including task owners, timelines, resource needs, and mitigation status, as needed.

4.2 Bureau Chief Data Officer (BCDO)

The Contractor shall provide the following deliverables to support DS/EX/CTO’s data and AI strategy, governance, and analytics initiatives:

4.2.1 Data Analytics, Artificial Intelligence (AI), and Mission Enablement

• DS Data/AI Strategy and Action Plan: Develop and update an annual strategy and action plan that identifies and prioritizes Bureau-wide data needs and projects, aligning with federal and Department initiatives. Update annually or as required.

P a g e | 17

• DS Data and AI Inventory: Maintain a living inventory of all data assets, including metadata, stewardship, access levels, and sensitivity classifications.

Publish as part of the Department’s Enterprise Data and AI Inventories and comply with the Open Data Act, when applicable. Update regularly.

• Data Quality Dashboard: Create reports with metrics and analysis on data accuracy, completeness, timeliness, consistency, and reliability. Include baselines and trends. Update as required.

4.2.2 Data Governance, Management, and Sharing

• DS Data Governance Framework and Policy: Define the structure, roles (e.g., data stewards), policies, and rules for managing data across the Bureau. Include a governance charter, decision-making protocols, and escalation paths. Update annually or as required.

• Project Analytics Plan: Develop a roadmap outlining how analytics will be used to address specific mission problems. Include business goals, objectives, methodologies, data sources, and timelines. Review quarterly.

• Project UAT Documentation: Provide user acceptance testing (UAT) documentation upon project delivery, confirming the product meets mission needs. Include agreements for handoff or plans for ongoing analytics operations and maintenance (O&M) support.

• Data Sharing MOU: Draft and finalize MOUs with external bureaus and interagency partners to support mission-driven data sharing needs. Review annually and update as required.

4.3 Technology Business Strategy (TBS)

The Contractor shall provide the following deliverables to support DS/EX/CTO’s program management, strategic planning, portfolio management, customer engagement, enterprise risk management, governance, procurement, and independent assessment services.

4.3.1 TBS Program Management Office (PMO)

• PMP: Develop and maintain a plan covering scope, schedule, communications, risk/issue/decision management, quality, and configuration management. Update annually or as needed.

• IMS: Create and maintain a baseline schedule and critical path for all DS/EX/CTO projects, updated weekly.

P a g e | 18

• Weekly Status Report (WSR): Submit weekly progress reports, including risks, issues, decisions, and look-ahead items, by Thursday at noon EST.

• Executive Brief Deck: Provide bi-weekly updates to the CIO and DS/EX/CTO staff on key metrics and action items for ongoing and upcoming projects.

• RID Log: Maintain a log of risks, issues, and decisions for traceability and accountability, updated continuously with weekly exports to leadership.

• Governance Meeting Packages: Prepare agendas, read-ahead, attendance records, minutes, and action items for governance meetings, delivered per board cadence.

• Authoritative Repository: Maintain a repository for stage gate reviews, SOPs, metadata, and version-controlled documents for configuration and knowledge management. Review quarterly.

• Logistics Support Artifacts: Provide calendars, meeting invites, room/bridge connections, and minutes for DS/EX/CTO project meetings on an ongoing basis.

4.3.2 Strategic Planning & Modernization

• IT Strategy and Execution Roadmap: Develop an annual roadmap with goals, objectives, initiatives, and measures for DS/EX/CTO projects, refreshed mid-year if needed.

• 3–5 Year Strategic Plan: Create an annual plan with goals, objectives, OKRs, KPIs, funding alignment, and integration with State, DS, and CIO initiatives.

• AOP: Develop an annual plan with funded initiatives, outcomes, and KPIs, including quarterly variance updates.

• Capability Roadmaps and Playbooks: Create and review roadmaps and playbooks for cloud, applications, EUC, and IDAM methodologies, updated semi-annually.

• Zero Trust and EA Guardrails: Establish and manage artifacts for Zero Trust and EA pillars, updated as needed after gate reviews.

• Enterprise Data Strategy: Collaborate with BCDO to create and implement governance, cataloging, lineage mapping, and data quality rules, updated annually.

• OCM Communications and Training Plan: Develop a plan for adoption strategies, communications calendars, role-based training, and metrics, reviewed quarterly.

P a g e | 19

• Policy Lifecycle Register: Maintain a repository for policy drafts, concurrences, published versions, and reviews, updated monthly.

• Executive Operations and Performance Dashboard: Create and update a monthly dashboard for CIO and DS/EX/CTO leadership, tracking OKRs, KPIs, and project performance.

4.3.3 Project and Portfolio Management (PPM)

• PPM Framework: Develop a framework for project lifecycle, stage gates, artifact standards, and RACI roles, reviewed annually.

• PPM Tool Configuration: Configure tools for data modeling, TBM, HR, and

EA integration, updated quarterly.

• Authoritative Portfolio Inventory: Maintain a repository of PPM documents and artifacts, reviewed monthly.

• Application Rationalization Report: Create reports to assess application inventory for retainment, refactoring, retiring, or replacement, reviewed semi-annually.

• Capacity and Sequencing Plan: Develop monthly plans to track project capacity and sequencing, linked to the IMS.

• Benefits Realization Framework and PIR Schedule: Establish a PIR schedule to capture benefits, leading practices, and lessons learned.

• Portfolio Dashboard and Scorecard: Create and update a monthly dashboard tracking delivery, cost, risk, benefits, and modernization metrics.

• CPIC and Investment Artifacts: Develop CPIC and investment artifacts required by OMB and Department review cycles.

• Weekly Activity Report: A Weekly Activity Report is required for each project and shall summarize completed work, near-term objectives, risks/issues and mitigations, sprint metrics, contract staffing levels, and overall project health.

Submission must align with the cadence established in program governance documentation.

• Quality Metrics Report: Monthly quality metrics must encompass code quality, deployment frequency, test coverage rates, defect trends, vulnerability management, change failure rates, MTTR, and recommendations for process improvement, mapped to program Key Performance Indicators (KPIs) and Objectives and Key Results (OKRs).

P a g e | 20

• Defect Tracking and Resolution Report: Defect tracking reports shall summarize open/closed counts, severity levels, root causes, aging, escape rates, resolution actions, and linkage to project requirements and releases for a holistic view of system health and quality trends.

• Stakeholder Communication Plan: Stakeholder communication plans must be developed and regularly updated, identifying all stakeholder groups, information requirements, communication cadence, channels, message templates, and roles responsible for dissemination and feedback management.

• Project Governance Documentation: Governance documents must define project and portfolio governance gates, approval workflows, change control procedures, risk/escalation protocols, and decisions-log maintenance, ensuring compliance with agency and federal IT policies.

• Earned Value Management System (EVMS) Report: Monthly EVMS reports are required for applicable projects and must detail Planned Value (PV), Earned Value (EV), Actual Cost (AC), Cost Performance Index (CPI), Schedule Performance Index (SPI), Estimate at Completion (EAC), and narrative explanations of variances and corrective actions.

• Technology Business Management (TBM) Report: Provide monthly TBM reports mapping IT spend to towers, services, applications, and business capabilities, supporting budgeting, forecasting, and cost optimization initiatives as defined in federal TBM guidance.

• Project Management Plan: For each project initiated, provide a tailored Project Management Plan describing scope, schedule, budget controls, staffing, communications, risk assessment, quality assurance, and formal change control procedures consistent with agency IT governance.

• Project Schedule: Develop a detailed project schedule at kickoff, highlighting sprint cycles, release milestones, dependencies, resource assignments, baselines, and integration with the master schedule for portfolio-level visibility and collaborative planning.

• Project Charter: Develop and maintain project charters to ensure that business needs, purpose and objectives, scope and key deliverables and other standard charter expectations and goals are memorialized.

• Business Requirements: Develop and maintain business requirements documentation for each project, encompassing functional and non-functional

P a g e | 21 needs, business rules, stakeholder analysis, acceptance criteria, constraints, and traceability matrices for design and test artifacts.

• Requirements Traceability Matrix: A Requirements Traceability Matrix (RTM) shall be established and updated through project lifecycle. The RTM must trace all requirements to design documents, test cases, security and performance benchmarks, releases, and demonstrate fulfillment at project completion.

• CI/CD Pipeline Customizations and Dashboard: Customizations of the baseline CI/CD pipeline shall be made for each project, preserving required quality gates and compliance checks unless explicitly waived by government direction. All modifications must be version controlled and documented within the pipeline. Dashboards must display real-time build, test, security, and release statuses.

• Product Backlog: Create and maintain a product backlog populated with epics, features, user stories, acceptance criteria, and definitions of "done," jointly with the product owner and stakeholders, stored in the approved Application Lifecycle Management tool (e.g., ADO) and continuously refined throughout delivery.

• Test Plans: For each project, comprehensive test plans shall be produced, covering unit, integration, system, security, performance, and user acceptance tests, with clearly defined entry/exit criteria, data management protocols, automation coverage targets, and evidence of control gates adherence.

• Test Cases: Author detailed test cases ensuring full coverage of functional and non-functional requirements. Automated and manual tests must be executed per sprint/release and stored in designated repositories or ALM tools, with results traceable to requirements.

• Process Flow: Process flow documents shall convey as-is and to-be business and system workflows using standard modeling notation, supporting requirements clarity, design decisions, and comprehensive change impact analysis.

• Use Cases and User Stories: Use cases and user stories documentation shall include preconditions, triggers, main and alternate flows, acceptance criteria, and relevant data. Documentation must support traceability and validate scope throughout project execution.

• Sprint Planning: Sprint planning documentation will capture sprint goals, committed backlog items, team capacity, task breakdowns, and dependencies

P a g e | 22 within the government-approved ALM tool. Documentation must enable review of team commitments and project constraints prior to sprint commencement.

• Sprint Review: Sprint review documents must summarize delivered functionality, key metrics, backlog modifications, stakeholder feedback, and acceptance outcomes for each sprint.

• Sprint Retrospective: Sprint retrospective documentation shall record observations on process effectiveness, improvement opportunities, agreed actions, assigned owners, and closure timelines to ensure continuous team accountability and improvement.

• Daily Standup Meeting Notes: Daily standup notes are required for each project team, capturing completed work, planned actions, impediments, and escalation items, maintained in the government’s ALM tool for transparency and audit.

• Software Release Notes: Software release notes must be provided for every production deployment, enumerating features, fixes, known issues, dependency changes, configuration updates, deployment instructions, rollback guidance, and approvals history.

• Automated/Manual Test Results: For each release, deliverables must include evidence of automated and manual test results, including pass/fail status, coverage percentages, defect findings and resolutions, performance benchmarks, security scan outputs, and Section 508 accessibility test results, all with requirement traceability.

• Security Testing Procedures and Results: Prepare security testing procedures and results, incorporating static/dynamic code analysis, container and IaC scans, vulnerability discovery, remediation evidence, severity SLAs, and formal governance approvals or exceptions for each release.

• Performance Testing Results: Performance testing…