Attach 3. draft_DS_EX_CTO MTS SOW_02.23.2026.pdf

DRAFT

DS/EX/CTO MTS Statement of Work

STATEMENT OF WORK

For

Enterprise Services To

Bureau of Diplomatic Security Office of the Chief Technology Officer Mission Technology Solutions (MTS)

Contract Operations Support

Enterprise Services, ##AQMM##A###, PoP

P a g e | i

DS/EX/CTO MTS Statement of Work

Table of Contents

1.0 Background

2.0 Purpose and Objective

3.0 Scope of Work

3.1 Enterprise Risk Management Support

3.2 Development, Modernization, and Enhancement (DME) Services

3.2.1 Core Development Platforms and Technologies

3.2.2 Cloud Architecture and Migration

3.2.3 Training and Documentation Support

3.3 Development Support Services

3.3.1 Architecture and Technical Support Services

3.3.2 DevSecOps and CI/CD Implementation

3.3.3 Authorization and Accreditation (A&A) and Authority to Operate (ATO) Support

3.3.4 Configuration and Release Management

3.3.5 UI/UX Services

3.3.6 Quality Management Framework

3.3.7 Testing Services

3.3.8 Quality Tools and Processes

3.3.9 Database Administration

3.3.10 System Administration

3.3.11 Tier 3 Support

3.3.12 Microsoft 0365 Support

3.4 Project and Product Management Services per CTO Project

3.4.1 Governance and Strategic Planning ........ Error! Bookmark not defined.

3.4.2 Project Management ............................... Error! Bookmark not defined.

3.4.3 Traditional Project Management ............. Error! Bookmark not defined.

P a g e | ii

DS/EX/CTO MTS Statement of Work

3.4.4 Agile Program Management ................... Error! Bookmark not defined.

3.4.5 Business Analysis and Requirements Management

3.4.6 Product Management

3.4.7 Performance Management Metrics

3.4.8 Agile Metrics

3.4.9 Earned Value Management System (EVMS) MetricsError! Bookmark not defined.

3.5 Contract Administrative Requirements and Reporting

4.0 Deliverables

4.1 Project Management, Agile, and SDLC Products for CTO Projects ..... Error!

Bookmark not defined.

4.2 Ongoing Reports and Metrics for CTO ProjectsError! Bookmark not defined.

4.3 Architecture and Design Products for CTO Projects

4.4 Cloud and DevSecOps Products for CTO Projects

4.5 Security and Compliance Products for CTO Projects

4.6 Continuity and Knowledge Management Products for CTO Projects

4.7 Contract Administrative Requirements and Reporting

5.0 Deliverables Schedule

6.0 Acceptance Criteria and Compliance Standards

6.1 General Compliance Requirements

6.2 Acceptance Criteria

6.2.1 Deliverable Review and Approval

6.2.2 Submission Format

6.2.3 Inspection and Notification

6.2.4 Correction of Deficiencies

6.2.5 Contract Closeout

6.3 Performance Standards

P a g e | iii

DS/EX/CTO MTS Statement of Work

7.0 Adherence to Policy or Standards

7.1 Language Requirements

7.2 Data Rights and Ownership

7.3 Nondisclosure Requirements

7.4 Privacy Act Compliance

7.5 Information Assurance and IT Security

7.6 IT Security Training

7.7 Dissemination of Information

7.8 Section 508 Compliance

7.9 Additional Compliance Requirements

8.0 Government-Furnished Equipment / Information

8.1 General Requirements

8.2 Government-Furnished Equipment and Services

8.3 Management and Accountability

8.4 Unique Items and Highlights

8.5 Compliance Requirements

9.0 Standard Work Hours

10.0 Place of Performance

11.0 Security Requirements

11.1 Personnel Security Clearances

11.2 Facility Security Clearance

11.3 Visit Authorization Requests (VARs)

11.4 Building Access and Identification

11.5 Handling Classified and Sensitive Information

11.6 Foreign National Restrictions

11.7 Mandatory Security Training

11.8 Reporting Requirements

P a g e | iv

DS/EX/CTO MTS Statement of Work

11.9 Compliance Requirements

11.10 Unique Items and Highlights

12.0 Travel

13.0 Point of Contact

14.0 Funding

14.1 Contract Vehicle and Type

14.2 Invoice Approval

14.3 Surge Activities

14.3.1 Key Requirements

14.3.2 Surge Activation Protocol

14.3.3 Coordination and Approval

14.3.4 Execution of Activities

14.3.5 Compliance Monitoring and Reporting

14.4 Other Direct Costs

14.4.1 Separate Contract Line-Item Numbers (CLINs)

14.4.2 Documentation and Compliance

14.4.3 Monitoring and Reporting

14.5 Equipment Procurements

14.5.1 Enterprise IT Component Upgrades and Replacement

14.5.2 Order Level Material (OLM) Provisions

Appendix A – MTS Performance Work Statement

1.0 Introduction

2.0 Performance Requirements

2.1 Administrative Deliverables and Actions

2.1.1 Reports

2.1.2 Project Plans

P a g e | v

DS/EX/CTO MTS Statement of Work

2.2 Technical Agile and Software Development Lifecycle (SDLC) Deliverables and Actions

3.0 PWS Deliverables/Delivery Schedule

4.0 Acceptance Criteria and Compliance Standards

5.0 Adherence to Policy or Standards

6.0 Point of Contact

Appendix B – Required Resources and Position Descriptions

Position Descriptions

Appendix C DSIAS and ARES System Configuration ElementsError! Bookmark not defined.

Table 1 Deliverable Schedule Table 2 PWS Deliverables Schedule Table 3 Required Resources

DS/EX/CTO MTS Statement of Work

1.0 Background

The U.S. Department of State leads American diplomacy, with the Secretary of State serving as the President’s principal foreign policy advisor. The Department’s workforce includes over 12,000 Foreign Service employees representing the United States abroad, more than 9,000 Civil Service employees providing continuity and expertise, and over 37,000 Foreign Service National Staff supporting operations at overseas posts.

The Bureau of Diplomatic Security (DS) ensures a safe and secure environment for U.S. foreign policy worldwide. DS designs and manages security programs for diplomatic missions, investigates passport and visa fraud, conducts personnel security investigations, and protects the Secretary of State and visiting dignitaries.

Under the Omnibus Diplomatic Security and Antiterrorism Act of 1986, DS is responsible for safeguarding life, property, and information.

Within DS, the Office of the Chief Technology Officer (DS/EX/CTO) drives the Bureau’s mission through technology and data services. Led by the Chief Information Officer (CIO), DS/EX/CTO manages IT program requirements and oversees critical functions, including Application Support, Service Desk Support, Software Development, System Networking, Enterprise Architecture, Strategic Planning, Customer Engagement, Risk Management, and Business Analysis. The office is organized into four divisions: the Front Office (FO), Integrated Systems Division (ISD), Enterprise Production Services Division (EPSD), and System Solutions Division (SSD) 1.

DS/EX/CTO manages numerous concurrent IT projects, integrating cloud-based and on-premises systems to meet evolving security needs. The office collaborates with the Department, other U.S. Government entities, and Intelligence and Law Enforcement communities to ensure seamless operations. It ensures compliance with federal cybersecurity mandates, implements NIST-compliant policies, and supports the Development, Modernization, and Enhancement of DS systems. By delivering

1 The organization will undergo a planned organizational change that includes renaming its divisions. While the division names and leadership titles may change, the scope of work, roles, and responsibilities outlined in this document will remain unchanged. Any references to specific divisions or leadership should be understood to apply to their future equivalents under the new naming structure.

P a g e | 2 secure, adaptable, and innovative IT solutions, DS/EX/CTO enables DS to meet mission requirements and advance U.S. diplomacy in all environments.

2.0 Purpose and Objective

• The objective of this contract is to enable the SSD, within the DS/EX/CTO, to deliver secure, innovative, and reliable IT Software systems solutions that enhance the Bureau’s ability to protect U.S. personnel, facilities, and information worldwide. This SOW will have following Task Areas: Development, Modernization, and Enhancement (DME) Services, and Project Management.

Specific areas of focus within those task areas include:

• DME Services: Provide integrated technical services to develop, enhance, maintain, and manage DS mission-critical systems and applications through cross-functional teams. Key activities include project management, agile software development lifecycle (SDLC) implementation, DevSecOps practices, hybrid cloud architecture, quality assurance, testing, configuration management, agile project management, database administration, system integration, technical training, and knowledge transfer.

• Project Management: Planning, organizing, and overseeing technology-related projects to ensure successful delivery within defined scope, time, and budget by adopting industry-standard software development life cycle (SDLC) methodologies to meet business requirements.

• DevSecOps and Continuous Integration/Continuous Delivery (CI/CD) Implementation: Improve product quality and delivery pace by implementing robust CI/CD pipelines that automate server provisioning, software configuration, testing, security scanning, and deployment processes.

• Infrastructure-as-Code (IaC) and Cloud Integration: Automate the provisioning, configuration, and security hardening of infrastructure, commercial off-the-shelf (COTS) applications, and cloud environments to decrease security accreditation timelines and ensure quality deployments.

Integrate solutions across on-premises, hybrid-cloud, and cloud environments, including Government Clouds such as Azure Government, AWS GovCloud, ServiceNow, and M365.

• Technology Modernization: Implement emerging technologies and processes to reduce delivery time, enhance business value, secure software

P a g e | 3 solutions according to DOS, NIST, and FISMA security standards, and improve product quality while reducing operational and maintenance expenses.

• Enhanced Productivity and Quality: Improve productivity and establish effective business solutions by staffing dedicated cross-functional teams that develop expertise in specific technology domains and business areas. Enhance application quality through automated testing, security scanning, and Section 508 compliance checking.

• Strategic Roadmaps and Emerging Technologies: Maintain strategic IT roadmaps that align technology initiatives with agency mission priorities.

Evaluate, recommend, and implement emerging technologies to support federal enterprise needs, while recruiting and staffing personnel with mission-critical technical skills.

• Fault-Tolerant Architectures and Continuity of Operations: Implement continuity of operations and fault-tolerant architectures that ensure zero trust, zero data loss, and high system availability across both on-premises and cloud platforms, including during cloud migrations or catastrophic events.

This contract will provide DS/EX/CTO with the expertise and resources necessary to develop, integrate, and sustain secure, high-quality systems solutions that enhance operational efficiency, security, and mission success.

3.0 Scope of Work

The Contractor shall provide comprehensive support for all DS/EX/CTO/MTS functions, including mission technology solutions, integrated technology operations, and organizational initiatives. Services must comply with all applicable federal, Departmental, Bureau, and organizational mandates, policies, and regulations.

The Contractor shall deliver high-impact services that enhance the CIO’s ability to govern, secure, and modernize the technology environment. This includes aligning investments, risk management, data, and service delivery with mission objectives.

The Contractor must demonstrate attention to detail, produce clear and thorough documentation, and effectively lead cross-functional teams. All work must adhere to federal mandates, regulatory requirements, and organizational priorities. Regular communication and reporting are required to ensure transparency and accountability.

P a g e | 4

The Contractor shall provide skilled personnel capable of supporting the Division’s mission across all offices and functional areas. While personnel may be assigned to specific offices within the Division, their expertise, deliverables, and services will be utilized to address broader needs across the Division and its associated programs.

Contracts must demonstrate flexibility and resilience, adapting to evolving priorities, shifting workloads, and emerging requirements. The Contractor’s team shall be prepared to perform assigned tasks in any location or for any mission-critical need, ensuring seamless support to the Division’s overarching goals.

3.1 Enterprise Risk Management Support

The Contractor shall integrate risk management into IT project plans, ensure redundancy and failover mechanisms for critical systems, and conduct patch management and vulnerability scanning to maintain system integrity. This work will be split between the Development and Operations and Maintenance (O&M) divisions of DS/EX/CTO and BISSO and will ensure their implementation measures are acted on and measured.

3.2 Development, Modernization, and Enhancement (DME) Services

3.2.1 Core Development Platforms and Technologies

The Contractor shall provide development and engineering expertise across multiple technology platforms including but not limited to:

• .NET Framework and .NET Core applications

• Java enterprise applications

• JavaScript/Node.js, React, and Angular js libraries

• Python applications

• Database administrations (SQL Server, Oracle, MySQL)

• Azure Government cloud services

• Microsoft Power Platform (PowerApps, Power BI, Power Automate, Power

Pages)

• SharePoint 2016 and Online

• ServiceNow platform

• AWS GovCloud cloud services

• ESRI ArcGIS products Geospatial applications

• Enterprise Search applications and platforms (Azure Search and OpenText

IDOL)

P a g e | 5

• Biometric applications and platforms (Ares-Next)

• Web-API development for system integration

• Azure Data Analytics platforms and services

• Data migration and transformation services

• Azure Artificial intelligence / Machine Learning (AI/ML) platforms and services

• Define DevOps platform architectures aligned with industry best practices and

DOS standards.

• Design and build DevOps pipelines

• Refactor applications for cloud environments if needed and execute data migration plans.

• Design and build platforms using tools such as GitLab, Jenkins, SonarQube, Artifactory, and Fortify.

3.2.2 Cloud Architecture and Migration

The Contractor shall provide cloud architecture services including:

• Cloud architecture design and implementation

• Hybrid-multi-cloud strategy development

• Cloud migration planning and execution

• Cloud security and compliance implementation

• Cost optimization and resource management

3.2.3 Training and Documentation Support

The Contractor shall implement process improvement methodologies for all training and documentation activities, continuously enhancing delivery methods and content effectiveness through collaborative efforts with MTS personnel. The Contractor shall develop and deliver training materials including:

• Self-service training materials for software releases and product enhancements

• Video-based training and tutorials

• Online help and user documentation

• Standard Operating Procedures (SOPs) and user guides

• Operations manuals and technical documentation

• Agile process training materials for teams and stakeholders

• SDLC documentation including user stories, requirements matrices, and marketing content

P a g e | 6

3.3 Development Support Services

3.3.1 Architecture and Technical Support Services

The Contractor shall provide enterprise architecture support, technical leadership, and specialized technical services to support MTS development and modernization initiatives. The Contractor shall drive process improvement initiatives across all technical support services, working collaboratively with government personnel to streamline architectural review processes, enhance technical standards, and improve service delivery mechanisms. The Contractor shall provide comprehensive solutions architecture services, including:

• Support enterprise modernization initiatives and provide architectural guidance for development teams

• Ensure alignment with DOS and DS/CTO enterprise architecture standards

• Research and recommend emerging technologies

• Perform technology assessments and proof-of-concept development

• Develop technology-specific architectural standards and guidelines

• Create reference architectures for common platforms and support platform migration efforts

• Design scalable, secure, and maintainable solutions

• Provide technical consulting services to DS program offices

3.3.2 DevSecOps and CI/CD Implementation

Services shall be provided by experts with demonstrated experience in DS specified tools and technologies. DevSecOps involves analysis, requirements collection, design, development, test, platform engineering, and production operations in addition to configuration management, planning, and project management. The Contractor shall implement comprehensive DevSecOps practices including:

• Infrastructure-as-Code (IaC): Automate infrastructure provisioning and configuration through code with the mindset and practice of automating everything possible

• Continuous Integration (CI): Automated code integration, building, and initial testing

• Continuous Delivery (CD): Automated deployment of pipelines with appropriate quality gates

P a g e | 7

• Security Integration: Automated security scanning, vulnerability assessment, and compliance checking

• Test Automation: Comprehensive automated testing including unit, integration, functional, and security tests

• Monitoring and Feedback: Real-time monitoring, logging, and performance feedback loops

• CI/CD Pipeline Management: Design, implementation, and maintenance of build and deployment automation

• Configuration Management: Comprehensive configuration management and security scanning integration

3.3.3 Authorization and Accreditation (A&A) and Authority to Operate (ATO) Support The Contractor shall provide comprehensive support for A&A and ATO processes for all applications and systems, to include, but not limited to:

• Support System Security Plan (SSP) development and maintenance

• Support with security control implementation and documentation

• Support continuous monitoring activities and evidence collection

• Support with Risk Assessment and Risk Management Framework (RMF) compliance

• Support preparation of security authorization packages

• Support with Independent Verification and Validation (IV&V) activities for security controls

• Support Plan of Action and Milestones (POA&M) development and tracking

• Support with security control assessments and remediation activities

• Support FedRAMP compliance activities where applicable

• Support with FISMA compliance documentation and reporting

• Support security artifact development including control implementation statements

• Support with security testing and validation activities supporting ATO processes

• Support process improvement initiatives for A&A and ATO workflows in collaboration with government FTEs

P a g e | 8

3.3.4 Configuration and Release Management

The Contractor shall ensure appropriate fallback plans exist for each release and government approval is obtained for each production release. The Contractor shall perform comprehensive configuration management and software release management activities including:

• Configuration and change notices and release notes

• Maintaining master deployment and patch schedules

• Source code repository management with version control systems (e.g., GIT, Subversion, Azure DevOps)

• Binary repository management serves as the official system of records for software releases

• Deployment coordination for patches, releases, and database scripts across environments

• Rollback plan development

• Capturing all dependencies and supporting organizational versioning strategies

• Managing code movement through Quality Gates from initial development to production builds

• Configuration and Release process development and maintenance

• After action report development and management

3.3.5 UI/UX Services and Training Services

The Contractor shall provide user interface and user experience services including:

• Develop and maintain standard UI/UX requirements, design and development for mobile and web applications

• User research and usability testing

• Wireframing and prototyping

• Design system development and maintenance

• Accessibility and Section 508 compliance integration

• User interaction design and information architecture

• Develop and maintain user training materials including videos and documents as required

P a g e | 9

3.3.6 Quality Management Framework

The Contractor shall implement a comprehensive quality management approach including:

• Integration with ongoing ISO-9001 processes and annual organizational recertification

• Definition, development, and automation of Quality Gate inspections for custom coded projects

• Quantifiable and automated approaches for measuring feature compliance, maintainability, security compliance, and performance

• Quality Assurance (QA) reviews for software requirements, design, engineering standards, implementation, documentation, testing, and configuration management

• Assumption and improvement of existing CTO quality management programs across all organizational process areas

3.3.7 Testing Services

The Contractor shall provide comprehensive testing services to ensure all deliverables meet government standards and requirements, to include:

• Unit Testing to test individual components/modules to verify that each unit works as intended in isolation

• Integration Testing to test interactions between integrated modules to ensure that different components work together correctly

• System/Regression Testing to test the complete system as a whole (end-to-end) to validate the system meets functional and non-functional requirements

• Support User Acceptance Testing to perform on the complete system before production release to ensure the software is ready for production deployment and meets business needs

• Support Deployment verification and validation Support to verify and validate production deployment meets functional and non-functional requirements

• Automated Testing using Playwright to perform Regression Testing

• Static Application Security Testing (SAST), Software Composition Analysis

(SCA), Software Bill of Material (SBOM), Dynamic Application Security Testing (DAST), and Infrastructure-as-Code scanning using Fortify Software Security Center (SSC) to support DevSecOps to identify vulnerabilities

P a g e | 10

• Section 508 Testing using JAWS, Google Lighthouse, WAVE, ANDI, Color Contrast Analyzer, and Axe DevTools to ensure all IT software solutions are compliant with Section 508 of Rehabilitation Act (29 U.S.C. 794d)

3.3.8 Quality Tools and Processes

The Contractor shall utilize and maintain automated quality tools approved by DOS and DS including code quality analysis, security scanning, automated compliance checking tools, test case management systems, and defect tracking and resolution processes. All testing processes shall be subject to continuous improvement initiatives, with the contractor leading efforts to enhance testing efficiency, coverage, and quality in partnership with government FTEs.

3.3.9 Database Administration and Development

The Contractor shall provide database administration services including:

• Database administration for enterprise database systems (e.g., Oracle, SQL, etc.)

• Database performance optimization and monitoring

• Backup and recovery planning and implementation

• Database migration and upgrade services

• Data architecture and modeling support

• Database Query development services

3.3.10 System Administration

The Contractor shall provide system administration support including:

• Development, test, and staging environment(s) management

• Infrastructure-as-Code implementation

• Cloud resource provisioning and management

• Security patch management and deployment

• System monitoring and performance optimization

3.3.11 Tier 3 Production Support

The Contractor shall provide Tier 3 support services and assist with environment management, to include, but not limited to:

• Resolve issues requiring assessment and remediation of software code or configuration defects

• Provide on-demand support with appropriate substitute coverage

P a g e | 11

• Maintain and execute Tier 3 Support SOPs addressing response and escalation requirements

• Conduct analytical and research support activities

• Collaborate with Development and QA teams to resolve customer product issues

• Provide effective communication and technical details to support teams

• Assist with ongoing development and technical issues while recommending solutions

• Support OS-level patching coordination

• Assist in establishing and maintaining standard operating system configurations for different development platforms

• Support administration of virtualized environments for development, test, sandbox, and core services

• Assist developers in troubleshooting development environments and pipeline setup

• Provide training on proper procedures for development pipeline and SDLC execution

• Ensure test environment configurations are representative of production systems

• Assist in establishing backup procedures and disaster recovery verification

• Assist in generating infrastructure, build, test, continuous integration, and deployment scripts

• Support copying production configurations to development and test environments for consistency

• Assist in developing procedures and scripts for creating realistic test data

• Support system user administration in development, test, and UAT environments until production transition

The COR and/or GTM may authorize extended or special hours for emergency system outages. Designated contractor staff may be required to maintain basic systems operations during government shutdowns as part of the emergency support team.

3.3.12 Microsoft 0365 Support

The Contractor shall support the development and management of DS web projects and applications using Microsoft Business Application & Collaboration tools, P a g e | 12 including but not limited to: Office365. SharePoint 2016, SharePoint Online, MS Power Platform, and Microsoft Dynamics. Tasks include:

• Leading teams of content administrators, software developers, and designers

• Gathering and analyzing client requirements

• Developing and maintaining solutions

• Creating standards, processes, and service catalog

3.4 Project and Product Management Services per CTO Project

The Contractor should provide comprehensive project and product management services to support DS initiatives, ensuring alignment with organizational objectives and mission priorities. This includes decision support prior to project initiation, monitoring project progress, and applying lessons learned to improve organizational processes. The Contractor shall continuously identify and implement process improvement opportunities in collaboration with government FTEs to enhance portfolio management effectiveness and operational efficiency.

3.4.1 Business Analysis and Requirements Management

The Contractor shall provide comprehensive business analysis and requirements management services including, but not limited to:

• Conduct stakeholder interviews, workshops, and surveys to gather business and technical requirements

• Analyze, document, and validate functional and non-functional requirements ensuring completeness and clarity

• Create and maintain clear and measurable requirements, requirements traceability matrices, manage requirements changes, and ensure version control

• Identify and analyze stakeholders, understand their needs, and manage stakeholder relationships throughout the project lifecycle

• Document current state processes, identify improvement opportunities, and design future state processes

• Assess differences between current capabilities and desired outcomes, identifying necessary changes and improvements

• Create detailed use cases, user stories, and acceptance criteria in collaboration with product owners and development teams

• Facilitate requirements review sessions, obtain stakeholder approval, and ensure requirements meet business objectives

P a g e | 13

• Analyze the impact of proposed changes on existing systems, processes, and stakeholders

• Produce comprehensive requirements documentation including business requirements documents, functional specifications, and user manuals

3.4.2 Product Management

The Contractor shall provide comprehensive product management services including, but not limited to:

• Define product vision, strategy, and roadmaps aligned with DS mission objectives and user needs

• Develop and maintain product roadmaps, release plans, and feature prioritization based on business value and mission impact

• Manage products from conception through retirement, including planning, development, launch, and maintenance phases

• Create, prioritize, and maintain product backlogs, ensuring features are properly defined and ready for development

• Develop detailed user stories with clear acceptance criteria in collaboration with stakeholders and development teams

• Facilitate communication between business stakeholders and development teams, ensuring alignment on product goals

• Conduct user research, competitive analysis, and market assessment to inform product decisions

• Track product metrics, user adoption rates, and key performance indicators to measure success

• Coordinate product launches, user training, and adoption activities

• Collect, analyze, and incorporate user feedback into product planning and enhancement activities

• Support go-to-market activities and product release coordination

• Monitor product performance and recommend enhancements based on user needs and mission requirements

3.4.3 Performance Management Metrics

The Contractor shall describe their process for managing overall contract and team performance utilizing Agile Management Metrics and Program-Level Earned Value

P a g e | 14

Management System Metrics (EVMS). Support DS/EX/CTO FTE Portfolio Lead on OMB reporting as required.

3.4.4 Agile Metrics

The Contractor shall design and implement metrics to gauge the success of agile in an organization comparable in size and scope to CTO. At a minimum, the contractor shall describe their capability to report the following metrics: Delivery Velocity (DV), Sprint Burndown, Unit Test Code Coverage, Automation Testing Coverage, Escaped Defects, and Content Spread.

3.5 Contract Administrative Requirements and Reporting

This section defines the administrative requirements and reporting methods for managing the contract and evaluating Contractor performance throughout the Period of Performance (PoP). It ensures transparency, accountability, and alignment with contract objectives. The Contractor shall:

• Perform contract project administration and project management actions as outlined in the DS/EX/CTO MTS PWS, found in Attachment A.

• Execute Agile processes and deliverables integrated into DS/EX/CTO’s daily operations, as specified in Attachment A - MTS PWS.

• Fulfill Software Development Lifecycle (SDLC) requirements embedded in

DS/EX/CTO’s routine operations, as detailed in Attachment A - MTS PWS.

4.0 Deliverables

The Contractor shall provide deliverables that ensure efficient, accurate, and timely performance of all tasks in compliance with contract requirements, federal regulations, and Department of State policies. Deliverables must align with applicable standards, including Federal Acquisition Regulation (FAR), Department of State Acquisition Regulation (DOSAR), Department of State Acquisition Manual (DOSAM), FITARA, FISMA, CIO Act, Project Management Institute (PMI), and Agile methodologies, where relevant. All deliverables become Government property and must comply with the Freedom of Information Act (FOIA) requirements unless marked proprietary and approved by the Government. Deliverables shall be submitted electronically using Microsoft Office Suite tools unless otherwise specified by the Contracting Officer’s Representative (COR). Hard copies may be requested by the COR.

P a g e | 15

4.1 Architecture and Design Products for CTO Projects

• Enterprise Architecture Compliance: Submit documentation evidencing compliance with government enterprise architecture principles, standards, patterns, data management, interoperability protocols, and security controls.

Reviews of technology alignment and EA governance outcomes are required.

• Technical Architecture: Deliver a technical architecture document for each project. This document must detail system components, interfaces, data flows, security controls, technology stack, deployment topology (on-premises, cloud, or hybrid), integrations, scalability, interoperability, and compliance with federal and agency enterprise architecture standards.

• Detail System Design: Design documentation that includes module/component blueprints, API specifications, data models, sequence and class diagrams, configuration parameters, error handling, observability designs, and deployment schematics. The documentation must fully support independent system sustainment and operations, enabling the Government to operate and maintain the solution without contractor support. The contractor shall update the documentation following significant design or technology changes.

• API Documentation and Standards: API documentation deliverables must specify endpoint definitions, interface contracts, authentication and authorization patterns, versioning strategies, error handling, encryption requirements, rate limiting, and developer onboarding instructions. All APIs must comply with enterprise and federal security requirements.

• Database Design and Migration Procedures: Provide database logical and physical data models, schema definitions, indexing strategy, data quality enforcement, backup/recovery/restore procedures, performance tuning documentation, and stepwise migration plans for each system.

• Cloud Migration Strategy and Plans: Cloud migration deliverables shall include readiness assessments, landing zone design, security baseline requirements, network and identity planning, migration wave schedules, cutover and rollback plans, data migration processes, and operational handoff guides for federal environments.

• Alternative of Analysis: Alternatives analysis documentation must present evaluation of system or technology options, including comparative review of cost, P a g e | 16 schedule, risk, security, compliance, performance, operational maintainability, and alignment to enterprise strategies, with clear recommendation and rationale.

• Innovation Plan: Identify, evaluate, and document recommendations for optimizing systems and applications through adoption of emerging technologies, including artificial intelligence, automation, cloud-native architectures, and next-generation development frameworks.

• Technical Versioning Repository: Maintain a repository of technical stack and upgrades.

4.2 DevSecOps Implementation

• Baseline CI/CD Pipeline Implementation: Deliver a baseline CI/CD pipeline orchestrating builds, integrated testing, security scans, approvals, environment deployments, dashboards, and compliance gates across software releases.

Templates and documentation supporting reuse and knowledge transfer must be included.

• Infrastructure as Code (IaC) Templates and Documentation: IaC deliverables shall contain standardized templates for cloud/on-prem provisioning, parameterized configuration, secrets management, policy enforcement, drift detection, versioning, and documentation enabling agency teams to implement secure, repeatable infrastructure deployments.

• Configuration Management (CM) Procedures: Configuration management documentation shall define identification, baselining, change control, audit, and tracking processes for code, infrastructure, environments, and documentation, integrating federal CM best practices and supporting governance requirements.

• Release Management Standard Operating Procedures: Release SOPs must specify planning, change aggregation, approval steps, deployment scheduling, stakeholder communication, roll-back protocols, and post-release verification procedures, integrated with CI/CD operations and regulatory governance.

• Deployment Procedures and Rollback Plans: Deployment and rollback documents shall provide stepwise runbooks, pre-deployment checks, automated steps, approval flows, validation tests, monitoring protocols, and contingency actions to ensure safe release promotion and recovery.

P a g e | 17

4.3 Security and Compliance Products for CTO Projects

• Security Control Implementation: Security implementation documents must include detailed procedures, baselines, parameter settings, inheritance mapping, and verification evidence supporting RMF and ATO requirements, ongoing assessments, and program-level continuous monitoring.

• Support ATO: ATO deliverables must include the System Security Plan (SSP), security control implementation statements, Plan of Action and Milestones (POA&M), assessment evidence, continuous monitoring metrics, and responses to assessor findings for full security authorization lifecycle support.

• Support Risk Management Framework (RMF) Compliance: RMF documentation must relate to system categorization, control selection/implementation/assessment, authorization, and continuous monitoring.

Contractor must correlate all evidence with required federal and agency overlays and baselines.

• Support Continuous Monitoring Plan and Reports: A continuous monitoring plan and quarterly reports must define security controls/schedules, toolsets, roles, escalation/notification protocols, vulnerability management, configuration drift, patch status, and remediation tracking, submitted for government review.

• Section 508 Compliance Testing Reports: Accessibility testing reports must document evaluation procedures, test results, identified issues, remediations, and retesting outcomes for each system release, substantiating conformance with Section 508/WCAG and reporting compliance to program leadership.

4.4 Continuity and Knowledge Management Products for CTO Projects

• Technical Training Materials: Deliverables must provide curriculum and role-based technical training materials aligned to program disciplines, technologies, DevSecOps, CI/CD, security operations, and system administration for government workforce enablement and ongoing learning.

• User Training Guide, Videos and Operations Guides: User and operations documentation must be deliverable per system/release and thoroughly address usage, configuration, deployment, monitoring, troubleshooting, and sustainment, updated with every change in production functionality.

• Operation Transition: Transition documentation and knowledge transfer must occur at project completion and include all architecture, code, design, P a g e | 18 deployment runbooks, SOPs, support models, and personnel contact matrices required for government sustainment and future operation.

• Best Practices Guidelines: Guidelines must be compiled for Agile, DevSecOps, security, testing, observability, and operations. Deliverables must be formally published and updated at least annually to incorporate lessons learned, regulatory changes, and evolving enterprise standards.

• Lessons Learned Reports: Lessons learned reports will be required at quarterly intervals and at project milestones documenting successes, issues, corrective actions, and best practices, with recommendations disseminated for improvement at all levels.

4.5 Contract Administrative Requirements and Reporting

This section defines the methods for administering the contract and measuring Contractor performance throughout the PoP. It ensures transparency, accountability, and alignment with contract objectives through oversight, documentation, and evaluation processes outlined in the PWS. The Contractor shall:

• Perform contract project administration and project management actions as specified in Attachment A - MTS PWS.

• Execute Agile processes and deliverables integrated into DS/EX/CTO MTS’ daily operations, as outlined in Attachment A - MTS PWS.

• Fulfill SDLC requirements and deliverables embedded in DS/EX/CTO MTS’ routine operations, as detailed in Attachment A - MTS PWS.

5.0 Deliverables Schedule

All deliverables2 must be submitted electronically using Microsoft Office Suite tools unless otherwise specified in SLAs or by your direct report. Hard copies may be requested by the COR. Deliverables must adhere to the timeline specified in the contract, ensuring compliance with FAR, DOSAR, and DOSAM requirements.

Table 1 identifies the deliverables with corresponding frequency:

Table 1 Deliverable Schedule

2 Deliverables and Delivery Schedule for Contract Management and Reporting Deliverables and Actions as well as Technical Agile and SDLC Deliverables and Actions are within Attachment A - FO PWS.

P a g e | 19

Deliverable Frequency Recipient(s)

System Architecture Document

Per Project TOPC for IT Delivery and CTO Project Lead

System Detail Design Document

Per Project TOPC for IT Delivery and CTO Project Lead

Cloud Migration Strategy and Plans

Per Project TOPC for IT Delivery and CTO Project Lead

Alternative of Analysis Per Project TOPC for IT Delivery and CTO Project Lead

CI/CD Pipeline Implementation Plan

45 Business Days after Project Start

TOPC for IT Delivery and CTO Project Lead

Configuration & Release Management Plan

Per Project TOPC for IT Delivery and CTO Project Lead

Deployment Procedures and Rollback Plans

Per Release TOPC for IT Delivery and CTO Project Lead

Security Control Implementation

Per Project TOPC for IT Delivery and CTO Project Lead

Authority to Operate (ATO) Support

Per Project as required

TOPC for IT Delivery and CTO Project Lead

Section 508 Compliance Testing Report

Per Release TOPC for IT Delivery and CTO Project Lead

Technical Training Materials

Per Project TOPC for IT Delivery and CTO Project Lead

User Manuals and Operations Guides

Per Project TOPC for IT Delivery and CTO Project Lead

Operation Transition Documentation

Per Project TOPC for IT Delivery and CTO Project Lead

P a g e | 20

Deliverable Frequency Recipient(s)

Lessons Learned Reports Per Project TOPC for IT Delivery and CTO Project Lead

After Action Reports Per Incident TOPC for IT Delivery and CTO Project Lead

Standard Operating Procedures for Development Environment Management Plan

60 Days after Contract kick off

TOPC for IT Delivery and CTO Project Lead

Standard Operating Procedures for Change Management Plan

60 Days after Contract kick off

TOPC for IT Delivery and CTO Project Lead

Technical Debt resolution Plan

Per Quarter TOPIC for IT Delivery and CTO Project Lead

6.0 Acceptance Criteria and Compliance Standards

Acceptance Criteria and Compliance Standards for Contractor Project Administrative and Management Actions and Contractor Technical Agile and SDLC Deliverables and actions are within the DS/EX/CTO FO PWS.

The Contractor shall remain engaged with the organization to stay informed of updates to policies and procedures and assist in their refinement and improvement.

All deliverables and services must align with the requirements outlined in the SOW or PWS, applicable MIL-STDs, and The Contractor’s technical and business proposals. Any deviations from established policies or standards must be approved in writing by the COR or Government Task Manager (GTM). Regular audits and reviews may be conducted to ensure compliance, and The Contractor shall promptly address any deficiencies identified. Failure to adhere to these standards may result in corrective actions or contract termination.

P a g e | 21

6.1 General Compliance Requirements

The Contractor shall ensure that all work performed under this contract complies with applicable U.S. Government laws, regulations, and Department of State (DOS) standards, policies, procedures, and guidelines. This includes adherence to:

• Foreign Affairs Manuals (FAM) and Foreign Affairs Handbooks (FAH)

• CIS Critical Security Controls (CIS Controls) published by DS/CTS/TIE for use by DOS

• NIST 800-53 (Rev 5) guidelines

• FedRAMP Requirements: For cloud services, ensure compliance with

FedRAMP-approved security controls

• FBI Criminal Justice Information Services (CJIS) Security Policy (if applicable)

• CIO Act: Ensure IT systems meet operational and security requirements

• FITARA: Ensure alignment with FITARA mandates for IT resource management

Specific DOS policies include, but are not limited to:

• 5 FAM Series: Information Technology Management, Records Management, Telecommunications, IT Systems, Internet and Intranet Use, and Information Systems Management

• 12 FAM Series: Information Security and Information Security Technology

• 5 FAH Series: IT Systems Handbook, Web Development Handbook, and

Information Assurance Handbook

• DOSAM 639.182 – Cybersecurity Supply Chain Risk Management Evaluation

Factor and Clause

• DS/DS/EX/CTO Policies and Procedures: Tailored FAM implementation procedures managed through the DS/DS/EX/CTO Process Management Group, available post-award

Specific policies on contract performance and administration:

• FAR 42.708 for contract closeout procedures

• FAR 15.404 for performance evaluation and cost analysis

• Department of State Acquisition Regulation DOSAR 642.1502 for performance evaluation

• DOSAM guidelines for deliverable quality and compliance

P a g e | 22

6.2 Acceptance Criteria

6.2.1 Deliverable Review and Approval

All deliverables, including documents, reports, services, and other outputs, must be reviewed and approved by the COR and/or GTM. Deliverables must meet task order requirements, be legible, properly formatted, free of spelling or grammatical errors, and align with defined goals and objectives. Comments provided by the COR/GTM must be incorporated into the final version unless valid justification is provided for exclusion. If comments are deemed technically unsound or inconsistent with safe business practices, The Contractor must notify the COR/GTM. A consensus between the COR/GTM and the Contractor is required for deliverable revisions. If consensus cannot be achieved, the COR/GTM will provide final direction.

6.2.2 Submission Format

Deliverables must be submitted in both hard copy and electronic format, compatible with mutually agreed software applications.

6.2.3 Inspection and Notification

The Government will inspect deliverables for completeness, accuracy, and compliance with task order requirements. Inspection may include validation using automated tools, testing, or random checks. The COR will provide written acceptance, comments, or change requests within five (5) to 15 business days or receipt, depending on the complexity of the deliverable. Notifications of rejection will include specific deficiencies causing the rejection.

6.2.4 Correction of Deficiencies

Non-conforming products or services will be rejected. Deficiencies must be corrected within five (5) to 10 business days of the rejection notice, or as agreed upon with the COR. If deficiencies cannot be corrected within the specified timeframe, the Contractor must notify the COR immediately and provide a corrective action plan within 10 business days.

6.2.5 Contract Closeout

At contract closeout, the Contractor must submit a release of claims document and finalize costs within 90 days of task order completion, in accordance with FAR 42.708.

P a g e | 23

6.3 Performance Standards

• Outcome: Deliverables must fully meet contract requirements and have no material quality issues.

• Requirements: Deliverables must be of high quality, complete, and delivered on time. Deliverables must be written clearly and concisely, providing DOS stakeholders with a clear understanding of all deliverables.

• Standards: Final documentation must be spell checked, grammar checked and accepted by the Government. 100% of delivery dates specified by the Performance Based Statement of Work (PBSOW), COR, and/or SOP (if applicable) must be met.

• Acceptable Quality Level: Deliverables are acceptable when identified problems are corrected with minimal COR intervention. No deviation from the standard is allowed unless approved by the COR and documented through a Contract modification issued by the Contracting Officer.

• Monitoring Source: The COR will conduct a 100% inspection of all deliverables to ensure compliance.

7.0 Adherence to Policy or Standards

7.1 Language Requirements

English is the required language for all deliverables and communications. Future requirements may involve Operations Center support in additional languages as determined by the Department of State. Contractors must ensure that all personnel, including subcontractors and consultants, meet the language requirements specified in the SOW.

7.2 Data Rights and Ownership

• Unrestricted Rights to Government Data: The Government retains unrestricted rights to all Government data. Contractors must provide full copies of data in formats that are readily accessible through predominant industry and/or open data standards at no additional cost to the Government.

• Government Data Ownership: All Government data collected, processed, or stored in the system is the property of the Federal Government. This includes, but is not limited to, payroll data, account information, permissions, login activity, and other supporting data necessary for system functionality.

P a g e | 24

• Unlimited Rights: The Federal Government has unlimited rights to all data first produced under any task order in accordance with FAR clause 52.227-14. This includes new code, reports, and other deliverables, which may not be used for any purpose other than the performance of the task order without the expressed consent of the Contracting Officer. Only government encryption will be used on government data in all environments and stages of development. Private keys will be tightly regulated and escrowed with the government.

7.3 Nondisclosure Requirements

The Contractor shall sign a Non-Disclosure Agreement (NDA) on behalf of the company, if applicable, and ensure that all staff assigned to the contract, including subcontractors and consultants, execute and adhere to the terms of the NDA. This agreement protects procurement-sensitive information of the Government and proprietary information of other Contractors.

7.4 Privacy…