Attach L-11 - EITS SOO (A0005).docx

By submitting a proposal for Task Order 3000, EITS, the Offeror agrees to furnish all services and items upon which the prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule if this Task Order offer is accepted by the Government anytime from award of the contract resulting from H95001-15-R-0001 through 180 calendar days thereafter.

Period of Performance

Contract Type This is a cost-plus-incentive-fee (CPIF) task order. The Offeror shall propose a target cost and target fee. The target cost is inclusive of all cost elements, including labor, material, and other direct costs (ODCs). The minimum fee shall be 3% of target cost. The maximum fee shall be 15% of target cost. The share ratio above target cost is 60 (Government)/40 (Contractor). The share ratio below target cost is 40 (Government)/60 (Contractor).

The Offeror’s proposed target fee percentage shall not exceed the fee percentages as proposed on Attachment L-16: Cost / Price Workbook 3, WS3-3: Fee Structure Table.

Payments for all contract line item numbers (CLINs) will be made in accordance with FAR 52.216-7, Allowable Cost and Payment. Payments and the fee payable under the task order are subject to adjustments in accordance with FAR 52.216.10, Incentive Fee, and performance assessments conducted in accordance with the IRES Performance Evaluation and Incentive Plan (Attachment J6).

In addition to adjustments authorized in accordance with FAR 52.216-10(d), adjustment of the target cost due to a variance in the actual cost incurred when compared to the Government’s plug number (GPN) for other direct costs (ODC) may be considered if actual ODC costs exceed +/- 15%. The adjustment will only be made by the amount the actual cost incurred exceeds the +/- 15% threshold; no adjustments to fee will be made.

CLIN Structure

Share Ratio Above Target (Gov/Cont): 60/40 Share Ratio Below Target (Gov/Cont): 40/60

WARNING – This document contains information that may be exempt from mandatory disclosure under the Freedom of Information Act

H95001-15-R-0001-0005 Attachment L-11

FOR OFFICIAL USE ONLY

Sep 1, 2016 FOR OFFICIAL USE ONLY

IRES

Integrated Research & Development for Enterprise Solutions

Attachment L11:

Enterprise Information Technology Services (EITS) Statement of Objectives (SOO)

WARNING – This document contains information that may be exempt from mandatory disclosure under the Freedom of Information Act

Table of Contents

Enterprise Information Technology Services Vision

The MDA vision for delivery of all MDA information management / information technology (IM/IT) services is to have an adaptive organization that assures the confidentiality, integrity, and availability of MDA-controlled unclassified and classified information following the DoD Risk Management Framework (RMF) and to achieve improvements in service delivery and cost containment while delivering customer-focused services based upon IT Service Management (ITSM) principles and the Information Technology Infrastructure Library (ITIL) methodologies.

MDA IT Services provides a set of core functions operating in an Enterprise context delivering processing, storage, and transport of information, human interaction, systems and network management, information dissemination management, and information assurance. These functions must be fully integrated and interoperable with one another in order to achieve overall success across the MDA Information Environment (MIE) consisting of three functional environments: mission, test, and general services.

1.2 Purpose

This task order will provide the MDA with Enterprise (agency-wide) IT capabilities 1) supporting Ballistic Missile Defense System (BMDS) Research, Development, Test, and Evaluation (RDT&E) requirements, 2) providing MDA administrative and business requirements, and 3) enabling BMDS mission support tasks for deployed systems. The CIO has oversight and provides assistance and support for all three IT environments to ensure compliance with the regulatory requirements.

The office of the Chief Information Officer (CIO) is responsible for ensuring that IM/IT are acquired and that information resources are managed and protected for the MDA in a manner that meets the requirements of legislation, regulations, and directives which include, but are not limited to, the Clinger-Cohen Act of 1996, the Paperwork Reduction Act of 1995, the E-Government Act, the Federal Information Security Management Act (FISMA) of 2002, the President’s Management Agenda, the DoD 8500 policy framework, DoD Directive 8000.1, National Security Agency information assurance policies, and the priorities established by the Director, MDA.

The MDA Enterprise Information Environment Mission Area (EIEMA) and Business Mission Areas (BMA) are Department of Defense Architecture Framework (DoDAF) and Joint Information Environment (JIE) compliant; they provide processing, storage, and transport of information; systems and network management; information dissemination management; and cybersecurity functions. The CIO provides MDA with secure classified and unclassified information technology systems; data centers; operations and monitoring centers; telecommunications; local and wide-area network infrastructure; and customer services to meet both DoD and MDA requirements of high availability, disaster recovery and continuity of operations. The CIO also provides support to the Warfighter Mission Area and the Defense Intelligence Mission Area for various components located within the MDA core sites. Components such as the Joint Functional Component Command- Integrated Missile Defense and the Intelligence Support Center represent two of the groups in these mission areas supported within the IRES contract.

1.3 Goals for 2020 and Beyond

MDA adheres to the DoD Unified Capabilities Operational Framework and has tied together multiple mission areas into an integrated framework. This integrated framework facilitates Joint Information Environment (JIE) efficiencies without sacrificing the ability to meet the special purpose information technology requirements of the development and test enclaves which support the timely BMDS development and fielding schedules. MDA data centers are registered with the DoD CIO as Special Purpose Processing Nodes (SPPNs). MDA’s SPPNs support unique requirements (e.g., RDT&E enclaves residing on the Defense Research and Engineering Network (DREN)) that have varying levels of security, access requirements, development requirements, and security controls in accordance with DISA “Enclave Test and Development Security Technical Implementation Guide” (STIG) Zones A through D. MDA follows the JIE standards to the maximum extent possible to facilitate information sharing. MDA’s capabilities-based acquisition model demands collaboration services across multiple government and contractor sites that are interconnected via the DREN infrastructure and the Department of Defense Information Network (DoDIN). This network infrastructure is highly integrated, supporting the wide range of scientific, research, missile defense development, business operations, and day-to-day collaboration required to bring the BMDS from concept to reality.

1.3.1 Goal 1: Deliver Agile IT That Enables Mission Success

IT Services must continually improve processes supporting end-to-end service delivery (i.e., requirements management, service design, release and change management, service transition, and governance functions including technical integration, configuration control, and data management) to increase the organizational agility to meet the demands of the missile defense community. A key element of this goal is integration with MDA’s system engineering process.

1.3.2 Goal 2: Cyber Compliance – Build the MDA Information Environment The Department of Defense (DoD) vision of the JIE is a secure joint information environment comprised of shared IT infrastructure, Enterprise services, and a single security architecture to achieve full spectrum superiority, improve mission effectiveness, increase security, and realize IT efficiencies. The task order must establish a foundation that aligns the MIE to DoD expectations for a SPPN that provides a shared, secure missile defense test and development cloud infrastructure to support the missile defense community’s RDT&E needs employing a single security architecture actively monitored for compliance by the MDA Computer Emergency Response Team (CERT).

Provide technology refreshment strategies and roadmaps, including data center-specific roadmaps, to ensure technology-parity with the Joint Information Environment while avoiding the cost pitfalls of having to achieve that homogeneity through a vendor monopoly. IT Services will sustain current capabilities while increasing service delivery and complying with DoD guidance.

1.3.3.2 Technology Watchlist

Exploit and integrate new technologies into the supporting infrastructure to improve service effectiveness and efficiency over the next five years. The Technology Watchlist section describes emerging and maturing technology areas that have the potential to improve service effectiveness and efficiency over the next five years. They are listed in a relative order of maturity.

1.3.3.2.1 Cloud Services

The MDA has already begun to field cloud elements and will continue to monitor this technology for changes in direction and to identify integration opportunities. The maturation of these technologies and the integration of the resulting capabilities are key components to achieving the MDA goals of improving IT Service Delivery and cyber compliance. Services based on a cloud delivery model provide opportunities for moving towards ubiquitous mission domain support wherever possible.

1.3.3.2.2 Software Defined Data Center

Evolution to a software-defined data center (SDDC), utilizing technologies to virtualize the compute, storage, and network components of the data center provides flexibility for improved mission effectiveness. SDDC technology is a key element in reaching MDA’s sustainment goal.

1.3.3.2.3 Business Analytics

Improve business intelligence and data analytics by strategically provisioning and employing technologies for searching, mining, storing, securing, and conducting data analytics on large, disparate data sets. Providing data analytic capabilities to MDA mission partners is essential to modern warfare. The integration of the resulting capabilities is a key component to achieving our service delivery goal. This technology can provide predictive analysis to improve mission effectiveness.

1.3.3.2.4 Mobile Technologies

Leverage mobile technologies to enable ubiquitous information access allowing users to perform their duties and improve their situational awareness from any location.

1.3.3.2.5 Cybersecurity Technologies

Strategically plan for and employ the latest, best technology to preserve and protect critical BMDS program information throughout its lifecycle.

2.0 Background

NOTE: This information is provided as an aid to offerors; it is not intended to direct or influence the proposed solutions or contractor-developed performance work statement submitted in response to this SOO.

2.1 Predecessor Task Orders

Task orders let on the JRDC that are considered predecessor task orders to this SOO include:

· 8402, MDA IT Services and Logistics (excluding task 3, and tasks 100 and above)

· 7402, MDA IT Services and Logistics (excluding task 3, and tasks 100 and above)

· 6402, MDA IT Services and Logistics (excluding task 3, and tasks 100 and above)

2.2 Organization Background

The MDA is comprised of four Program Executives responsible for the execution of the BMDS program (Program Executive for Programs and Integration, Program Executive for C4ISR, Program Executive for Aegis BMD, and Program Executive for Advanced Technology) and six Program Directors responsible for the functional activities supporting the RDT&E mission (Director for Engineering, Director for Test, Director for International Affairs, Director for Acquisition, Deputy Director and Director MDIOC, and Director for Operations). In addition to the above, the MDA is also supported by a Command Group Staff that includes: General Counsel; Chief of Staff; Quality, Safety and Mission Assurance; Equal Opportunity and Diversity; Public Affairs; Internal Review; Chief Information Officer; Independent Test Readiness Review Team; and Small Business Advisor. All organizational entities leverage the CIO for Information Technology and Information Management functions.

2.2.1 Chief Information Officer (CIO)

The CIO has adopted ITIL as the framework for organizing IT processes and services, and training the Information Technology workforce to meet an ITSM construct. Accordingly, IC has established five staff functions to manage the Infrastructure Integration and Event Support, Information Management, and Information Technology Operations and Cybersecurity capabilities:

1) IC Staff – Information Management and Technology Operations

2) ICM – Infrastructure Integration and Event Support

a. ICME – Infrastructure, Event Support

b. DACJ – Contracts and Acquisition

c. DOB – Financial Management

d. DOHC – Human Resources – West

e. PA – Protocol / Public Affairs

f. DEI – Security

g. DPL – Integrated Logistics Support

3) ICV – Information and Computer Network Defense (CND)

a. ICVA – IA Certification and Accreditation

b. ICVI – BMDS IA Management

c. ICVC – Computer Network Defense

4) ICT – Information Management and Technology Operations

a. ICTP – IT Policy Planning and Portfolio

b. ICTO – Enterprise Operations and Engineering

c. ICTT – Unified Communications

d. ICTA – IT Networks and Systems

e. ICTM – Information Management

5) Regional IT Support

a. IC-NCR

b. IC-HSV

c. IC-DAHL

d. IC-KAFB

e. IC-COS These five staff functions manage the IT/IM enterprise to ensure compliance with federal mandates, DoD policies, and compliance reporting in order to field Enterprise compliant information technology solutions, manage information, and to operate and defend our networks and information. The synergy achieved by the relationship between these functions results in the Network Operations (NetOps) desired effects of assured system and network availability, assured information protection, and reliable information delivery.

In accordance with the IRES Performance Evaluation and Incentive Plan, Service Summary Items (SSIs) 1 through 4 are common [required] on all task orders and will be assessed at the contract level (i.e., all task orders will receive the same rating – one fail all fail model).

SSI 5 (through n) [Technical Performance] captures the specific task order Service Summary Items deemed essential to successful execution of the task order (note: To be developed / defined using the performance measures proposed by the contractor.) Exhibit 1 defines the SSIs applicable to this task order.

5.0 Statement of Objectives and Outcomes

Eight major lines of service will be used as the basis for describing the requirements of this SOO; while these eight service areas are provided for an understanding of CIO services and desired outcomes, they are not meant to drive a contractor work breakdown structure (WBS). Offerors are encouraged to develop their own WBS that demonstrates innovative approaches to most advantageously satisfy the government’s requirements.

Outcomes are task order requirements that must be captured in the Contractor Performance Work Statement (CPWS). Thresholds which identify a specific performance level must also be incorporated into the CPWS. Desired attributes are both quantifiable and non-quantifiable performance goals/objectives that the Government would like to achieve, and are provided as assistance in developing proposal/CPWS performance thresholds and service summary items. Constraints are limitations on the contractor’s technical or management approach/solution. The contractor's approach/solution must comply with the constraints. Government identified thresholds for EITS performance can be found in Enclosure 6, EITS Key Performance Indicators.

All activities conducted on this task order must adhere to the special requirements identified in the contract-level SOO (Contract Attachment J-1). In the event of a conflict between Section 5.0 of the SOO and the CPWS, Section 5.0 of the SOO takes precedence.

Exhibit 1. SSIs and Weights Applicable to This Task Order

UNACCEPABLE

Performance Threshold

ACCEPTABLE

Performance Threshold

OBJECTIVE

10 QPI

EVM Program Analyst: review of the task order schedule(s) and the IMS.

5 QPI

COR: Review of Task Order 2000 – CDRL C012

COR: Customer Survey: twice annually prior to performance evaluations (mid and final)

Data manager: 100% Inspection: CDRL / Proposal delivery / milestone accomplishment record.

75 QPI

5.1.1 Description

Successfully integrate and coordinate all activity necessary to efficiently execute the task order.

· Format 1 defines cost and schedule performance data by product oriented Work Breakdown Structure (WBS). Format 1 data will be provided at WBS level 4.

· Format 2 defines cost and schedule performance data by the contractor's organizational structure (e.g., Functional or Integrated Product Team (IPT)).

· Format 3 defines changes to the Performance Measurement Baseline (PMB).

· Format 4 defines staffing forecasts.

· Format 5 is a narrative report used to provide the required analysis of data contained in Formats 1-4 and 6.

· Format 6 defines and contains the contractors Integrated Master Schedule (IMS).

· Format 7 defines the time-phased historical and forecast cost submission.

CDRL C001: TO 3000: Integrated Program Management Report

5.1.2.2 Delivery of the contractor acquired property (CAP) for the EITS task order.

CDRL C002: TO 3000: Interim Government Property Inventory Report

5.1.2.3 Quarterly EITS task order management report consisting of significant accomplishments, issues, concerns, risks, and self-assessment of technical performance.

CDRL C003: TO 3000: Task Order Status Report MILESTONE: Initial Baseline Review

a. Situational awareness of task order activities.

b. Frequent and open communication.

5.1.4 Constraints

None.

Provide IT portfolio management focusing on the portfolio of services delivered by the MDA/CIO for use in the execution of daily operations supporting the MDA. Specific functions within this objective include: Requirements Management, Service Level Reporting, Service Metrics, Governance (Change, Configuration, and Release Management), Licensing, Technology Refresh, Enterprise Architecture, IT Service Management (ITSM), and the development, management, and reporting of performance metrics. Outputs of Portfolio Management Services will provide data used in the development of external Agency reports (i.e., CPIC, investment capital forecasting) and aid the MDA/CIO in coordinating with internal MDA customers on existing and future services/capabilities.

CDRL C010: Operational Support Documents: Capacity Management Plan

CDRL C008: Operational Support Documents: MDA CIO Service Portfolio CDRL C011: Quarterly Reports: [Insert Document Title]: [Insert FYQ] CDRL C012: Operational Support Documents: MDA CIO Service Pipeline CDRL C013: Chargeback Showback Metrics: [Insert Month Ending]

5.2.2.4 Oversight and governance of key processes that ensure continuous improvement in evolving an Enterprise IT Organization with a true service orientation that aligns with the MDA Organization and Mission; demonstrating IT cost control wherever possible, improving the quality of end-to-end IT services, improving agility in responding to business and mission needs, focused on customer results and recommending prioritization of actions and IT expenditures based on business and mission priorities.

CDRL C007: Operational Support Documents: MDA Enterprise Strategic Plan

5.2.2.5 Accurate system, segment, or enterprise DoDAF representations of all EITS managed networks, systems, and applications supporting the needs of the Agency and BMDS, tailored to the form, fit, and function required to accurately represent Enterprise IT service support to the key lines of business within MDA.

CDRL C005: Engineering Documentation CDRL C006: Operational Support Documents: [Insert Document Title] (assume 14-20 annually)

CDRL C004: Software Accountability and Maintenance Report

CDRL C009: Operational Support Documents: Technology Refresh Plan

a. Achieve measurable efficiencies in IT service delivery.

b. Performance measures that demonstrate efficiencies in the delivery of product and services.

c. Identification and tracking of cost control initiatives implemented at the portfolio level.

d. Reliable lifecycle management and capacity planning projections that can be used for management decisions.

e. Realistic performance baselines that facilitates early identification and mitigation of risk; baseline integrity is maintained and changes are fully documented.

f. Relevant, accurate architecture documentation compliant with DoDAF v. 2.x.

g. Accurate data supporting fee-for-service chargeback to customers.

Provide cybersecurity services including the execution of the MDA’s Tier 2 Certified Network Defense Service Provider (CNDSP), referred to as the MDA Computer Emergency Response Team (CERT). Responsibilities of the CERT include the protection, detection, response and sustainment of CNDSP program requirements across subordinate Tier 3 enclaves. Included in the cybersecurity services objective are the functions of boundary protection, Tier 3 cybersecurity, vulnerability management, and Cross-Domain Solutions (CDS). CDS activities encompass the design, development, implementation, accreditation, and sustainment of dataguard solutions necessary to enable cross-domain interoperability that support information sharing for operations, testing, exercises, experiments, wargames, and training. Cybersecurity operations also include the development/update of Risk Management Framework documentation supporting the certification and accreditation process.

CDRL C015: [Insert System Name]: Certification and Accreditation Documentation (assume 15 to 20 annually)

5.3.2.3 A cyber incident handling process that: (1) maintains a robust detection capability; (2) ensures the timely reporting of cyber incidents; (3) effectively contains events and incidents and isolate information systems to minimize any damage or impact to the MIE; (4) safely acquires and preserves the integrity of cyber incident data; (5) ensures the effective coordination and communication of cyber incident information through appropriate channels; (6) provides an effective and comprehensive response; (7) identifies lessons learned to help improve infrastructure component protection strategies; and (8) understands patterns of activity and trends to characterize the threat and direct protective and defensive strategies.

CDRL C014: Cyber Incident Handling Process: [FY]

a. Escalation of cyber-attack awareness within five minutes of identification.

b. Continued certification of the MDA CERT as a Tier 2 CNDSP.

c. Continuous updates of POA&M for all systems/enclaves with timely mitigation for all Category 1 findings.

d. Verified, validated, and approved cross domain solutions for use in BMDS mission support and testing.

Provide data center capabilities that incorporate all of the characteristics of Cloud Computing (on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service) in the following service models: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) through a Community Cloud deployment model supporting the Research, Development, and Testing of current and future BMDS capabilities. Data Center Services includes the provisioning and management of consolidated storage infrastructure, centralized backup and restore, and situational awareness of all delivered IT services. Data Center Services also provides data management services to subscribed MDA customers as well as the configuration management of floor space and rack elevation assignments through a contractor-defined reservation process. Data Center Services oversees authorized maintenance activities, configuration freeze control/Mission Assurance, and the coordination of environment control and management functions to include capacity planning and requirements forecasting of facility infrastructure needs.

CDRL C018: Operational Support Documents: Data Management Plan

a. Tiered, self-service provisioning of compute resources for test and development

b. Server availability: 99.99%

c. Operating system and network provisioning within 5 days of request

d. Integration of provisioning with financial management subsystems for chargeback

e. Consistent, 100% auditable asset tracking reporting capability, tied to procurement subsystems

5.4.4 Constraints

Data Center services to be provided from MDA data centers in Huntsville and Colorado Springs.

Provide customer support services inclusive of service desk operations, touch-labor client support, COMSEC account management, print services, conference room A/V maintenance, client application software, conference and event support, and employee equipment moves at the MDIOC.

a. Incident Response (Mean Time to Repair (MTTR)): Critical, 6 hours; High, 1 Day; Medium, 2 Days; Low, 3 Days

b. Maintain continuous 100% inventory of all Controlled Cryptographic Item (CCI) and keying material with no loss or compromise

c. Asset records (for property and portfolio purposes) maintained accurate to 98%

EITS Network Administration Services provides design and technical management service in support of the MDA Unclassified and Classified Network Transport Services (UNET & CNET) that provide connectivity between MDA organizations and between MDA and the greater DoD community through Department of Defense Information Network (DoDIN) Service Delivery Points. EITS Network Administrations Services provides comprehensive management and technical support for MDA WAN, MAN, and LAN communications and data distribution to MDA’s principal sites, major sites, and all authorized remote site locations. Network Administration Services provides management of the WAN and MAN telecommunications common carrier product interfaces and coordinates with long-haul and local exchange carriers and services providers to ensure network reliability is maintained in support of Agency missions. Network Administration Services provides cable plant management and network distribution in all LAN environment locations (reference GFI, para. 7) as well as the distribution of precision timing and video cable circuits. Network Administration Services manages the interfaces to external DoD networks and all network enclaves supported by the common transport services and enforces network security controls IAW DoD policy and standards.