Attachemnt 1- Revised Performance Work Statement 9182020.pdf

Attachment One (1): Revised Performance Work Statement (PWS)

1. General: This is a non-personal services contract to provide Defense System of System

Development (DsoS) and Sustainment Support services for the Department of Defense (DOD), Defense

Counter Intelligence and Security Agency (DCSA) Defense Insider Threat Management and Analysis

Center DoD Department of Defense (DITMAC). The Government shall not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and services necessary to perform services to enhance products delivered during contract HS0021-16-C-0008. The services that will be provided will address sustaining the current operational system that supports the DITMAC mission, DSoS 2x, and also transitioning the user population to the new platform DSoS 3x delivered as the primary product of HS0021-16-C-0008 Option Year 3. The vendor shall enhance and tailor the new DSoS 3x capability to ensure alignment with operational parameters and requirements, adhering to defined parameters. The Contractor shall perform to the standards in this PWS and the contract.

1.2 Background: In December 2014, the DCSA was appointed by the Secretary of Defense to incubate the DITMAC program. The mission of the DITMAC is to enable information sharing, collaboration, analysis, and risk mitigation across the DoD Components to address current and emerging threats to DOD personnel, assets, and information by insiders. It fills acritical gap within the Department by empowering and entrusting a single senior Defense official with the task of working with all DoD Component insider threat programs to promote best practices, drive innovation, promulgate a fundamental set of standards, and provide resource and policy advocacy to senior decision makers, and through an enterprise-level analytic function, close seams and gaps between DOD Components that are potentially exploitable by insiders.

The National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs require agency heads to establish an integrated capability to monitor and audit information for insider threat detection and mitigation that leverages counterintelligence, security, cybersecurity, human resources, law enforcement, and other relevant functions and resources to identify and counter the insider threat.

The December 2014 Office of the Under Secretary of Defense for Intelligence (OUSD(I) now known as

OUSD(I&S)) memo directed that the DITMAC provide an enterprise-level capability for insider threat information management with the ability to:

Oversee the mitigation of insider threat to DoD personnel, infrastructure, and essential national security information resident on DoD facilities or networks;

Assess risk, refer recommendations for action, synchronize responses, and oversee resolution of identified issues on threats that insiders may pose to their colleagues and/or DoD missions and resources;

Develop risk thresholds/standards for actions and compile results to evaluate those actions on threats that insiders may pose to their colleagues and/or DoD missions and resources;

Establish standards to ensure DoD's Insider Threat Program is compliant with applicable

Executive Orders/DoD regulations; and fulfill certain requirements of national insider threat policy and minimum standards;

Provide a single repository for DoD insider threat related information; and

Promote collaboration and information sharing on insider threats to DoD personnel and facilities.

1.3 Objective: The objective of this effort is to support the DITMAC office in defining the technical sustainment and enhancement tasks for previously accomplished tasks that are required to enable the

DITMAC to achieve its critical mission as defined by OUSD(I)OUSD(I&S). The DITMAC mission is to enable information sharing, collaboration, analysis, and risk mitigation across all DOD Components to address the current and emerging threats insiders pose to DOD personnel, assets, and information. DOD

Components will report insider threat reporting to the DITMAC via the DSoS, which correlates this information with additional data sources and historical data to which individual DOD Components may not have access. During the period of performance continued sustainment of the DSoS 2x operational baseline will be performed in accordance with mission standards, also software enhancements of the delivered DSoS 3x system, the DSoS 2x successor will be undertaken. This entails modifying the application after delivery in order to correct faults, improve performance or other attributes, or to adapt the product to a modified environment. The enhancements performed will entail repairing applications bugs, glitches, errors, and anomalies which are iteratively presented based on end user feedback via eliciting, analyzing, and communicating functional and nonfunctional requirements, vetting these against the requirements submitted at project inception. Also during this period of performance IT security system hardening will be performed applying a system of hardening is a collection of tools, policies, procedures, techniques, and best practices to reduce vulnerability in application’s systems, infrastructure, firmware, and other areas, aligning with DCSA and DOD Cyber Security directives.

1.4 Scope: DITMAC provides the DOD’s quantitative and qualitative analytic overview of insider threat related risk trends, which will significantly inform future decision making. The DITMAC follows an analytics driven approach to assessing risk and endeavors to employ a rigorous science-driven approach to addressing risk and risk mitigation as it pertains to Insider Threat in the DoD. The Contractor shall provide critical sustainment, enhancement and maintenance on the DSoS which serves as the critical capability enabling the DITMAC and the greater DoD insider threat hub enterprise to achieve its mission.

1.5 Period of Performance (POP):

1.5.1 DSoS Sustainment and enhancement will have a period of performance as follows:

(a) September 26, 2020 – September 25, 2021

1.6 General Information:

1.6.1 Quality Control (QC): The Contractor shall develop and maintain an effective Quality Control

Plan (QCP) to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The

Contractor’s QCP is the means by which they assure that their work complies with the requirement of the

PWS and the contract.

1.6.2 Quality Assurance: The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 On-Site Working Conditions, Holidays and other Closures:

(a) DCSA facilities are smoking restricted workplaces. Due to the nature of the work, facilities, and requirements, Contractor staff may only smoke outside in designated smoking areas.

(b) The Government expects the Contractor will establish normal operating hours under this contract between 8:00 a.m. to 4:30 p.m. EST Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor’s Program Manager (PM) and the Government’s Contracting Officer

Representative (COR) shall consult and coordinate on any proposed alternate work schedules that may be arranged depending on the operational tempo/needs of the mission. For other than firm fixed price contracts, the Contractor will not be reimbursed when the Government facility is closed for the above reasons. The

Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

(c) Government personnel observe the following days as holidays and the Government facilities will be closed and unavailable to Contractor personnel on the following days:

New Year’s Day January 1st*

Martin Luther King’s Birthday Third Monday in January

President’s Day Third Monday in February

Memorial Day Last Monday in May

Independence Day July 4th*

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans Day November 11th*

Thanksgiving Day Fourth Thursday in November

Christmas Day December 25th*

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

(d) In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Presidential Inauguration Day

• Any other day designated by the President’s Proclamation

(e) It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional POP, or entitlement of compensation except as set forth within the contract. In the event the Contractor's personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

(f) When the Federal, State, Local or other Governmental entity grants excused absence to its employees, Assigned Contractor personnel may also be dismissed. The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, and shall be guided by the instructions issued by the Contracting Officer (KO) or COR.

(g) If Government personnel are unavailable due to furlough or any other reason, the Contractor shall contact the CO or the COR to receive direction. It is the Government's decision as to whether the contract price/cost will be affected. Generally, the following situations apply:

(1) Contractor personnel who are able to continue contract performance (either on-site or at a site other than their normal workstation), shall continue to work and the contract price shall not be reduced or increased.

(2) Contractor personnel who are not able to continue contract performance (e.g., support functions) may be asked to cease their work effort. This may result in a reduction to the contract.

(h) It is understood and agreed between the Government and the Contractor that in the event the Contractor personnel wish to attend DCSA organizational events, such as the annual picnic, holiday party, etc., they shall coordinate their work schedules with the COR and obtain approval of their company's supervisor prior to the event. The Government is not responsible for reimbursing any expenses to the Contractor for Contractor personnel attending any DCSA organizational event. The exception shall be: when Contractor employees are invited to Director (or Leadership) led events (e.g. Town Halls, All-Hands, etc.) to address the mission and vision of the agency, the Contractor employee may attend as part of their normal duties.

1.6.4 Place of Performance: The work to be performed under this contract shall be performed primarily at the Suffolk building facility at 5611 Columbia Pike Suite 00D69, Falls Church VA 22041 and the

DITMAC facility at 1550 Crystal Drive, Arlington, Virginia. The contractor may have limited activity the

DCSA Headquarters Russell Knox Building at

27134 Telegraph Road, Quantico, Virginia. The contractor is authorized telework using a government approved plan.

1.6.5 Type of Contract: The Government will award a firm-fixed-price (FFP) contract for this requirement.

1.6.6 Security Requirements: The Contractor will be required to access classified systems and information in order to complete the tasks and satisfy the deliverables articulated in the PWS, and some

Contractor personnel will occupy workspace within a Sensitive Compartmented Information Facility

(SCIF) at the DITMAC Headquarters and the Suffolk Building. Likewise, such personnel may require access to sensitive and classified systems and reporting. As such, personnel performing in support of this effort at the DITMAC and/or Suffolk Building or with access to classified systems and reporting shall possess a Top Secret (TS) clearance with eligibility for access to Sensitive Compartmented Information

(SCI) data. Personnel performing in support of this effort at Contractor facilities without access to classified systems or reporting at the TS/SCI level, requiring only occasional access to government facilities, shall possess a minimum of Secret clearance. The security requirements are in accordance with the DD254 in

Section J.2 of this contract.

1.6.6.1 Secret (S) Level Position Investigations shall have been completed within at least the previous ten years to allow for access to Government facilities or to Secret level information, as appropriate.

1.6.6.2 TS Level Position Investigations shall have been completed within at least the previous five years to allow for access to Government facilities or to TS level information and for access to SCI and/or Special

Access Programs (SAP), as appropriate.

1.6.6.3 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

1.6.6.4 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the

Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to theca.

1.6.6.4.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.6.4.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO or the COR.

1.6.7 Special Qualifications: The Contractor is responsible for ensuring all employees have appropriate experience to provide the services required by this contract.

1.6.8 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal

Acquisition Regulation (FAR) Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the KO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.9 COR: The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the

Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinate availability of Government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the

COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.10 Key Personnel: The following personnel are considered key personnel by the Government and the

Contractor is required to provide resume(s) to the Government COR for the Project Manager (PM). The

Contractor shall provide a PM who shall be responsible for the performance of the work required within this PWS. The PM shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract and shall be available during the normal working hours, between 8:00 a.m. to

4:30p.m, Monday thru Friday except Federal holidays or when the Government facility is closed for administrative reasons.

Qualifications for all key personnel are listed below:

1.6.10.1 Project Manager:

Minimum Requirements:

Bachelor’s degree (or higher level degree) in Program/Project Management, Information

Technology/Computer Science, or related discipline;

Five years of demonstrated program and/or project management experience;

Five years of demonstrated experience, managing projects of this magnitude;

Three years of demonstrated experience working with the DoD; and

Familiarity with Insider Threat and DITMAC is preferred.

1.6.11 Contractor Manpower Reporting: The Contractor shall report ALL Contractor labor hours

(including subcontractor labor hours) required for performance of services provided under this contract for the DCSA via a secure data collection site. The applicable website will be communicated to the contractor by the COR or the KO.

1.6.12 Identification of Contractor Employees: All Contractor personnel attending meetings, answering

Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear badges in the performance of this service.

1.6.13 Contractor Travel: The Government anticipates limited travel within the national capital region to conduct software training. The Government anticipates CONUS training to be virtual in nature. Exact locations and frequency are unknown at this time. Travel reimbursement shall be made on a cost reimbursable method; the Government will reimburse the Contractor for actuals costs associated with approved travel. All request for Contractor travel shall be approved by the COR prior to commencing. The

Contractor shall submit a Cost Estimate that includes the following:

(a) Reason for Traveling

(b) Temporary Duty Location

(c) Number of Individuals Traveling

(d) Estimates for Hotel, Air Fare, Parking, Mileage, Rental Car, and Per Diem

1.6.14 All Contractor travel shall use the most effective and efficient means to travel. Reimbursement of transportation, lodging, meals and incidental expenses are allowable subject to the limitations contained in

FAR 31.205-46. When the Contractor invoices for the completed travel, the Contractor shall submit copies of all receipts (regardless of dollar value) with a copy of the COR's approval to travel with the invoice that requests reimbursement for travel under the ODC CLIN. With the expansion of the organization and aligning with leadership direction frequent local travel has become imperative to include Ft Meade, Springfield

(NGA), RKB, Pentagon and other locations within the NCR. Local Travel will be paid in accordance with the JTR and must be approved by the COR. This travel will apply to the trainer and the core group of leads.

Requests for reimbursement would include but not limited to mileage public transportation, and parking.

The core would pre approve all external meeting participation so this reimbursement process would be closely monitored. Travel will be reimbursed on a monthly basis. Contractor will be required to track actual mileage.

1.6.15 Nondisclosure Agreements: In performance of this contract, the Contractor may have access to controlled unclassified information (CUI) and other sensitive, non-public information. The Contractor agrees (a) to use and protect such information from unauthorized disclosure in accordance with Department of Defense Instruction 8582.01, Security of Unclassified DOD Information on Non-DOD Information

Systems, June 6, 2012; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government Program Manager before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer required for Offeror performance; and (e) to advise the Government Program

Manager of any unauthorized release of such information. The Contractor shall have its employees assigned to this contract execute a non- disclosure agreement for delivery to the Government. The Government will require Contractor personnel to sign a non-disclosure statement to protect non-public information in the possession of the Government.

1.6.16. Release of Information: The Contractor and its personnel may have access to Personally Identifiable

Information (PII), Classified Information, and other controlled unclassified information (CUI) that is not releasable to the general public. The Contractor or its personnel shall not release any information or documents that they are provided during performance of the contract without the express written permission of the KO through coordination with the COR.

1.6.17 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.18 All CLINs shall have the authorization of the COR prior to purchase and a copy of the authorization shall be submitted with all invoices for these purchases.

PART 2

DEFINITIONS & ACRONYMS

2. Definitions and Acronyms

2.1 Definitions:

2.1.1 Contracting Officer. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.2 Contracting Officer’s Representative. An employee of the U.S. Government appointed by the CO to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have authority to change the terms and conditions of the contract.

2.1.3 Defective Service. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.4 Deliverable. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.5 Key Personnel. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6 Physical Security. Actions that prevent the loss or damage of Government property.

2.1.7 Quality Assurance. The Government procedures to verify that services being performed by the

Contractor are performed according to acceptable standards.

2.1.8 Quality Assurance Surveillance Plan. An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.9 Quality Control. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.10 Subcontractor. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.1.11 Contractor. A supplier or Contractor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.12 Work Day. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.13 Work Week. Monday through Friday, unless specified otherwise.

2.2 Acronyms:

API Application Programming Interface

CAF Consolidated Adjudication Facility

CDRL Contract Data Requirements List

CIO Chief Information Office

KO Contracting Officer

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTS Commercial off the Shelf

CSV Comma Separated Value

DART Decision Analysis Risk Tool

DC District of Columbia

DD254 Department of Defense Contract Security Requirement List

DFAR Defense Federal Acquisition Regulation

DITMAC Defense Insider Threat Management and Analysis Center DoD Department of Defense

DCSA Defense Counterintelligence and Security Agency

DSoS DITMAC System of Systems

FAR Federal Acquisition Regulation

FY Fiscal Year

GOTS Government off The Shelf

IAW In Accordance With

JWICS Joint Worldwide Intelligence Communications System

NCR National Capital Region

OCI Organizational Conflict of Interest

ODC Other Direct Costs

PAC Post Award Conference

PhD Doctorate of Philosophy

POC Point of Contact

PRS Performance Requirements Summary

PRI Potential Risk Indicator

PWS Performance Work Statement

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Program

SIPRNet Secret Internet Protocol Router Network

SC2S Secret Commercial Cloud Services

TE Technical Exhibit

TS/SCI Top Secret Sensitive Compartmented Information

UC2S Unclassified and Secret Commercial Cloud Services

PART 3

GOVERNMENT FURNISHED PROPERTY (GFP), EQUIPMENT AND SERVICES

3. Government Furnished Items and Services:

3.1 Services: The Government will provide access to personnel and information necessary to satisfy the terms of the contract.

3.2 Facilities: The Government will provide the necessary workspace for the Contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

3.3 Equipment: DCSA will provide all necessary equipment to perform this requirement. Contractor personnel will take and appropriately document any necessary training related to the use of DCSA equipment.

The Government will provide laptops, access to scanners, printers, fax machines etc. and a limited number of storage devices for use by the Contractor on the DCSA Network, in the performance of this contract. In addition, the Contractor will be provided Government-Furnished Information (GFI) and Government-

Furnished Material (GFM) as applicable.

3.4 Materials: The Government will provide access to required regulations, policies, procedures and other Government information necessary for Contractor performance.

3.5 All Contractor personnel shall sign the DCSA “Consent to Monitoring” form.

3.6 Information: The following information will be provided to the user:

(a) Replacement, Modernization, and Modification: During the term of the contract, the Government may replace, modify, or improve equipment, systems, at the Government's expense and by means not associated with this contract. All replaced, improved, updated, or modernized, equipment and systems shall be operated by the Contractor at no additional cost to the Government unless such changes result in an increase or decrease in contract requirements.

(b) Initial familiarization/orientation shall be provided by DCSA at DITMAC, Crystal City, VA (or another location/method at DCSA’s discretion) location within five (5) days of contract award.

(c) DSoS 2.X and 3.X baseline code.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. Contractor Furnished Items and Responsibilities:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 Facility Clearance: The Contractor shall possess and maintain a TS facility clearance from DCSA.

The Contractor’s employees, performing work in support of this contract shall have been granted or will obtain a TS/SCI security clearance from the Personnel Security Management Office for Industry (PSMO-

I)/ Department of Defense Consolidated Adjudications Facility (DOD CAF) at time of award. The DD254 is provided in Section J.2 of this contract.

4.3 Materials and Equipment: For work performed at Government sites the Government shall provide all necessary materials, supplies and equipment necessary to accomplish the requirement under this PWS.

The Government shall provide the necessary office equipment to produce the deliverables and products under this PWS. For any tasks performed off-site or at a Contractor facility the Contractor shall furnish materials, supplies, and equipment necessary to accomplish the requirement.

PART 5

SPECIFIC TASKS

5. Specific Tasks: DITMAC Support Services- The Contractor shall provide sustainment and enhancement of the DSoS for DITMAC to include the following tasks:

5.1.1 Task 1: DSoS Enhancements

5.1.1.1 The DSoS 3x is a capability delivered that will be enhanced from the baseline capability for the purpose of processing these large disparate sources into a cogent insider threat case, enabling analysis, reporting, and follow up. The DSoS has the capability to initiate a case at the DITMAC and/or at any of the

DoD Components, with a unique identifier and build a corpus relevant to the individual being reported on by augmenting initial information with additional data from other sources. All data shall be entity resolved to ensure proper validation of individual data and minimal false alert reporting. The approach will enable customized integration of large data sets from disparate feeds, originating in multiple domains, using various schemas. DCSA anticipates using a multi spiral approach to manage requirements and features for the DSoS.

The system will be hosted in a NGA owned Cloud. The Contractor shall complete certification & accreditation and deployment of DSoS 3x to the DoD Cloud to include the following specific features:

5.1.1.2 The Contractor shall support efforts related to the sustainment and enhancement for JWICS instance of the DSoS v3.x.

5.1.2 Task 2: DSoS Sustainment - The DSoS as a baseline capability is resident in multiple environments and multiple phases of migration. The contractor shall be responsible for sustaining all deployments/instances of the DSoS (2.x and 3.x) throughout the lifecycle of the system.

5.1.2.1 DSoS NIPRNet and SIPRNet Production Environment Migration

5.1.2.1.1 The Contractor shall support the enhancement and modification of the Production version of the

DSoS Software to align with architectural requirements inherent to migrating the DSoS Production environment from its current implementation on premise at DCSA to the Commercial Cloud Services (C2S) environment hosted at the National Geospatial Intelligence Agency (NGA).

5.1.2.1.2 The Contractor shall support the migration of the DSoS Production environment to the

Unclassified and Secret Commercial Cloud Services (UC2S and SC2S) environments hosted at NGA.

Migration support shall include but not be limited to the establishment of both UC2S and SC2S

Preproduction environments, all applicable Assessment and Authorization activities required, and data migration from the DCSA on premise Production Environment to the newly established NGA C2S

Production environment.

5.1.2.1.3 The Contractor shall support and administer the DSoS software in the newly established DSoS

Isolated Virtual Data Center C2S environment. The Contractor shall continue to interface with DCSA personnel to ensure that the environment continues to be in alignment with all applicable DCSA policies and processes as required.

5.1.2.1.4 The Contractor shall be responsible for the backup and restoration of the VM images via VM snapshots within the C2S Production environment ensuring that backup and restoration processes and procedures are in alignment with DCSA policies and directives.

5.1.2.1.5 The Contractor shall be responsible for the backup and restoration of all supported data stores all supported systems operating within the C2S Production environment ensuring that backup and restoration processes and procedures are in alignment with DCSA policies and directives.

5.1.2.1.6 The Contractor shall provide systems administration to support the continued system operation and maintenance of all supported systems deployed to the C2S Production environment.

5.1.2.1.7 The Contractor shall be responsible for operating system patches, performing backups, and maintaining configuration control of S/W assets for all supported systems deployed to the C2S Production environment ensuring that backup and restoration processes and procedures are in alignment with DCSA policies and directives.

5.1.2.1.8 At such time the government deems appropriate, the contractor shall appropriately and securely decommission DSoS 2.x on the Unclassified, Secret, and Top Secret NGA Cloud domains in alignment with policy and regulations.

5.1.2.1.9 At such time the government deems appropriate, the contractor shall support DCSA in the secure decommission of DSoS 2.x on the Unclassified and Secret domains hosted at DCSA on-premises.

5.1.2.2 The Contractor shall provide systems engineering services to include the planning and engineering of the infrastructure and the identification of software and system design improvements for the DSoS

Software deployed on NIPRNet, SIPRNet, and JWICS.

5.1.2.3 The Contractor shall ensure proper systems functions and maintenance, ensuring that overall system performance meets or exceeds DITMAC and DCSA standards. The Contractor shall maintain audit records of system users and activities for the DSoS Software deployed on NIPRNet, SIPRNet, and JWICS.

5.1.2.4 The Contractor shall support DCSA in ensuring system compliance with all applicable DoD and

DCSA security policies and directives

5.1.2.5 The Contractor shall support the technical and enterprise architectures as they relate to the DSoS software for the DITMAC. The Contractor shall maintain DSoS Software database(s) by determining structural requirements, recommending developmental changes and installing new updates. The

Contractor shall determine database structural requirements by analyzing DITMAC operations, applications, and programming for the DSoS Software deployed on NIPRNet, SIPRNet, and JWICS.

5.1.2.6 The Contractor shall provide systems administration to support system operation and maintenance, transitioning of the DSoS Software this to the DCSA CIO after the first 12 months. The Contractor shall be responsible for the planning and coordination of the installation, test, operation, troubleshooting, and maintenance of the software, to include upgrades that do not significantly expand the system performance envelope, transitioning this to the DCSA CIO after the first 12 months.

5.1.2.7 The Contractor shall monitor software performance to prevent problems in order to keep the DSoS running smoothly and efficiently DSoS Software running smoothly and efficiently on NIPRNet, SIPRNet, and JWICS.

5.1.2.8 The Contractor shall be responsible for operating system patches, performing backups, and maintaining configuration control of S/W assets.

5.1.2.9 - RESERVED

5.1.2.10 The Contractor shall support the creation and maintenance of enterprise- related architectural documentation for the DSoS Software deployed on NIPRNet, SIPRNet, and JWICS. The Contractor shall provide DoD architectural framework (DoDAF) updates to DoD Components and update DoDAF architectural views for DITMAC internal documentation purposes. The Contractor shall also complete the development of required documentation for certification and accreditation of DITMAC systems across all networks which the DSoS platform deployed or being deployed during the contractual period of performance the DSoS software deployed on NIPRNet, SIPRNet, and JWICS.

5.1.2.11 The Contractor shall maintain user training materials, provide user training, respond to basic user support questions, track software trouble tickets, and resolve software related problems. The Contractor shall capture Frequently Asked Questions (FAQs). The Contractor shall develop briefings that include advanced multimedia and graphic production capabilities that detail the DSoS and its capabilities.

5.1.2.11.1 The Contractor shall provide ONE (1) Full Time Equivalent (FTE) Resource or

Equivalent Support to provide training to DITMAC and DoD Component personnel for the DSoS Software deployed on NIPRNet, SIPRNet, and JWICS. This resource shall:

5.1.2.11.1.1 Upon approval by the COR, Schedule, coordinate, support, and facilitate training sessions for DSoS Software customers on NIPRNet, SIPRNet, and JWICS as needed/as directed by Government program leadership during the contractual period of performance.

5.1.2.11.1.2 Provide training sessions via Virtual Teleconferences and in person for DSoS Software customers on NIPRNet, SIPRNet, and JWICS located at both CONUS and OCONUS installations as needed/as directed by Government program leadership during the contractual period of performance.

5.1.2.11.1.3. The exact quantity and location of in person or virtual training sessions are unknown at this time. The Government expects to facilitate approximately two (2) CONUS and zero (0) OCONUS DSoS software training sessions during the contractual period of performance. The Government anticipates

CONUS training to be within the national capital region with virtual training the norm. Submit training requests to the Government prior to accepting a training request or scheduling.

5.1.2.12 The Contractor shall provide One (1) Full Time Equivalent (FTE) Resources or Equivalent Support to provide Help Desk Support for DSoS Software customers on NIPRNet, SIPRNet, and JWICS as needed/as directed by Government program leadership during the contractual period of performance. These resources shall:

5.1.2.12.1 Provide direct support for DSoS Software customers contacting the DSoS Help Desk via phone, email, or in person between the core hours of 0730 – 1600 Monday through Friday except for Federal holidays and days in which the DITMAC facilities are otherwise closed.

5.1.2.12.1.1 Tier 1 support shall include initial issue information collection and recording, issue identification, initial issue triage, and basic troubleshooting.

5.1.2.12.2 Provide direct support for DSoS Software issues reported requiring Tier 1 support as needed/as directed by Government program leadership during the contractual period of performance.

5.1.2.12.2.1 DSoS Software Tier 1 support shall include initial issue information collection and recording, issue identification, initial issue triage, and basic trouble shooting.

5.1.2.13.3 Escalate issues to and coordinate with the DSoS Software Development Team for issues requiring Tier 2, 3 and/or 4 support (defined below).

5.1.2.13.3.1 DSoS Software Tier 2 support shall include additional information collection and recording, investigation, troubleshooting, and engaging the DSoS Software Development Team for troubleshooting and resolution support as needed.

5.1.2.13.3.2 DSoS Software Tier 3 support shall include additional information collection and recording, investigation, troubleshooting, and troubleshooting reported issues directly with Senior DSoS

Software Development personnel for troubleshooting and resolution support as needed.

5.1.2.13.3.3 DSoS Software Tier 4 support shall include engaging with DCSA or other host environment partner’s technical personnel, external hardware and software vendors, and technical representatives supporting the customer’s workstation and/or network as needed to further troubleshoot and resolve the reported issue(s).

5.1.2.13.4 Update and maintain issue tickets within the same issue tracking system employed by the

DSoS Software Development Team.

5.1.2.13.5 Provide a summary of and metrics for issues reported and/or resolved in the Monthly

Status Report.

5.1.2.14 The Contractor shall provide ONE (1) Full Time Equivalent (FTE) Resource or Equivalent Support to provide subject matter expertise support as needed/as directed for DSoS Software deployed on NIPRNet, SIPRNet, and JWICS during the contractual period of performance. Support shall include but not limited to: preparing, delivering, and supporting briefs/meetings; drafting and maintaining documentation;

engaging with DITMAC personnel and other Insider Threat Community members; and other tasks as needed/as directed by the COR.

5.1.2.15 The Contractor shall provide ONE (1) Full Time Equivalent (FTE) Resource or Equivalent Support for program management, documentation, planning, and coordination support for efforts related to the formalization of the DSoS Software and its supporting Program Management Office as an Enterprise capability.

5.2. Deliverables: All deliverables shall be provided to the KO and COR in soft copy and in accordance with (IAW) the Deliverable Table in Part 8.2.

5.2.1 Task 1: DSoS Enhancement Deliverables:

5.2.1.1 Monthly Status Report: The Contractor shall produce monthly status reports of task progress and completion. The reports shall indicate the POP covered, as well as an executive summary of work completed, in progress and planned for each task, any problems encountered, impact of actual and potential problem areas causing schedule variances and mitigation plan and comprehensive review and analysis of schedules, and technical performance of each contract task.

5.2.1.2 Final Report: The Contractor shall provide a written final report no later than 10 business days prior to the conclusion of the POP. This report shall include a summation of the activity and documentation completed, recommendation for follow-on activity or sustainment of the current effort, and identify any gaps or vulnerabilities discovered during the course of this contract action.

5.2.1.3 Integrated Master Schedule (IMS): The IMS is an integrated schedule containing the networked, detailed tasks necessary to ensure successful program execution. The IMS is vertically traceable to the

Project plan, and should correlate or help produce a Work Breakdown Structure (WBS). The Contractor shall create and maintain an IMS in Microsoft Project (or comparable) format for the overall effort. The

IMS shall be used to track accountability among a diversity of stakeholders, and ensure awareness of the tasks (and their dependencies) required to achieve the strategic objectives captured above. The IMS will remain a working document throughout the duration of the effort, maintained by the Contractor, with the first draft required no more than two months following contract award.

5.2.1.4 Equipment Inventory Report: For each task, the Contractor shall deliver, 30 calendar days after contract award and 30 calendar days prior to the end of the POP. The Contractor shall provide to the PM and COR a listing by item number, nomenclature, quantity, price, and date of purchase, total value and location of all equipment that is purchased by the Contractor and associated with the award.

5.2.1.5 DoD Architecture Artifacts: Updated and delivered for each major release. The DoD Architecture

Framework Documentation will be used to provide architecture framework product documentation that describes characteristics to the purpose of the architecture. OV-1/OV-3 provided at a minimum.

5.2.1.6 Contract Exit Transition Plan: Delivered, no later than 20 calendar days after contract award to a subsequent Contractor on substantially the same subject matter, and updated 30 calendar days before the end of this contract. The Contractor shall submit a plan for transitioning the necessary tasks, projects, and activities from the incumbent. The plan shall identify transition planning strategy, schedule, risks, roles, and responsibilities. Since interruptions or delays to the work could impact missions, it is essential that attention be given to minimizing any interruptions or disruptions. The Contractor shall ensure that maximum cooperation with the new Contractor and ensure that each task receives adequate attention during any phase-in 'period specified by the government.

5.2.1.7 Specialized Reports: The Contractor shall provide reports, data, and other documentation described in the Performance Requirements Summary (PRS) (7.1) below in the format described or provided by the COR.

5.2.1.7.1 Requirements Specification Documents (See Task 1, sub task 5.1.1.1)

5.2.1.7.2 Data Analysis Technical Reports (See Task 1, sub task 5.1.1.2.1)

5.2.1.7.3 System Designs Documents (See Task 1, sub task 5.1.1.1)

5.2.1.7.4 Data Flow Diagrams (See Task 1, sub task 5.1.1.2.1)

5.2.1.7.5 Software Code- including source code and executable binaries with all associated libraries and tools necessary to run. (See Task 1, sub task 5.1.1.1, 5.1.1.2, 5.1.1.3,5.1.1.4)

5.2.1.7.6 Software Requirements Specification (SRS) (See Task 1, sub task5.1.1.1)

5.2.1.7.7 Software Version Description (SVD) (See Task 1, sub task5.1.1.1)

5.2.2. Task 2: DSoS Sustainment Deliverables:

5.2.2.1 Monthly Status Report: The Contractor shall produce monthly status reports of task progress and completion. The reports shall indicate the POP covered, as well as an executive summary of work completed, in progress and planned for each task, any problems encountered, impact of actual and potential problem areas causing schedule variances and mitigation plan and comprehensive review and analysis of schedules, and technical performance of each contract task. It shall break down resource expenditures

(current and cumulative) and notate any travel costs (if any).

5.2.2.2 Final Report: The Contractor shall provide a written final report no later than 10 working days prior to the conclusion of the POP. This report shall include a summation of the activity and documentation completed, recommendation for follow-on activity or sustainment of the current effort, and identify any gaps or vulnerabilities discovered during the course of this contract action.

5.2.2.3 Financial reports: Delivered monthly. The monthly report for each task will include at a minimum, labor and other direct costs (ODCs) incurred for the current period, cumulative costs for the contract period, remaining funds available, and labor hours expended; include graphics (e.g., line charts) showing actual costs against planned costs and explain all variances. The financial report shall be in accordance with the associated contract data requirements list.

5.2.2.4 Integrated Master Schedule (IMS): The IMS is an integrated schedule containing the networked, detailed tasks necessary to ensure successful program execution. The IMS is vertically traceable to the

Project plan, and should correlate or help produce a Work Breakdown…