Attachment 0001 - PWS - ADA IR.pdf

ACCELERATING DATA AND ARTIFICAL INTELLIGENCE

(ADA) TEAMS INCIDENT RESPONSE (IR)

PERFORMANCE WORK STATEMENT (PWS)

FOR

CHIEF DIGITAL AND ARTIFICIAL INTELLIGENCE OFFICE

(CDAO)

15 November 2024

Table of Contents 1 Introduction 2 Background

2.0 Tasks

2.1 Location of Performance

2.2 SOFA

2.3 ITAR

2.4 Security

2.5 Government Furnished Property and Equipment (GFP/GFE)

2.6 Funding Types

3 Subtasks

3.0 Program Management

3.1 Provide Program Integration, Training, and End User Support

3.2 Data Labeling and Pipeline Management

3.3 AI Engineering and Integration Support

3.4 Acceleration of Emerging AI Technologies Research and Integration

4 Contract Management

4.0 Period of Performance

4.1 Place of Performance

4.2 Travel

4.3 Travel Screenings

4.4 Travel Documents

4.5 Security

4.6 USG Networks and Communications Infrastructure

5 Additional Information

5.0 Point of Contact (POC)

5.1 Project Guidance

6 Anti-Terrorism/Operational Security

1 Introduction To scale data, analytics, and AI for the Department of Defense (DoD), the Mission Analytics Directorate at the Chief Digital and Artificial Intelligence (AI) Office (CDAO) is establishing embedded teams to provide data scientists, full stack developers, software engineers, product management support (e.g., monitors product general availability process, develops marketing material and training content), customer success functions (e.g., customer analytics, UI/UX, product design & solutioning), and other product services support to enable the adoption of data driven decision making across the DoD.

The Accelerating Data and Artificial Intelligence Teams will henceforth be referenced in the document simply as ADA. For the purposes of centralized management, the term CDAO Central will be used.

The Incident Response teams will henceforth be referenced in the document simply as IR.

The word organization will be used to indicate generically the organization that is to receive the support as outlined in the location of performance section.

2 Background The ADA and IR teams have been fully operational for the past several years. ADA teams are embedded within the Combatant Commands (CCMD) and at Joint Staff. IR teams are co-located with the ADA teams in EUCOM, INDOPACOM, and the Joint Staff. The IR team is not a 24-hour operation under normal conditions but must plan for flexibility and scalability for continuous operations when mission demands dictate.

2.0 Tasks

The following tasks are applicable to the scope of this PWS

Task Task Title 1 Program Management 2 Provide Program Integration, Training, and End User Support 3 Data Labeling and Pipeline Management 4 AI Engineering and Integration Support

5 Acceleration of Emerging AI Technologies Research and Integration

The following table associates the tasks to the respective team Task ADA IR

1 X X 2 X X 3 X X 4 X X 5 X X

2.1 Location of Performance

The teams will be postured to support all CCMDs and adjust as directed by CDAO leadership based on product needs and priorities. Locations detailing ADA and IR requirements are captured in the table below.

Where more than one element (e.g. ADA, IR, etc) exists at the same location, teams are expected to work collaboratively rather than exclusively. Where multiple elements are co-located, contractors may support more than one line of effort based on mission needs and location priorities as directed by designated government personnel.

Organization Location IR ADA

AFRICOM - U.S. Africa Command Kelley Barracks, Stuttgart Germany X

CENTCOM - U.S. Central Command MacDill Air Force Base, FL X

CYBERCOM - U.S. Cyber Command Fort Meade, MD X

EUCOM - U.S. European Command Patch Barracks, Stuttgart, Germany X X

INDOPACOM - U.S. Indo-Pacific Command Camp H.M. Smith, Hawaii X X Joint Staff (ADA)

OSD CDAO (IR)

Pentagon, Washington DC X X

NORTHCOM - U.S. Northern Command Peterson Space Force Base, CO X

SOCOM - U.S. Special Operations Command MacDill Air Force Base, FL X

SOUTHCOM - U.S. Southern Command Doral, FL X

SPACECOM - U.S. Space Command Peterson Space Force Base, CO X

TRANSCOM - U.S. Transportation Command Scott Air Force Base, IL X STRATCOM - U.S. Strategic Command Offutt Air Force Base, NE X

2.2 SOFA

The contract will require contracting support to be based in Germany and will therefore require that some of the contractors be covered under the Status of Forces Agreement (SOFA) to live in that area during the period of performance.

2.3 ITAR

The contractor and/or its subcontractors may be required to generate, or need access to, export-controlled items. It will be the responsibility of the contractor, as the exporter, to obtain the appropriate export license or exemption(s). The contractor shall comply with all U.S. laws, policies, and regulations applicable to the exchange of information with foreign nationals and foreign countries, including, but not limited to the ITAR, the Export Administration Regulations (EAR), and policies of the requiring activity’s foreign disclosure office, in accomplishing the requirements. The contractor shall refer to DFARS Clause 252.225-7048, Export-Controlled Items (June 2013) for compliance. As directed by the Government, the contractor may be required to release or exchange information with representatives of Five Eyes (FVEY), NATO, and all countries/nation states within the AFRICOM, U.S. Central Command (CENTCOM), EUCOM, FORSCOM, INDOPACOM, and SOUTHCOM AORs.

2.4 Security

Team SCIF Access Required

SECRET

Access required

CAC

Required

Sponsoring Org

ADA Yes Yes Yes CDAO, Local

CCMD

IR No Yes Yes CDAO, Local

CCMD

2.5 Government Furnished Property and Equipment (GFP/GFE)

GFP/GFE will be provided. Contractors shall have internal controls to manage (control, use, preserve, protect, repair and maintain) USG property in its possession accountable to the award/order. The USG will also manage and monitor GFP. The following approximate allocation of GFE is outlined in the table below. The numbers outlined below are an approximation of contractor numbers aligned to each portfolio.

Team GFE Article Quantity Sponsoring Org ADA Laptop 55 CDAO, Local CCMD

IR Laptop 25 CDAO, Local CCMD

2.6 Funding Types

The contract must be able to accept the following types of funding:

• O&M

• RDT&E

• BA-08

3 Subtasks The following are subtasks related to the tasks outlined in section 3.1.

3.0 Program Management

3.0.0 Development of Monthly Status Reports (MSRs) and Quarterly Report Summaries (QRS).

3.0.1 Development of a Project Schedule.

3.0.2 Development of a Staffing Plan and associated labor accounting controls.

3.0.3 Maintain, assist in prioritization of the global organization development project backlog.

3.0.4 Advise on global deployment of resources.

3.0.5 Coordinate and facilitate organization Team functions with WHS headquarters.

3.0.6 Track and collate reporting of global deployment of resources under the purview of organization entities, if given access to their travel data as required by CDAO Central leadership

3.0.7 Coordinate and maintain internal collaboration tools, version control / change management, productivity tools, MS Teams, and email distribution groups.

3.0.8 Coordinate travel, general scheduling, assist in security support for organization teams and WHS visits, and host visitors.

3.0.9 Facilitate onboarding training for organization Embedded Teams, including administrative processes, organization overview, technology, platforms overview, and CDAO SOPs delivered on schedule as defined by CDAO Central leadership.

3.0.10 Provide continuity and mitigation planning for Embedded Teams located in foreign locations.

3.0.11 Communicate projects status, blockers, and ground truth to CDAO leadership.

3.0.12 Generate roadmaps and assist with the prioritization of current initiatives in order to balance business goals with Customer Impact.

3.0.13 Conduct Digital Readiness Assessments using the Framework as defined by CDAO.

3.1 Provide Program Integration, Training, and End User Support

3.1.0 Utilize and promote use of CDAO Central HQ knowledge management solutions and requirements generation/prioritization.

3.1.1 Provide technical and executive level reporting to CDAO Central HQ Team that communicate impact and reach of local efforts.

3.1.2 Document and understand organization Data Science (DS) & Artificial Intelligence (AI) training programs.

3.1.3 Identify Digital Services training gaps in CCMD, offer trainings to fill those respective gaps.

3.1.4 Standardize processes for training on tools developed.

3.1.5 Understand organization integration opportunities, scope requirements, and assess alternatives.

3.1.6 Leverage quantitative and qualitative data to influence design decisions.

3.1.7 Provide ongoing tailored and on demand training to organization personnel on the technology stacks employed by the commands.

3.1.8 Establish engineering best practices and ensure compliance across the entire portfolio for consistency in practice. This includes and not limited to documentation lint standards, utilization of source code repositories, unit testing, CI/CD pipelines, code peer review, etc.

3.1.9 Enable development with API technologies including the installation, configuration, operations, and troubleshooting of API products.

3.1.10 Provide customer success services and CRM support.

3.2 Data Labeling and Pipeline Management

3.2.0 Collaborate with individual organization and CDAO Central HQ Team to gather documentation on local hosting and data architecture relative to military AI requirements in a machine and human readable format.

3.2.1 Document failover/continuity of operations (COOP) plans for data systems.

3.2.2 Identify any existing local development environments and provide engineering best practices to enhance existing systems.

3.2.3 Catalog, label, and ingest structured and unstructured data into appropriate DoD data catalogs based on mission/function and identify data that is part of any systems of record as directed by organization and CDAO Central HQ Team.

3.2.4 Establish engineering best practices and ensure compliance across the entire portfolio for consistency in practice. This includes and not limited to documentation lint standards, utilization of source code repositories, unit testing, CI/CD pipelines, code peer review, etc.

3.2.5 Employ DevSecOps when developing, testing, and maintaining data pipelines.

3.2.6 Enable development with API technologies including the installation, configuration, platform operations, and troubleshooting of API products.

3.3 AI Engineering and Integration Support

3.3.0 Leverage and maintain awareness of work across organizations to communicate the vision for the products.

3.3.1 Align and prioritize initiatives with the product roadmap in accordance with the organizations needs and overall operational goals.

3.3.2 Conduct research to identify policies, directorates, stakeholders to design resources to develop feasible, viable and desirable solution through collaboration with engineering teams.

3.3.3 Adhere to a CDAO Central leadership provided standard technical approach and provide transparency of development progress and methods for passive quality review and reuse of solutions.

3.3.4 Identify data solutions in accordance with agreed organization standards that ensure services are resilient, scalable, and future proof.

3.3.5 Assist CDAO Developers, Data Stewards, Software Architects and Product Managers to produce DoD AI Technology roadmaps.

3.3.6 Document and maintain applicable organization Software Architecture maps and technology roadmaps.

3.3.7 Improve digital services through rapid prototype and develop solutions on existing infrastructure in a response to emergent requirements.

3.3.8 Translate initial organization integration opportunities into fully scoped and actionable use cases.

3.3.9 Facilitate access to infrastructure for operational development by organization digital experts.

3.3.10 Identify, document, and share organization -specific processes (command and control or technical) required to accomplish CDAO Central development objectives.

3.3.11 Document existing data ontologies and data types in use at organizations encountered in development tasking and indicate availability for reuse.

3.3.12 Identify organization requirements and work with organization and CDAO Central HQ Team to propose solutions to connect CCMD requirements to existing solution providers.

3.3.13 Facilitate the “conception though completion” of large-scale digital products, in conjunction with Product teams that can be composed of Engineering, web applications and UX Design.

3.3.14 Enable development with API technologies including the installation, configuration, platform operations, and troubleshooting of API products.

3.3.15 Develop enterprise applications with modern JavaScript frameworks if needed such as React, Angular, and Vue.

3.3.16 Build modern, responsive, and cross-browser-compatible websites if needed using HTML, CSS, and JavaScript.

3.3.17 Design, develop, and maintain enterprise analytic products using business intelligence software applications, such as Qlik, Tableau, etc.

3.4 Acceleration of Emerging AI Technologies Research and Integration

3.4.0 Perform continuous discovery and recommend projects for backlog prioritization.

3.4.1 Recommend community tools to support DoD and organization AI Development including Wikis, Software Engineering Tools such as Github, forums, and other means.

3.4.2 As blockers arise in product development, recommend process improvements to accelerate CCMD Data maturity Development.

3.4.3 Compile a list of available AI offerings to assemble a DoD AI offerings catalog.

3.4.4 Provide research, modeling, technical analysis, and technical writing support.

4 Contract Management The Army Contracting Command Rock Island (ACC-RI) is the contracting agency for the USG.

As the Contracting Activity for this agency, they have the authority, through a duly appointed Contracting Officer (KO), to enter, administer, and/or terminate this contract and make related determinations and findings. Responsibilities after award are in accordance with those defined in the contract and those applicable portions of the Federal Acquisition Regulation (FAR) and its supplements. ACC-RI is the only USG official who can provide direction to the contractor resulting in changes to the scope, schedule, and cost of this effort. Any changes required by the USG Inspector, or the Contracting Officer Representative (COR) must be approved in writing by the ACC-RI KO.

4.0 Type of Contract

The task order (TO) shall be a Firm Fixed Price (FFP) base year plus one option year in accordance with Federal Acquisition Regulation (FAR) 52.217-9, Option to Extend the Term of the Contract.

4.1 Performance of Contract

The contract performance will be aligned with the purchase of 26 sprint cycles across the year(s) of performance. This will facilitate 2-week sprint cycles aligned to each line of effort within each of the portfolios. Work will be delivered in two week increments throughout the period of performance. The government reserves the ability to manage and dynamically reallocate and the staffing across the unique sprint teams to meet mission needs and stay within budgetary constraints.

4.2 Place of Performance

This work shall be performed as hybrid of telework and onsite in DC-area offices of the CDAO in Falls Church, Pentagon, or Arlington or at the CCMDs as described in section 2.1.

*Telework Eligibility will be determined by the COR on a case-by-case basis after TO award. Generally, the balance between onsite and hybrid work will likely depend on specific portfolio demands, project phases, and security access requirements for that mission/project (refer to Section 4.5).

4.3 Travel

As designated, Travel shall be used to satisfy the requirements of this Contract. Travel is an Other Direct Cost (ODC). ODC’s are on a cost-reimbursable basis, with no fee. Travel shall be in coordination with the USG and rates should be comparable to the Joint Travel Regulation (JTR) and reimbursable as outlined in the Federal Acquisition Regulations (FAR) Part 31.205-46. Travel for this contract may include deployment to hazardous duty areas. The Contractor may make frequent flights and must be prepared for tasking at remote sites. An increase in labor hours (up to 72 hours) is authorized per week by the USG if deployed to non-hazardous and hazardous duty areas. Note: This is standard precautionary language, extremely unlikely to ever be needed, and would be discussed on a case-by-case basis at the time if necessary. This is virtually non-existent.

Travel shall be in accordance with the provisions of the JTR, when applicable.

Transportation may be commercial means or when mission requirements dictate, the USG may provide transportation for the desired travel via USG vehicle (car, van, or small truck) or USG aircraft (both fixed wing and rotary). When the cost of travel may exceed the dollars allotted in the TO, the Contractor shall notify the Contracting Officer prior to any travel for authorization to proceed.

Contractors may need to prepare for variable travel demands based on CDAO’s mission requirements. However, travel is not expected to be highly frequent due to the presence of CDAO personnel already stationed at many key locations.

4.4 Travel Screenings

When Contractor personnel are deployed in support of special exercises and operations, the USG will conduct theater specific training and briefings, issue theater specific clothing and individual equipment, ensure that medical requirements (such as immunization, DNA screening, HIV testing and dental examinations) for deployment have been met, and arrange for transportation to the theater of operations.

4.5 Travel Documents

As part of the processing of Contractor personnel, the USG will provide the following distinct forms of identification:

a. Official No-Fee U.S. Passport and Travel Visas. When deployed in support of the USG, Contractor personnel are required to always carry a valid passport. The USG will coordinate through the Department of State and appropriate embassies for use and issuance of official no-fee U.S. passports and the required visas for travel in support of the USG.

b. CAC. This card identifies one’s status as a contractor employee accompanying the U.S. Armed Forces. This card serves as identification and authorizes access to military facilities.

c. Personal Identification Tags. The identification tags shall include the following information: full name, social security number, blood type and religious preference.

These tags should be always worn when in the theater of operations.

d. Other Identification Cards. In addition, other identification cards, courier cards, badges, etc. shall be issued depending on the USG ’s security requirements, the sensitivity of the exercise or operation, or because of other requirements based on the theater of operations.

e. Force Protection. The USG will provide force protection for Contractor personnel accompanying the USG in support of exercises and operations.

4.6 Security

All positions provided on this contract require a SECRET clearance. The USG’s security requirements are in accordance with the DD Form 254 attached to this contract action.

Contractor personnel performing work under this contract must have the required clearance at the time of the proposal submissions and must maintain the level of security required for the life of the contract.

If additional clearances are needed, governments sponsorship may be available on a case-by-case basis. It is expected that approximately 75% of the ADA staffing will require SCI eligibility to fulfill mission requirements.

Positions requiring security clearance access are generally expected to be on-site to meet security requirements. Telework flexibility may be limited and subject to role-specific condition. For example, if a project does not require classified space access, then the team may have the option to telework, provided all compliance protocols are followed. All contractors and government personnel must adhere to CDAO telework regulatory guidance and standards as it may continue to change.

4.7 USG Networks and Communications Infrastructure

It is the USG’s intent to have contractor software development and integration efforts interface with required USG systems. Unless approved by the USG, the Contractor is prohibited from the development of independent, parallel, or mirrored operating systems. If the Contractor is provided access to, or purchases services on a fee for service basis, on any USG networks or communications infrastructure, they will comply with DoD and local guidelines and requirements for review and approval prior to introducing commercial, USG developed, or contractor developed applications, software, or equipment into the environment.

5 Additional Information

5.0 Point of Contact (POC)

The POC for the contractor will be the KO and COR.

5.1 Project Guidance

The KO/COR will provide project guidance or direction regarding the functional requirements for all software products generated and customized under this PWS. Functional guidance provided by the KO/COR will be coordinated with the end user organization to ensure that cost and schedule impacts are identified and addressed prior to being implemented by the Contractor.

6 Anti-Terrorism/Operational Security

Homeland Security Presidential Directive-12 (HSPD-12). HSPD-12 establishes a mandatory, Government-wide standard for secure and reliable forms of identification issued by the Federal

Government to its employees and Contractors (including Contractor personnel). Under this Directive, the heads of executive departments and agencies are required to implement programs to ensure that identifications issued by their departments and agencies to Federal employees and Contractors meet the Standard.

a. Individual Contractor personnel shall complete the Application for Identification Card/DEERs enrollment (DD Form 1172-2) CAC request and the System Authorization Access Request (SAAR) DD Form 2875 upon arrival. Submitters will provide updates for continued access for contract extensions, new awards, and contract / contractor termination.

b. The submitters will notify the security office and their contract leads of contract renewals. Subsequent access based on contract / contractor badge renewals will require official notification via email or formal memoranda from submitter to the security office.

Documentation not properly completed will not be accepted. Submitters will forward their DD Form 1172-2 and DD Form 2875 to the security office via email. Submitters must also copy appropriate government leads.

c. The security office will validate the contractor’s security clearance. If a contractor employee has a correct background investigation and favorable adjudication, they will have their CAC application initiated within 24 hours of submission.

d. If the contractor does not have a valid background check or favorable adjudication eligibly by the DoD CAS (Consolidated Adjudication Service), and is on an unclassified effort, they must undergo the Homeland Presidential Directive 12 (HSPD-12) access vetting process. The submitter, and the security office, will jointly complete the HSPD-12 package vetting process. Contractor CACs in this case must have a completed Federal Bureau of Investigation check with favorable fingerprint results returned prior to granting an interim CAC. The following applies to HSPD-12 vetting:

(I) The submitter, working with their contractor, must submit contractor Declaration for Federal Employment (OF-306) completing (items 1, 8, 9, 10, 11, 12, 13, 16, and 17).

(II) The contractor must include an up-to-date resume.

(III) The security office will complete a HSPD-12 Notification of Incoming Personnel

(NIP) form and submit it PSOD for processing.

e. Operational Security (OPSEC). Protecting critical and sensitive unclassified and controlled unclassified information (CUI) is a collective responsibility. Contractor personnel must follow OPSEC policies. This includes a requirement that contractor personnel must complete Level I OPSEC Awareness training within 30 calendar days of their reporting for duty and annually thereafter.

f. Information Awareness Training / Cyber Awareness Challenge. Individual contractor personnel must complete the DoD IA awareness training (also referred to as the Cyber Awareness Challenge) before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions must comply with DoD training requirements in DoDD 8570.0.1, and DoD 8570.01-M within six months of appointment to IA/IT functions.

g. Controlled Unclassified Information (CUI). The Contractor is required to fully comply with all provisions of the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. This includes the implementation and maintenance of cybersecurity protections in accordance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, 'Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.' The Contractor shall apply these protective measures to all systems that process, store, or transmit Covered Defense Information (CDI) including Controlled Unclassified Information (CUI).

6 Anti-Terrorism/Operational Security