Attachment 01 Performance Work Statement.pdf

CUI

SIP{R

ATTENTION

ATTENTION

Controlled by: PMW 220

CUI Categories: (1) General Procurement and Acquisition

(2) Source Selection

Distribution/Dissemination Control: NOCON

POC: Cherie Bradley, cherie.l.bradley.civ@us.navy.mil

All individuals handling this information are required to protect it from unauthorized disclosure.

Handling, storage, reproduction, and disposition of the attached document(s) must be in accordance with 32 CFR Part 2002 and applicable agency policy.

Access to and dissemination of Controlled Unclassified Information shall be allowed as necessary and permissible to any individual(s), organization(s), or grouping(s) of users, provided such access or dissemination is consistent with or in furtherance of a Lawful

Government Purpose and in a manner consistent with applicable law, regulations, and

Government-wide policies.

Standard Form 901 (11-18) mailto:cherie.l.bradley.civ@us.navy.mil

Standard Labor Data Collection and

Distribution Application (SLDCADA) Performance Work Statement Navy Enterprise Business Solutions Program

Version 1.6

Date: 23 September 2026

Distribution Statement F: Further dissemination only as directed by PMW 220 (4 October 2021) or higher authority. Refer to Program Manager, Navy Enterprise Business Solutions Program Management

Office (PMW 220), Program Executive Office, Manpower, Logistics, and Business Solutions (PEO

MLB), Washington Navy Yard, 1325 10th St. SE, Building 196, Washington, DC 20374 for additional document requests.

Destruction Notice: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Controlled by: Department of the Navy Controlled by: PMW 220

CUI Categories: PROCURE, SSEL

Distribution Statement: Statement F POC: Cherie Bradley, cherie.l.bradley.civ@us.navy.mil mailto:cherie.l.bradley.civ@us.navy.mil

SLDCADA

Performance Work Statement

File name:

SLDCADA_PWS_v1p0.doc Page:

1/66 Version:

Date of Creation24 SEP 2026

1 BACKGROUND

2 OBJECTIVE

3 SAMPLE TEAM BREAKOUT AND TASKS

4 SCOPE

4.1 Sustainment Support Activities Program of Record (POR)

4.2 Additional Services

5 APPLICABLE REGULATIONS & DIRECTIVES

6 REQUIREMENTS

6.1 Sustainment Support Activities POR Requirements

6.1.1 Program Management:

6.1.2 Release Management

6.1.3 IT System Management and Support

6.1.4 Data and Interface Management Support

6.1.5 Customer Support

6.2 Additional Services

6.2.1 Migration of SLDCADA Environments to Alternate Data Center for Cloud Hosting Services

6.2.2 New User Community Implementation

6.2.3 Risk Management Framework (RMF) authority to operate (ATO) .......... Error! Bookmark not defined.

6.2.4 Risk Management Framework (RMF) authority to operate (ATO)

7 GENERAL REQUIREMENTS

7.1 Digital Data Management

7.2 Delivery

7.3 Performance Requirements Summary (PRS)

7.4 Government Furnished Resources

7.5 Government Facilities

7.6 Software Licenses

7.7 Contractor Furnished Resources

8 REPORTING REQUIREMENTS

8.1 Deliverables and Reports

8.2 Unclassified Report Markings

9 GENERAL INFORMATION

9.1 Place of Performance

9.2 Hours of Operation

9.3 Security Requirements

9.4 Mandatory Training

9.5 Contractor Employee Identification

9.6 Service Contract Reporting

9.7 Travel

APPENDIX A: TABLE OF DELIVERABLES

APPENDIX B: CONTRACT PERFORMANCE BASED MATRIX

APPENDIX C: SLDCADA PROGRAM SUPPORT TOOLS

Page:

2/66

10 APPENDIX D: NIS

HISTORICAL METRICS

1 BACKGROUND

SLDCADA is an unclassified, web-based, customizable time and attendance (T&A) and labor reporting system providing a single input screen via a single sign on capability utilizing Common

Access Card/Public Key Infrastructure (CAC/PKI)-based login functionality. SLDCADA meets all regulatory requirements (Defense Civilian Pay System (DCPS)/Defense Finance Accounting

System (DFAS), Cyber Security (CS), and 508 Accessibility) for entering and tracking of civilian T&A data. SLDCADA currently provides T&A capabilities and labor reporting services to more than 60,000 users.

SLDCADA is a java-based application running on an Oracle 19c database platform with production, development, and test environments (hereby referred to as the SLDCADA Solution) located in the Amazon Web Services (AWS) cloud environment. The Cloud Computing

Innovation, Transformation, and Integration (Cloud CITI) in Charleston, SC acts as the Navy

Cloud Broker, providing an Infrastructure as a Service (IaaS) environment to the SLDCADA

Program.

SLDCADA’s website, https://www.sldcada.dc3n.navy.mil, is a single point of entry to the application, customer documentation repository, and reservation system for SLDCADA training events. The website employs web design industry best practices to provide a modern, user-friendly experience for SLDCADA users. It is accessible from any web browser and includes features such as a site wide search function, a SLDCADA “Tips and Tricks” section, and an array of Computer Based Training (CBTs) modules to self-train at the user’s convenience.

SLDCADA transfers civilian time data to DCPS; military and contractor time can be transferred to local / customer-identified systems, as required. It offers centralized or distributed input in either a weekly or a biweekly reporting format. SLDCADA tracks civilian labor hours by type hour codes (THCs) for pay purposes and civilian, military, and contractor labor hours against job order numbers (JONs) and/or Work Breakdown Structures (WBSs) for financial and cost collection purposes.

Full audits of all entries are automatically stored and available via a variety of system reports.

SLDCADA provides both full reporting and exception-based reporting. The application provides strict security controls to ensure access to functionality and data is controlled and monitored and adheres to mandated separation of duties. Detailed audit records are collected and preserved within the application to ensure traceability and accuracy of all data updated within the system to meet Federal Information System Controls Audit Manual (FISCAM) and other Department of

Defense audit compliance requirements.

Page:

3/66

2 OBJECTIVE

The objective of this PWS is to provide end-to-end integrated system sustainment and infrastructure support services for SLDCADA. The Contract is a Firm-Fixed-Price (FFP) contract. No cost-type effort shall be performed under this Contract except for Other Direct

Costs (ODCs) expressly authorized in advance by the Government Contracting Officer.

Page:

4/66

3 SAMPLE TEAM BREAKOUT AND TASKS

The “Sample Team Breakout” and “Sample Tasks” charts below are provided for general informational purposes only and reflect the Government’s estimate of the types and number of personnel that may be required to support this program. This information is based on actual historical work performed on SLDCADA. It does not establish a required staffing approach.

Offerors shall propose a team composition based on their own expertise and independent judgment regarding the resources necessary to perform the effort.

Sample Team Breakout

Total FTEs 24.00

FTEs

Sustainment CLIN 24.00

Task Order Program Manager 1.00

Program Mgmt Analyst - Sr 1.00

Program Mgmt Analyst - Mid 0.00

Project Scheduler 1.00

Configuration Manager - Sr 1.00

Configuration Manager - Mid 1.00

Configuration Manager - Jr 0.00

Software Engineer - Lead – 1.00

Software Engineer - Sr 1.00

Software Engineer - Mid 2.00

Auditor - Sr 1.00

Auditor - Mid 1.00

Database Management Analyst - Sr 1.00

Database Management Analyst - Mid 1.00

IT Specialist - Sr 3.00

IT Specialist - Mid 2.00

Systems Analyst (HD Technician) - Sr 2.00

Systems Analyst (HD Technician) - Jr 1.00

Systems Analyst (Customer Support) - Mid 1.00

Systems Engineer - General (Testing Team) - Sr 1.00

Sample Tasks

The Sample Tasks are representative of the types of tasks that may be performed under this effort; however, they are not intended to be all-inclusive. Rather, they are provided as illustrative examples derived from historical task performance.

Page:

5/66

Work Stream Federal

Role

Contractor

Roles

Broad

Area

Focus Area and Sample Tasks

1. Program

Management

& Leadership

Product manager, Product

Owner

TBD. As proposed by contractor

Technical • Strategic

Alignment: Coordinating priorities between contractor and

PMW 220 senior leadership.

• Resource & Schedule

Planning: Managing the Integrated

Master Schedule (IMS), Action

Trackers, and tracking Software

Change Requests (SCR) cost/effort estimates.

• Workforce Agility: Driving team cross-training, cultivating an agile culture, and maintaining core coverage hours (0700-2000 EST).

• Reporting: Delivering weekly

RIO/QUAD status updates and risk assessments.

2. Audit, Governance, & Compliance

Product manager, Product

Owner

TBD. As proposed by contractor

Technical • Audit Readiness &

Defense: Supporting external financial statement audits (EY

Office Hours, PBCs, CAPs, and

NFR remediations).

• Access Reviews: Executing the

Privileged User Access Review

(UAR) and securing signed

Closeout Reports.

• Process Controls: Updating the

DON Control Standards impact analysis and reviewing database audit reports.

3.

Configuration

& Document

Control

Product manager, Product

Owner

TBD. As proposed by contractor

Technical • Document Lifecycle: Managing, editing, and obtaining signatures for over 100+ program documents

(SOPs, plans, guides).

• Change Boards: Convening monthly Change Review Boards

(CRB) and Internal Review

Boards (IRB) to process RFCs and

SCRs.

• Financial Memos: Managing the

Page:

6/66 lifecycle of FSST, FSSR, and

FSSI memos.

4. Systems

Engineering &

Release

Management

Product manager, Product

Owner

TBD. As proposed by contractor

Technical • Release Lifecycle: Packaging, testing, conducting readiness reviews, deploying major/patch releases, and running SQL Direct

Data Changes.

• Modernization

Initiatives: Migrating to Orion

GitLab, upgrading WebLogic 14c

/ JDK 17, and refactoring DCPS data mappings.

• Quality Assurance: Developing test plans, validating SCRs, and executing post-deployment testing.

5. IT

Infrastructure

& Cyber

Security

Product manager, Product

Owner

TBD. As proposed by contractor

Technical • System Administration: OS patching, system monitoring, and running daily/weekly admin routines.

• Vulnerability &

Compliance: Conducting ACAS reviews, SCAP generation, and executing RHEL 8 STIG assessments.

• Upgrades: Progressing Red Hat

8 upgrades, BMC Control-M updates, and preparing for Win

Server 2022 migrations.

• Security Enablers: Renewing

PKI certificates and managing database backlogs.

• RMF REV 5, TASK ORDS

Page:

7/66

6. Customer

Operations &

Identity

Support

Product manager, Product

Owner

TBD. As proposed by contractor

Technical • Direct User

Support: Troubleshooting NIS

ICAM/identity database configurations and resolving high-volume Track-IT support tickets.

• Migration Execution: Leading large-scale user transitions (e.g., the 8K-11K user CNIC HQ Shore

2C Migration).

• Operations & Batching: Running batch cycles, verifying DCPS counts, and managing outages.

• Outreach &

Training: Conducting Refresher

SA training, supporting system administrators, and sending critical notifications.

4 SCOPE

The scope of services for SLDCADA sustainment support requirements covered in this PWS includes both Sustainment Support Activities Program of Record (POR) requirements, and the potential additional services requirements.

4.1 SUSTAINMENT SUPPORT ACTIVITIES PROGRAM OF RECORD (POR)

The Government requires Information Technology Support Services for system sustainment efforts including program management, software engineering, system management, configuration management, customer support, and future project support for the Standard Labor

Data Collection and Distribution Application (SLDCADA) program, a part of the PMW220

Navy Enterprise Business Solutions (EBS) portfolio.

The scope of the Sustainment Support Activities requirements is services categorized in the list of task areas identified below and are further subdivided into the following sub-task areas:

• Program Management

• Release Management

• IT Infrastructure Management and Support

• Data and Interface Management Support

• Customer Support

Page:

8/66

• Additional Services

4.2 ADDITIONAL SERVICES

The scope of the additional services is to provide additional task specific services, as required, including the task areas identified below:

• Cloud/Alternate Data Center Hosting Services Migration

• New SLDCADA User Command/Communities Implementations

• Risk Management Framework Authority to Operate (ATO)

Page:

9/66

5 APPLICABLE REGULATIONS & DIRECTIVES

During performance of the contracted work, the contractor shall adhere to the following documentation and any revisions/updates thereof, approved for implementation. Notification of revisions/updates in the documents shall be provided to the contractor by the Contracting Officer

(PCO). The contractor shall follow PCO instructions on the implementation of any changes.

Table 4-1: Applicable Regulations and Directives – General Documents

General Applicable Documents

1. DoW Cloud Computing Security Requirements Guide v1 r3, 6 March 2017

2. DoWI 5015.02, DoW Records Management Program, June 26, 2026, CH 1, 8/17/2017

3. DoW Cybersecurity Activities Performed for Cloud Service Offerings, 11/15/2017

4. DoW Manual 5200.01, DoW Information Security Program: Controlled Unclassified

Information (CUI), Volumes 1-2, Changes dtd. 7/28/2020

5. DoW CIO Memo July 3, 2007, Encryption of Sensitive Unclassified Data at Rest on Mobile

Computing Devices and Removable Storage Media

6. DoW Architecture Framework (DoWAF), Version 2.02; 3 March 2011

7. DoWI 5000.64, Accountability and Management of DoW Equipment and Other Accountable Property, April 27, 2017; CH 3 June 10, 2019

8. MIL-STD-881D, Department of Defense Standard: Work Breakdown Structures (WBS) For Defense

Materiel Items, 9 APRIL 2018

9. NIST SP 800-61, Computer Security Incident Handling Guide, Revision 3, April 3,2025

10. IEEE 1220-2005, Standard for Application and Management of the Systems Engineering Process

11. Privacy Act of 1974, Public Law 93-579, (5 U.S.C. 552a)

12. Department of Defense Risk, Issue, and Opportunity Management Guide for Defense Acquisition

Programs, JAN 2017

13. DoW 5015.02-STD, Electronic Records Management Software Applications Design Criteria Standard, April 25, 2007

14. NARA Bulletin 2010-05, Guidance on Managing Records in Cloud Computing Environments, September 08, 2010

15.

M-11-11, OMB Memorandum 1111, Continued Implementation of Homeland Security Presidential

(HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 2011

16. 649-1A, “Configuration Management Requirements for Defense Contracts”

17. EIA 649C, 2019-02-07 “Configuration Management Requirements for Defense Contracts”

18. DoWI 8320.02, Sharing Data, Information, and Information Technology Services in the Department of

Defense, 05 August 2013

19. DoWI 8320.07, Implementing the Sharing of Data, Information, and Information Technology Services in the Department of Defense, CH 1, 12/5/2017

20. M-13-13, Office of Management and Budget Memorandum of 9 May 2013, Subject: Open Data

Policy-Managing Information as an Asset

21. United States Government Accountability Office Federal Information System Controls Audit Manual

(FISCAM), GAO-26-108633, Jun 29, 2026

22. DoW Cloud Cyberspace Protection Guide, 16 Oct 17

23. 36 CFR Part 1194 - INFORMATION AND COMMUNICATION TECHNOLOGY STANDARDS

AND GUIDELINES; Appendix D to Part 1194 - Electronic and Information Technology Accessibility

Standards as Originally Published on December 21, 2000

24. United States Navy RISK MANAGEMENT FRAMEWORK PROCESS GUIDE Version 2.0 04

August 2017

Page:

10/66

25.

Department of the Navy (DON) Office of the Chief Information Officer (CIO) & Office of the

Financial Management & Comptroller (FM&C) Financial Management (FM) Overlay Template

Version 1.2 May 20, 2016

26. DoWI 5000.75 Business Systems Requirements and Acquisition, Change 2 January 24, 2020

Table 4-2: Applicable Regulations and Directives – DON Documents

Department of the Navy Applicable Documents

1. Department of the Navy Cloud Policy ASN RD&A and DON CIO Memo - Publish Date: 12/07/20

2.

DON Chief Information Officer (CIO) Message Date Time Group (DTG) 122213Z MAY 08, Public Key

Infrastructure (PKI) Software Certificate Minimization Effort for DON Unclassified

Environments

3. Systems Engineering Technical Review Organizational Standard Process Handbook: Version 2.0, December 15, 2015

4. Navy Cyber Forces Network Operations Command and Control Implementation Plan, version 1.4, July 2011

5. OPNAVINST 3030.5C, Navy Continuity of Operations (COOP) Program and Policy, 22 April 2019

6. SECNAVINST 3030.4E, Department of the Navy Continuity of Operation (COOP) Program, May 1,

7. SECNAVINST 3052.2, Cyberspace Policy and Administration within the DON, March 6, 2009

8. DOW Risk Issue Opportunity Management Guide for Defense Acquisition Programs, January 2017

9. Information Assurance Technical Authority (IA TA) Cyber Situational Awareness STD CSA -014

10. Information Assurance Technical Authority (IA TA) CYBERSAFE Security Standards STD CSC v1.0

11. Information Assurance Technical Authority (IA TA) Security Information and Event Management

STD SIEM-006R0

12. Information Assurance Technical Authority (IA TA) Information Security and Continuous Monitoring

STD ISCM-005R0

13. Information Assurance Technical Authority (IA TA) Boundary Protection STD BP-009R0

14. Information Assurance Technical Authority (IA TA) Trusted System Network STD TSN-015

15. Information Assurance Technical Authority (IA TA) Account Management STD-AM-016 v1.0

16. Information Assurance Technical Authority (IA TA) Host Level Protection STDHLP-001 R1

17. Information Assurance Technical Authority (IA TA) Firewall Standard STD FW-002 R0

18. Information Assurance Technical Authority (IA TA) Defense-in-Depth Functional Implementation

Architecture STD DFIA-004 v1.0

19. USD(C) Memo Standard Financial Information Structure (SFIS) Implementation Policy, August 4, 20 M-21-02 Fiscal Year 2020-2021 Guidance on Federal Information Security and Privacy

Management Requirements

21. DON Federal Information Security Modernization Act (FISMA) Guidance, 9 June 2015

22. SECNAVINST 5000.36A, Department of the Navy Information Technology Applications and Data

Management, 19 December 2005

23. SECNAVINST 5510.30C, Department of the Navy Personnel Security Program, 24 JAN 2020

24. United States Navy RISK MANAGEMENT FRAMEWORK PROCESS GUIDE Version 2.0 04

August 2017

25.

Department of the Navy (DON) Office of the Chief Information Officer (CIO) & Office of the

Financial Management & Comptroller (FM&C) Financial Management (FM) Overlay Template

Version 1.2 May 20, 2016

24. DON DCIO Navy Cloud First Policy, 1 Feb 2017

25. DON CNO Letter, Information Assurance Technical Authority Standards, 3 Aug 2017

26. ASN RD&A Memorandum, Cybersecurity Compliance of Information Assurance and Technical

Page:

11/66

Authority Standards, 8 Nov 2016

27. OPNAV 5239.1D U.S. NAVY CYBER SECURITY PROGRAM 18 JUL 2018

28. SECNAV 5239.3C DON CYBERSECURITY POLICY 5/2/2016

29. NTTP-3-54M/MCWP3-40.9, Operations Security, Mar 2009

30. SECNAV 3070.2A Operations Security, 9 May 2019

31. PMW220INST PMW220 SYSTEMS ENGINEERING POLICY 5230.3 12/15/2020

32. ENTERPRISE ARCHITECTURE INTEGRATION, COMPLIANCE AND STANDARDS POLICY

PMW220INST 5238.1A 12/15/2020

33. PMW220INST 5234P2B "Configuration Management", 21 Dec 2020

34. SECNAVINST 5239.22, "Department of the Navy Cybersecurity Program", November 15, 2016

35. OPNAVINST 3432.1A, Navy Operations Security Program Management; 4 Aug 2011

36. Department of the Navy Architecture Development Guide (DON ADG), Version 2.0; 29 July 2011

37. DON Enterprise IT Control Standards https://portal.secnav.navy.mil/orgs/FMC/FMS/FMS-1/FMS 1.3/FMStandards/Forms/AllItems.aspx

38. SECNAVINST 5239.20A, Department of the Navy Cyberspace Information Technology and

Cybersecurity Workforce Management and Qualification; 10 February 2016

39. SECNAV M-5239.2 Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual; June 2016

40. MEMORANDUM: Privileged Access Agreement (PAA) and Enhanced User (EU) Guidelines for

NAVWAR

Table 4-3: Applicable Regulations and Directives – DOW, Federal, and International Standards

Department of Defense, Federal Agency and International Standards

Applicable Documents

1. DoW Cloud Computing Security Requirements Guide v1 r3, 6 March 2017

2. DOW CIO Cloud Computing Strategy, July 2012

3. DoW 5200.2-R, Personnel Security Program, March 21, 2014

4. Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, Defense Information System

Network (DISN)Responsibilities, January 24, 2012

5. CJCSI 6510.01F, Information Assurance and Support to Computer Network Defense (CND), February 9, 2011

6. Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs)

7. DoW 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), February 28, 2006 CH 2, 05/18/2016

8. DoWI 8500.01, Cybersecurity Mar 14, 2014, CH 1, effective 7 OCT 2019

9. DoW Instruction 8510.01: Risk Management Framework (RMF) for DoW Information Technology

(IT) [Incorporating Change 1, Effective May 24, 2016, CH 3, effective 29 DEC 2020

10. DoWI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, May 18, 2023

11. DoWI 8520.03, Identity Authentication for Information Systems, May 13, 2011, CH 1, effective May

19, 2024

12. DoWI 8523.01, Communications Security (COMSEC), 26 JAN 2021

13. DoWI 8551.1, Ports, Protocols, and Services (PPSM), May 28, 2014, CH 1, effective, 27 JUL 2017

14. DSCA Policy Memorandum 21-07 of SFIS 11.1 Matrix; May 25, 2021

15. DoW CIO Memorandum, Adoption of the National Information Exchange Model within the

Department of Defense, 28 March 2013

16. NIST SP 800-171, Rev 2, Protecting CUI in Nonfederal Systems and Organizations SEP 22, 2026

Page:

12/66

Page:

13/66

6 REQUIREMENTS

6.1 SUSTAINMENT SUPPORT ACTIVITIES POR REQUIREMENTS

The objective of this task is to provide integrated system sustainment and infrastructure support services for the entire SLDCADA program.

6.1.1 Program Management:

The contractor shall:

a. Perform the necessary Program Management and oversight of the full scope of the Task

Order including support of the SLDCADA solution utilizing best practices leveraged from Program Management Body of Knowledge (PMBOK), Capability Maturity Model

Integration (CMMI), and the Information Technology Infrastructure Library (ITIL)

Service Management Framework. Best practices include, but are not limited to:

(1) Project Integration

(2) Project Scope Management

(3) Project Time Management

(4) Decision Analysis and Resolution

(5) Incident Management

(6) Records Management

(7) Project Monitoring and Controlling

(8) Stakeholder Management

(9) Quality Management

(10) Communication Management

(11) Casual Analysis and Resolution

(12) Risk Management

(13) Process Improvement

(14) FISCAM Compliance Management

b. Establish and maintain a management program during contract performance, incorporating details of all PWS Section 5 paragraphs and sub-paragraphs. The

SLDCADA Program Management Plan (CDRL A004) must reflect an understanding of all tasks and performance objectives specified in this PWS and describe an approach to satisfy these requirements. The plan shall identify all contractor resources; i.e., equipment, material, supplies, and staffing plan on how these resources will enable the contractor to meet performance objectives. The plan must also include the contractors

Page:

14/66 specific approach to each of the 14 items specified in bullet 1 under section 5.1.1. of the

PWS. The Program Management Plan is due to the Government no later than 45 calendar days after task order award.

c. Conduct Monthly In- Process-Reviews (IPR) with the Government, based on progress toward the Program Management Plan and discuss and demonstrate progress documented in the SLDCADA Monthly Status Report (CDRL A001) and the Monthly Financial and

Contract Report (CDRL A002).

d. Provide meeting minutes of each monthly IPR and any other meetings conducted between the contractor and the government. Minutes are due to the Government no later than 3 business days after the meeting has concluded. (CDRL A00S).

e. Submit an integrated Master Schedule, defining the timeline in which required deliverables and all sustainment efforts will be completed, which will include all compliance weakness remediation activities. This is due within 30 calendar days of the award of task order or within 15 calendar days of the beginning of an exercised option period or emergent project initiation. The format of the schedule will be Microsoft Project and must include resources, dependencies, and other content for each task, as specified within the PMW220 Integrated Program

Management Guidelines. (CDRL A00E)

f. Update the IMS weekly and proactively provide status to the Government on any late tasks, risks, issues, or delays or changes in Production Releases via the weekly SLDCADA Status Meeting.

6.1.1.1 Budget and Financial Management

The Contractor shall:

a. Establish a SLDCADA contractor database and enter time in SLDCADA, allocated to a task WBS structure approved by the government. Access will be granted to appropriate Government personnel for cost tracking.

b. Provide on a monthly basis a physical copy of the monthly invoice submitted via Wide Area Workflow (WAWF)/Invoicing, Receipt, Acceptance, and

Property Transfer (iRAPT) to the Government Contracting Officer’s

Representative (COR). (CDRL A003)

c. Assist the Government in assessing budget and cost impacts on program support issues, and provide cost reduction recommendations, to the Program

Management Office (PMO) in support of the program. Recommendations shall be based upon and supported by thorough data analysis.

d. Provide recommendations and initiatives for improvements to reduce overall costs using data driven decision making practices and deliver via Business Case

Analysis and/or cost benefit analysis.

e. Submit a Task Order Level Monthly Expenditure Report to the COR starting no

Page:

15/66 later than forty-five(45) calendar days after issuance of task order and by 15th

(fifteenth) of each month thereafter for the previous month for CLINS (CDRL

A002).

6.1.1.2 Reporting and Metrics

a. Provide analysis, maintenance, and improvements in performance measurements and metrics.

b. Measure and track system data to enable timely input to Tableau-enabled data visualizations for various dashboards. Visualizations include but are not limited to cost, schedule, performance, customer satisfaction, software release quality, and other data.

Over time, dashboards and visualizations will be refined. Refinements include but are not limited to new visualizations, more details on existing visualizations, changes to update frequency and entirely new dashboards. Contractor will not be responsible for maintaining Tableau.

c. Produce inputs to feed dashboards or similar performance-related displays, such as the

Tableau-enabled CPE WEBS Executive Dashboard. The required inputs will involve a select set of metrics listed in this PWS; currently four are proposed awaiting approval:

System Availability, System Reliability, Work Order Completion Survey, and WO %

Closed within Priority Timeline. Additional metrics may be added, at any time, to satisfy new tracking requirements. The contractor may also recommend additional metrics for tracking; provided the rationale for doing so are clearly articulated and address cost/benefit considerations.

d. Update the dashboard monthly, no later than four business days before the third Monday, when dashboards are reviewed by leadership. Departures from or additions to the normal update cycle may be driven by events such as Program Management Reviews, support for other senior level meetings or events, and holidays. Such departures/additions will usually be planned but may be ad hoc.

e. Submit a monthly status report to the COR starting no later than forty-five (45) calendar days after issuance of task order and by the 15th (fifteenth) of each month thereafter for the previous month. (CDRL A001) The report shall contain the following elements:

(1) Monthly highlights and milestones achieved.

(2) Accomplishments by POR Sustainment PWS Area (Program Management, Release

Management, IT Infrastructure Management and Support, Customer Support, Data and Interface Management Support), schedule status, problems/risks/issues identified and mitigation/resolution actions with status, and planned key efforts planned for the next three months.

(3) Status of deliverables.

(4) Metrics Reporting to include:

(a) System Availability – As referenced in section 5.1.3.1

Page:

16/66

(b) System Maintainability – As referenced in section 5.1.3.1

(c) System Reliability - As referenced in section 5.1.3.1

(d) System Operability – As referenced in section 5.1.3.1

(e) Trend Analysis - As referenced in section 5.1.3.1

(f) Peak system usage day/times - As referenced in section 5.1.3.1

(g) Time and Attendance completion monitoring – As referenced in section 5.1.5.3

(h) User Training conducted and Survey results - As referenced in section 5.1.5

(i) Help Desk Ticket Metrics - As referenced in section 5.1.5.1

(j) Annual Customer Satisfaction Survey Results - As referenced in section 5.1.5.3

(k) Release Quality Metrics

(1) Beta Test/User Acceptance Survey – As referenced in section 5.1.2.4

(2) Total number of defects identified post release, as well as their defined priority - As referenced in section 5.1.2.4

f. FISCAM Compliance integrated dashboard results (used to track and report status of various IT General Controls activities), as referenced in section 5.1.1.8. This report will include the FMO-5 Integrated Risk Management control dashboard reflecting the aptitude of this contract to meet FISCAM compliance.

g. Security Report detailing all security events, which occurred during the previous month –

(section 5.1.1.5).

h. Cyber Security (CS) Report addressing outstanding CS requirements with plan to accomplish resolution prior to Navy mandated deadlines. Shall include status of existing plans in execution, penetration, backup, and Continuity of Operations Plan (COOP) status information (section 5.1.3.2).

i. Cybersecurity Workforce (CSWF) Report (CDRL A00T)

The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel.

DoW 8570.01-M and DFAR’s PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report (CDRL

A00T) monthly. IAW clause DFARS 252.239-7001, if cybersecurity support is provided, the contractor shall provide a CSWF list that identifies those individuals who are IA trained and certified. Utilizing the format provided in CSWF CDRL Attachment 1, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. See applicable DD Form 1423 for additional reporting details

Page:

17/66 and distribution instructions. Contractor shall verify with the COR the proper labor category cybersecurity designation and certification requirements.

j. Provide a report of all the FISCAM, Navy IT General Control SOPs, and NIST controls executed or tested by the SLDCADA team, the results, and the corrective action plans to remediate any failures.

k. Current or anticipated problems/deficiencies and recommended solutions.

6.1.1.3 Contract Management

The Contractor shall:

a. Provide proactive support in the areas of strategic planning and analysis required to accomplish program milestones and goals to support management in the decision-making process.

b. Deliver all CDRL submittals in the requested Government format and per delivery schedule via the NAVWAR AMS tool (https://ams.navair.navy.mil).

c. Assist the Government in providing the necessary documentation, management reporting, and cost estimates to the PCO and APM in support of Contract Performance.

d. Provide all manpower required in support of the task order with a favorable Tier 5 (T5) background investigation or T5 reinvestigation (T5R – every 5 years) on contractor personnel for privileged access IT in accordance with SECNAV M-5239.2 (07 July 2026 or latest revision) and NAVWAR Command Information Security Officer (CISO) Memo of 13 July 2020. If a revision or update is perceived to create price, schedule, or technical changes to the task order, the contractor shall notify the PCO of the impacts of the change in accordance with the Changes clause of the Task Order. The contractor shall follow

PCO instructions on the implementation of any changes.

e. Authorized User: As defined in SECNAVINST 5239.20A is, “Any appropriately cleared individual with a requirement to access a DoW Information Systems (IS) for performing or assisting in a lawful and authorized governmental function.”

f. Enhanced User: As defined in SECNAV M-5239.2, dated July 2026, is, “An Authorized

User (military, civilian or contractor) who requires detailed knowledge of Cyber IT and/or cybersecurity to support work in the development, maintenance, or operation of

DoN systems, including weapons, tactical, electronic and electrical services, navigation, and engineering. Enhanced Users possess advanced Cyber IT/CS knowledge and abilities centered on particular professional areas.”

g. Privileged Access: As defined in SECNAVINST 5239.20A is, “Access to system control, monitoring, administration, criminal investigation, or compliance functions…each person with Privileged Access will be required to acknowledge special responsibilities with a

Privileged Access Agreement (PAA).”

h. Privileged User: Ad defined in SECNAVINST 5239.20A is, “A user that is authorized, and therefore trusted, to perform security-relevant functions that ordinary users are not

Page:

18/66 authorized to perform.” Authorized Users requires general computer skills and baseline understanding of cybersecurity to conduct work that is not IT or cybersecurity focused.

Each User of DON IS must maintain the appropriate security clearance; have a current user access agreement (e.g., System Authorization Access Request (SAAR)) and, if applicable, a Privileged Access Agreement (PAA); and complete approved cybersecurity awareness training prior to accessing DON networks. Users who have the requirement of

“Tier 5” security investigation are eligible to access highly sensitive information classified up to Top Secret/Sensitive Compartmented Information (TS/SCI), and have elevated privileges on IT systems. They have elevated privileges on IT systems, allowing them to perform administrative tasks that standard users cannot. Users are considered a highly trusted individual with significant access to critical systems due to their extensive background investigation and clearance level.

i. Provide all manpower required in support of this task order, including the appropriate onboarding/offboarding procedures, badging, and system user access procedures, and security clearance management IAW NAVWAR Memorandum dated 13 July 2020, SECANAVINST 5510.30C, SECNAV-M 5239.2, and SECNAVINST 5239.25.

Privileged Access Users require a T5 background investigation.

j. All authorized users of DON Information Systems (IS) must complete proper training and all cyber personnel must be qualified to perform the tasks associated with their assigned positions and cyber work role, to include all other requirements IAW SECNAVINST

5239.25, dated 10 October 2023.

k. Ensure maximum uniformity and effectiveness in the application of Personnel Security

Program (PSP) policies, IAW SECNAVINST 5510.30C, dated 24 January 2020, within the DON while meeting the DON’s objective of authorized initial and continued access to classified information and/or initial and continued assignment to sensitive duties to those persons whose loyalty, reliability, and trustworthiness are such that entrusting users with classified information or assigning user to sensitive duties are clearly consistent with the interests of national security. Additionally, the PSP ensures that no final unfavorable user/personnel security determination will be made without compliance with all procedural requirements.

l. Provide initial and refresh security training for all contractor personnel and report all training completions to the COR.

m. Maintain an employee roster database to be used for manpower statistics and emergency contacts.

6.1.1.4 Communications and Records Management

The Contractor shall:

a. Lead a weekly status meeting with the SLDCADA Government leadership team and relevant contractor personnel to discuss highlights, activities, schedule status, Page:

19/66 problems/issues, upcoming activities/events, and non-compliant/non-consistent CM items

(section 5.1.1.7).

b. Develop a remote work plan to include collaboration tools used and stakeholder communication plans. This plan must ensure continuity of operations for the SLDCADA program and be incorporated into the overall Program Management Plan (A004).

c. Assist the Government in preparing, and/or provide to the Government as required, communications required in support of the SLDCADA program including articles, white papers, presentations, status updates, program management briefs, and budget cycle updates.

d. Assist the PMO with scheduling, planning, and attending briefings, conferences, workshops, training, meetings, seminars, and teleconferences as required by the

Government. The contractor shall assist the Government with the preparation of all tasks associated with the event, including but not limited to scheduling, reserving facilities and equipment, customer notification, coordination of attendees (including subject matter expertise), documentation, presentations, meeting minutes/lessons learned/action items, and customer satisfaction surveys.

e. Assist the Government in responding to internal and external requests for information/status regarding the SLDCADA program, including but not limited to: Navy, DoW, and other government agency requests, as appropriate. The contractor shall provide accurate and comprehensive information and any required documentation requested by the Government for these responses.

f. Respond to requests for information from the Integrated Risk Management (IRM), per the predefined assessment schedule. The IRM was established by Public Law 97-255, the

Federal Managers' Financial Integrity Act of 1982 (FMFIA) and was enacted to ensure efficient and effective management of government resources to protect against fraud, waste, and abuse. The DON utilizes this program to ensure adherence to DOW and Navy regulations.

g. Capture minutes of all meetings and maintain an integrated action items list, with action, responsible party, expected completion date, and status. The action item list must be updated at least weekly and stored in a shared location.

h. Maintain artifacts of processes, as specified in Standard Operating Procedures. Artifacts must be provided at the request of the government, the IRM team, external auditors, or other key stakeholders.

i. Store all program records, artifacts, minutes, etc. in a government approved central repository. The current repository is a Microsoft SharePoint Library within the PMW

220 ECMS SharePoint Site.

j. Retain all SLDCADA Program records in accordance with the National Archive Records

Administration retention and disposal schedules.

Page:

20/66

6.1.1.5 Asset and Facilities Management

a. Maintain an inventory of all applicable equipment, software, and hardware in a centralized repository to include Government Furnished Property (GFP) that may be provided in the future. Currently GFP is not provided. BMC Track-it! is provided by the

Government for hardware inventory but migration to the Navy ERP inventory system is expected during the course of this contract. Software inventory is maintained in both

Track It and DITPRDON/DADMS. The contractor shall comply with GFP provisions as set forth in FAR Part 45.

b. Provide when requested, and update at least yearly, an inventory report that lists all

Government-owned assets, to include NMCI equipment and peripherals such as monitors and external hard drives (CDRL A00N). This report may be utilized by a Government authorized representative to conduct a physical inventory audit.

c. Provide as part of the Monthly Status Report a security report detailing all security events related to the facility or equipment which occurred during the reporting period (CDRL

A001).

d. Maintain an inventory of keys issued to contractor employees (digital as well as physical) and review the inventory in accordance with applicable regulations.

e. Dispose of inventory, as directed by the government, in accordance with Defense

Logistics Agency regulations.

6.1.1.6 Risk Management

The Contractor shall:

a. Document a Risk Management Plan (CDRL A007) incorporating best practices from

PMBOK and defining the processes, roles & responsibilities, reporting, and metrics they will follow for performing risk management on all tasks performed under this contract.

b. Assist with qualitative and quantitative assessments of risk and management activities through the PMW220 Risk Management Process and in accordance with the DoW Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs of January

2017, Office of the Deputy Assistant Secretary of Defense for Systems Engineering.

c. Provide as part of the Monthly Status Report a current status of any active risks that require the attention of the Government, advising any impacts to the SLDCADA program, likelihood of occurrence, and actions being taken to mitigate the risk.

d. Hold a monthly Risk Review meeting with applicable Government stakeholders, to review the current SLDCADA Risk Register, per the Risk Management Plan.

e. Perform ongoing risk assessments and report updates at regular intervals, including program milestones and configuration audits.

f. Maintain a comprehensive risk register using a risk management tool

Page:

21/66

g. Coordinate with the Government to report accepted risks, which will be entered into the shared CPE WEBS risk management system.

6.1.1.7 Configuration Management (CM)

a. Perform CM in support of SLDCADA Sustainment. CM must be identified, documented, and enforced on all equipment, software, application layers (application, Operating

System, Databases, and Tools) processes, system functionality, documentation, and data across all environments (Development, Testing, and Production) in accordance with standard Government regulations and specifications (see Section 4.0) and CMMI best practices utilizing industry standard automation tools.

b. Submit a CM Plan (CDRL A009), within 60 calendar days of the award of the task order detailing all facets of system and program configuration management. This plan along with all documented procedures should detail roles and responsibilities, tools utilized, and metrics to be measured in support of CM. The CM Plan must be maintained and followed throughout the period of performance and should adhere to the semi-annual

SLDCADA Release Schedule (see Section 5.1.2).

c. Document and save all configuration items in an DoW approved industry standard, automated CM tool repository. This repository shall be used for configuration, transport and release control; to ensure access to updated procedures for internal use; to provide oversight in the accuracy following releases; to provide ad-hoc reports as needed; to support user and management needs and to support FISCAM Configuration Management compliance. Serena PVCS is currently provided by the Government as the CM repository.

d. Develop guidelines, procedures, and schedules for conducting periodic and event driven

CM Audits including both software (all layers) and hardware . Contractor will conduct

CM Audits and follow-up on discrepancy resolution and maintain audit documentation and records of corrective actions taken using tools, such as Integrated Master Schedule

(IMS).

e. Adhere to all SLDCADA and PMW220 Configuration Management Policies and

Standard Operating Procedures and recommend updates where needed to maintain compliance with regulatory changes.

f. Provide metrics on non-compliant and non-consistent configuration items on a weekly basis.

g. Ensure requirements traceability to all configuration changes.

6.1.1.8 Navy Audit Support

Page:

22/66

a. Ensure all contracting staff is educated on the SLDCADA FISCAM controls as it relates to their respective duties

b. Take action to maintain or implement all related FISCAM applicable controls.

c. Proactively monitor Navy IT FISCAM Control Standards, and NIST IT Control

Standards, and update Standard Operating Procedures for Government approval to remain in compliance with regulations.

d. Respond to all Full Financial Statement Audit internal and external data calls in a timely manner and submit timely resolutions to audit findings as agreed by the Government.

These audit support efforts will be required at least annually and executed throughout fiscal year.

e. Prepare, coordinate, and lead the SLDCADA program walk-through with internal and external. Auditors in accordance with the agenda presented by the auditors. Prepare, coordinate, and lead dress rehearsals along with supporting artifacts with the Government

Program Lead required in preparation for the walk-through with the FMO, CIO and

PMW220 Audit supporting Teams.

f. Develop and present the slide decks to walk the internal and external Audit Teams through the SLDCADA processes, procedures, and controls.

g. Provide the requested information from the SLDCADA system or system support documentation and data query results to satisfy the Navy Auditor's Provided by Client

(PBC) data calls during the conduct of the annual audit cycle within the requested response timeframe as set by the Navy Auditor and the Government (2 to 5 business days).

h. Update and/or generate SLDCADA System Support documentation annually at a minimum to satisfy any Navy Audit Finding in support of resolution of the finding per the agreed to timeframe with the Government.

i. Incorporate best practices from Information Systems Audit and Control Association

(ISACA) for all other SLDCADA system activities, including customer migrations and system integrations to ensure completeness, accuracy and timely execution of actions.

6.1.1.9 Quality Assurance and Control

The contractor shall:

a. Ensure the necessary quality assurance planning and execution required to support successful and effective delivery of SLDCADA support services under this task order.

Quality Assurance should incorporate best practices leveraged from ISO 9001 and ISO

20000 frameworks and include a Quality Management System from the contractor that addresses processes for measuring and performing all tasks and support services to

Acceptable Quality Levels (AQLs) for the Government.

Page:

23/66

b. Establish a Quality Assurance Plan to include a Quality Management System Manual that reflects its Quality Control Program including processes & procedures, roles & responsibilities, and reporting & metrics that will be followed. The Quality Assurance

Plan, including the Quality Management System Manual, shall be provided to the

Government within twenty (20) calendar days after task order award (CDRL A008).

c. Ensure all personnel including subcontractor personnel are fully versed in and adhere to the Quality Management System.

d. Be solely responsible for the quality of services provided.

e. Utilize a Quality Control Program to ensure that services are completed in accordance with acceptable principles of internal control, and meet specified, acceptable levels of quality. The operation of the Quality Control Program must be documented, maintained, and made available to the COR upon request. At a minimum, the Contractor’s Quality

Control Program shall include an internal quality control and inspection system for required services. The job titles and organizational positions of the individuals who will conduct the inspections must be specified. There shall be a method to identify deficiencies in services that may occur and procedures to correct any deficiency in services that may occur. There shall be a file of information regarding inspections and other quality and internal control actions that documents the purpose of the inspection, the results of the inspection, and any corrective action taken as a result of the inspection.

Upon request, this file shall be made available to the Government during the period of performance.

6.1.1.10 Transition Support (If Required)

The objective of this task is to conduct a kickoff upon task order award, receive knowledge transfer requirements and services from the out-processing contractor personnel (Transition

Phase-in), and give knowledge transfer and services to the on-boarding contractor personnel

(Transition Phase-out), as required. The contractor shall:

a. Develop a Transition Phase-in Plan that consists of a timeline for onboarding support personnel and transitioning actions and shall provide sufficient detail to ensure that no break in services is experienced. Onboarding contractor lead shall provide Transition

Phase-in Plan to the Government to coordinate any necessary efforts with the out-processing contractor (CDRL A00K).

b. Within 10 business days of task order award or as coordinated with the Government, conduct a Contract Kick-off Meeting with the Government to review, negotiate, and approve the Transition Phase-in plan to include contractor team organization, activities, timeline, and any required transition support coordination required from the Government with the out-processing contractor. (CDRL A00M)

c. Participate in Transition Phase-in tasks to orderly and efficiently receive knowledge transfer from the out-processing contractor, coordinated by the Government. The

Transition Phase-in shall be considered the first thirty (30) calendar days of the task order performance period.

Page:

24/66

d. Meet with out-processing contractor and the Government to garner data such as completed and work-in-progress tasks and challenges to prepare and present an updated

Transition Phase-in plan (CDRL A00K) to the Government for review and approval at…