Attachment 12 - TO 001 PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

Contracting Officer’s Representative (COR).

a. Primary COR. See Defense Information Technology Contracting Organization (DITCO) Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact Task Order Title. Global Electromagnetic Spectrum Information System (GEMSIS) Sustainment and Enhancement (T001) Background. Refer to base contract PWS.

Objectives:

The objective of this task order (TO) is to support the sustainment, maintenance, operation, enhancement, and training of the baseline software capabilities described above by leveraging the existing operational enterprise capability within the DISA Stratus Non-Secure Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol Router Network (SIPRNet) cloud environment. These capabilities have been assessed to meet Department of Defense (DoD) operational requirements which will need to be sustained and expanded to further meet the operational spectrum needs of the DoD. This requirement shall support the extension of the current software architecture, data storage, and feature sets supporting the integration of additional data sets and analytics. This contracting effort includes tasks for accelerating the development and maintenance of blue system data, improving the data development processes and visualization features, enhancing the databases, and adding additional data sources for the planning and execution of Joint Electromagnetic Spectrum (EMS) operations.

Scope.

This requirement provides for the operations, maintenance, sustainment, enhancement, and training of EMS software capabilities for the DoD and interfacing with National Telecommunications and Information Administration (NTIA).

Under the Spectrum Information System (SIS) base contact, the scope of this work is focused on the following tasks:

· Performance Area 6.1, Task 1 – Task Order Management

· Performance Area 6.2, Task 2 – Transition-In/Transition Out

· Performance Area 6.3, Task 3 - Engineering Support and Outreach

· Performance Area 6.4, Task 4 – Software Maintenance and Enhancement

· Performance Area 6.5, Task 5 – System Administration and Operations Support

· Performance Area 6.6, Task 6 – Cybersecurity

· Performance Area 6.7, Task 7 – Helpdesk Support (Tier-3)

· Performance Area 6.8, Task 8 – Training

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 15% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

Performance Requirements.

The contractor shall adhere to the instructions regarding and compliance guidance outlined in the base contract PWS, Section 6, Performance Requirements, for all tasks specified in this TO.

6.1 Task 1 – Task Order Management. (O&M, RDT&E, FFP)

The contractor shall provide the management, personnel, planning, and coordination support necessary to accomplish all work requirements specified in this TO.

The contractor shall provide a Program Manager to oversee, coordinate, and provide leadership and the controls necessary to manage all task order activities awarded under the SIS base contract. The Program Manager shall manage deliverable targets, maintain staffing at levels required to satisfy customer requirements, team and/or subcontract as needed, budget, risks, and interface directly with Government leaders for all supported areas, and exercise control over assigned task personnel.

Project managers and technical staff are required to formally manage, track, and report project activities with respect to schedule, cost, risk, and key milestones in accordance with established Government business processes and direction from the Government. The contractor’s management effort shall include administration, program controls, product effectiveness, data and configuration management, risk and issue management, subcontract management, staff management, and security management. The contractor shall insure that all staff members comply with mandatory contractor training requirements.

The contractor shall identify and utilize software development-related best practices for all software activities specified at the contract and the task order level. This includes requirements definition and analysis, software design and design documentation, code development, maximum use of automated testing, documentation and inspection, user interface development and inspection, testing (verification and validation (V&V)), configuration management, interface definition and controls, risk management, quality management, scheduling, and all planning. The contractor shall ensure their software development-related processes and procedures used for any tasks specified at the task order level are documented, and the processes include continuous process improvement.

The contractor shall prepare an Software Requirements Specification (SRS) and a Preliminary Design Review (PDR) (deliverables for Task 2) for each major sprint for approval by the GEMSIS Program Manager and the COR specified at the TO level.

The contractor shall supply all subject matter expertise required to accomplish all tasks specified in this TO, including in the areas of: data science, database administration and management, spectrum management, spectrum engineering, electronic warfare, intelligence data, Joint Electromagnetic Spectrum Operations (JEMSO), End-to-End Supportability System (E2ESS) operations, Joint Spectrum Data Repository (JSDR) operations, blue force Spectrum-Dependent System (SDS) equipment and parametric data, Information Assurance (IA) expertise, information technology (IT) expertise, system/software engineering, and web browser applications.

The contractor shall comply with the Government’s Configuration Management Plan and use configuration management and change management systems to ensure product version control is in place. As new capabilities are demonstrated, tested, and fielded, the user community shall be able to make CRs through the Configuration Management process, including the Baseline Control Board (BCB). The user community consists of stakeholders, the Configuration Control Board (CCB), the Project Control Board (PCB), and the Program Management Office (PMO). Stakeholders will contribute suggestions for software and data changes to GEMSIS throughout the life of this requirement. The Configuration Control Board (CCB) and Project Control Board (PCB) evaluate and prioritize requirements, and the GEMSIS Program Management Office (PMO) defines the software release contents based largely on the CCB and PCB input. The contractor shall maintain all CRs, and product version records specified at the contract and task order level.

The contractor shall conduct both functional and physical configuration audits on the development and production environments and provide audit results to the Government specified at the contract and task order level. Configuration management of Technical Data Packages (TDP) shall occur in the approved DoD enterprise collaboration/interoperability and IT project management services, and on delivered Digital Video Disks (DVDs) or via Government approved electronic means. A TDP is not considered delivered until it is provided to the COR and loaded into the DoD repository (e.g. Confluence, Git repository).

6.1.1 Subtask 1: Kick-Off meetings. The contractor shall prepare and conduct kick-off meetings. These events are intended to establish a common understanding of TO requirements, schedule details, and expectations.

6.1.2 Subtask 2 – Task Order Management Reviews (TOMRs). Product TOMRs will be conducted monthly and cover all aspects of quality, resource utilization, and funding/invoicing. The contractor shall track and provide a presentation on all efforts/activities performed at the contract level and across all TO. The review presentation shall address financial status (planned vs. actual), staffing levels, task costs, sprint costs, variances, organizational structure, work breakdown structure, schedule, risk, and quality issues for the TOs. TOMR presentation materials shall be provided to the COR as specified in the TO. The contractor shall make COR requested changes to the TOMR presentation format and content within ten business days, as specified in the TO. All changes to the TOMR presentation material must be finalized and approved by the Government prior to conducting the monthly TOMR. The contractor shall document all issues and risks in the TOMR that could cause problems with the software development lifecycle, sustainment, operational support, or operational availability of the web applications. Issues and risks identification shall include probability, consequence, and mitigation approach information.

Non-Disclosure Agreements (NDA) shall be required by all personnel performing on this TO requirement. The contractor is responsible for identifying that all personnel, to include any new personnel on the contract and task orders, have executed the DISA provided NDAs in accordance with the timeline stated in the task order PWS. The contractor shall track and provide an updated list of NDAs every TOMR. The contractor shall report on the status of staff completion of mandatory training.

6.1.3 Subtask 3 - Interim Progress Reviews (IPRs). The Government will conduct bi-weekly IPRs as specified in the task order. The contractor shall prepare agendas and presentation materials for the IPRs for all efforts within this TO PWS. The IPRs shall summarize ongoing activities, accomplishments, deliverable statuses, and issues. The contractor shall prepare meeting minutes based on the content of the actual meetings, to include a synopsis of discussion and action items and list of participants. These minutes and actions shall be reviewed, and statuses incorporated in the next IPR.

6.1.4 Subtask 4 - Integrated Master Schedule (IMS). The contractor shall develop and maintain an integrated master schedule using Microsoft Project to track and monitor task activities as specified in the task order. The IMS shall include logically networked program activities and dependencies. The schedule shall contain the planned events and milestones, accomplishments, exit criteria, and activities from task order award to the completion of this requirement. The IMS shall clearly link all subsystems and related activities for deployments to support operations and sustainment planning. The contractor shall quantify risk in hours, days, or weeks of delay and provide most likely duration for each IMS activity and event. The contractor shall work with the GEMSIS program office staff to deconflict and coordinate deployment tasks and maintenance releases.

6.1.5 Subtask 5 - Technology Report. The contractor shall provide a technology report identifying all technologies embedded in the system and used by the contractor for the development, testing and operations of the systems. The report shall contain the following for each technology: source, purpose, version utilized, software licenses, end of support information (i.e., Dates, Options and Costs for extended support), and a proposed approach for addressing technology obsolescence with related Non-Developmental Item (NDI) cost information. The contractor shall notify the Government in writing and receive approval before adding any new technology into the software baseline (i.e., any new technology required for development, testing or operations).

6.1.6 Subtask 6 - Technical Exchange Meetings (TEMs). The contractor shall support approximately 12 Government site visits to the contractor facility per year for Government review of management processes, development processes, test activities, configuration control of software and TDP products, and the monitoring and disposition of defect/problem reports for all tasks specified in the TO PWS.

The contractor shall provide demonstrations of software, as requested by the Government, for a variety of audiences. The audience shall include the technical staff as well as senior leadership. The contractor shall support technical interchange meetings, and customer engagements at either the contractor site, Program Executive Office (PEO) Spectrum, DISA Headquarters (HQ), Pentagon, or locations requiring travel. (See Task 3). The contractor shall document meeting minutes, outcomes, and action items. The contractor shall support the Government as required supplying updated information/materials/slides for presentation to external parties and senior leadership.

Deliverables:

Draft due 10 business days before the PCB meeting. The finalized PCB presentation is due the day before the PCB meeting, one business day before the end of each month.

As requested for remaining reports (Not to Exceed four reports per year).

Four business days after task order award.

Revised TOMR must be submitted and finalized two business days before the TOMR meeting for Government approval

Deliverable due Bi-monthly thereafter.

* Standard Distribution: One copy of the transmittal letter with the deliverable to the Primary COR and GEMSIS Configuration Manager. Deliverable and transmittal letter stored in accordance with the GEMSIS Configuration Management Plan.

6.2 Task 2 – Transition-In/Transition-Out of Contract and Continuity of Services. (O&M, RDT&E, FFP) The objective of the transition-in and transition-out task areas is to ensure continuity of services during the transition between the ID/IQ effort and/or specific task orders.

6.2.1 Subtask 1 - Transition-In. The contractor shall execute a smooth and seamless transition-in, ensuring continuity of services as specified below.

The contractor shall support a transition-in period during which transition between the contractor and the predecessor contractor is necessary to assure minimum disruption to vital services and Government activities. During this period, the incumbent contractor will continue to be fully responsible for the continuation of services. The transition-in period is projected to be approximately 30 business days. All key personnel/key positions must be onboard at the start of the period of performance. 50 percent total staffing must be completed within two weeks of the start of the TO Period of Performance (PoP) and 100% within 30 days. The transition-in period encompasses the people, processes, tools, technologies, and sequenced activities required to maintain system operation, sustainment, and development activities.

The contractor shall provide a transition-in plan to the Government 14 business days after TO award, detailing contractor tasks, task dependencies, and milestones during the transition period.

6.2.2 Subtask 2 - Transition-Out (Optional). NOTE: Priced as a SEPARATE CLIN in the LAST Period of Performance only.

Transition-out services are critical to maintain continuity of services during the transition between the base contract and/or specific task orders. Prior to contract expiration and after a follow-on contract is awarded, the contractor shall exercise its best effort and cooperation to conduct an orderly and efficient transition to the succeeding contractor. During the transition period, the incumbent will be fully responsible for the continuation of services as detailed in the contract and task order PWS.

The contractor will collaborate with the mission partners at least 120 days or sooner, prior to the end of the contract, to develop a transition-out plan in accordance with (IAW) FAR 52.237-3. The draft transition out plan is due to the government 90 calendar days prior to contract end date. The contractor shall change and modify the plan, as needed, until it is accepted by the Government. The final version of the transition-out plan shall be delivered no later than 60 calendar days prior to contract end date.

After new contract award, the contractor shall disclose adequate personnel records, including required certifications and clearance levels sufficient to allow the succeeding contractor to conduct interviews for possible employment/transition (only if the contractor is not awarded the successor contract). These records shall be provided to the successor at least 60 calendar days prior to date of contract expiration. If any incumbent employees desire to transition and are selected by the successor, the current contractor shall cooperate by granting release of those employees on a mutually agreed upon date. During the closeout process and no later than 10 business days after final day of performance, the contractor shall turn over all required equipment inventory to the property manager, deliverables, suitability information and security records to the COR. The transition-out plan shall encompass all the processes, procedures, documentation, and tools currently utilized under the contract and task order. The transition-plan shall detail all contractor tasks, task dependencies, and milestones during the transition period. The transition-out plan shall also include the list and location of contract records to include historical information that may assist the successor contractor in a smooth transition, and an inventory of all Government Furnished Property (GFP). The transition shall be handled with minimal disruption to the Government. A failure to do so shall result in will be reflected as non-compliance in the final Contractor Performance Assessment Report Systems report.

Deliverables:

Final transition-in plan must be approved by the Government between the 14th and 22nd business day after award.

Final transition-in plan must be approved by the Government between the 14th and 22nd business day after award.

Final transition-out plan due 60 business days prior to end of contract and task order PoP

Final transition-out plan due 60 business days prior to end of contract and task order PoP

* Standard Distribution: One copy of the transmittal letter with the deliverable to the Primary COR. Deliverable and transmittal letter stored with GEMSIS Configuration Management (CM) according to the GEMSIS Configuration Management Plan.

6.3 Task 3 – Engineering Support and Outreach. (O&M, CPFF)

TS/SCI clearance is required for the contractor to obtain appropriate access to JWICS. The contractor must have access to SIPRNet and JWICS to successfully perform work under this task. This access is required to enable assessment of technical integrations and cross domain solutions for JSDR between NIPRNet, SIPRNET, and JWICS.

6.3.1 Subtask 1 – Sprint Planning

The contractor shall collaborate with the GEMSIS PMO, product leads and external stakeholders to perform requirements analysis and develop sprint plans that meet requirements. This includes collaborative software development and support. Sprint plan execution may include collaboratively developing software and TDP materials with other projects, programs, and contractors.

Sprint Plans. The contractor shall develop sprint plans that implement the requirements. The contractor shall plan and track sprint releases in the IMS.

The contractor’s established sprint plans must be approved by the Government. The contractor shall develop software under this contract using an agile development methodology to comply with the PWS requirements. Sprint planning shall be conducted under task 6.3 Engineering Support and Outreach, and sprint execution shall be conducted under task 6.4 Software Maintenance and Enhancement. The contractor shall prepare an SRS and a PDR for each sprint plan for approval by the GEMSIS Systems Engineer and the COR. The contractor shall provide materials for each sprint and other formal meetings at least one-week before the corresponding meeting. The contractor shall obtain written approval from the COR before adding any software development, software testing or system operations technologies to the technology baseline. Change Requests (CR) to be included in sprints will be determined and prioritized through the PCBs and CCBs. The CCB and PCB evaluate and prioritize requirements, and the GEMSIS PMO defines the release contents based largely on the CCB and PCB inputs.

CRs to be included in sprints will be determined and prioritized through sprint prioritization working groups. The Government user representative will provide prioritized requirements. The GEMSIS PMO defines the release contents based largely on the prioritized requirements and sprint prioritization working group inputs.

6.3.2 Subtask 2 – Data Analysis

The contractor shall evaluate Government designated data sources and work with Government SMEs to develop and document a data integration strategy and capability to automatically ingest data from originating sources, and/or query and display data from federated data sources. The contractor shall evaluate data formats and compatibility with existing data requirements and standards and establish the methodology to integrate. The contractor shall leverage or develop an interface as well as a process to extract the data from identified external data sources, transform it as needed to map to JSDR, and enable access to it from the JSDR environment, maximizing automation. The contractor shall create CRs to integrate these changes to the baseline. The contractor shall implement processes that minimize and simplify efforts in administration and maintenance of the ingest function. The system will provide audit access for data connections and/or downloads. The contractor shall configure the system to log data access, including user identification, date and time of access, and the query being performed. The contractor shall develop Interface Control Documents (ICD) for external interfaces, to be delivered with TDPs.

The contractor shall develop a strategy for evaluating and managing data content within the software to meet DoD Chief Digital and Artificial Intelligence Office (CDAO) data requirements. This strategy will contain recommendations for data review, data retention, and data governance policies. This will include such assessments as leveraging metadata as necessary to maintain traceability of the data (searchable, source, etc.) as well as potential rule sets for determining best sources of data when disparate sources conflict. The contractor shall document this strategy in a Content Management Data Strategy deliverable.

6.3.3 Subtask 3 – Outreach

The contractor shall participate in Technical Exchange Meetings (TEM) with interfacing data provider organizations, service EMS programs, external systems, and stakeholders, as required to support software operations, sustainment, and enhancements. TEMs will be required approximately one per month or as specified in the TO, which may require travel, and occur with other Government programs and organizations including (but not limited to): Electronic Warfare Planning and Management Tool (EWPMT), Spectrum Services Framework (SSF), Fusion Analysis Development Effort (FADE) – Multiple Intelligence Spatial Temporal (MIST) (FADE-MIST), Global Combat Support System – Joint (GCSS-J), Integrated Broadcast Service (IBS), E-SPACE, Real Time Spectrum Operations (RTSO), System Planning Engineering and Evaluation Device (SPEED), Strategic Knowledge Integration Web (SKIWeb), Joint SATCOM (Satellite Communications) Management and Planning System (JSMPS), Joint Integrated SATCOM Tool (JIST), etc. The contractor shall support quarterly Electromagnetic Spectrum Data Community of Interest (ESDCoI) working group meetings on-site at PEO Spectrum locations at DISA Ft. Meade, Maryland and/or PEO-SPECTRUM Annapolis, Maryland. The contractor shall provide demonstrations of software capabilities as requested by the Government. The contractor shall document meeting minutes, outcomes, and action items. The contractor shall support the Government as required supplying updated information/materials/slides for presentation to external parties and senior leadership.

For scoping purposes, SME travel includes the following:

· Dayton, Ohio (once per year)

· San Antonio, Texas (four times per year)

· Aberdeen, Maryland (twice per year)

· Quantico, Virginia (once per year)

· Dahlgren, Virginia (once per year)

· Charlottesville, Virginia (once per year)

· Colorado Springs, Colorado (once per year)

· Stuttgart, Germany (once per year)

· Tampa, Florida (once per year)

· Honolulu, Hawaii (once per year)

· Omaha, Nebraska (once per year)

6.3.4 Subtask 4 – Architectural Products

The contractor shall maintain, develop, and update the following architectural products (and revisions to reflect changes to the system) to depict the software system environment to include:

OV-6c

The contractor shall also answer requests for information from other projects working on spectrum related architecture products, such as the PEO Spectrum project for Electromagnetic Spectrum Enterprise Architecture and PEO Spectrum funded efforts by other contracts to develop supporting architectural products.

6.3.5 Subtask 5 – Technical Assessments/Recommendations

The contractor shall make recommendations with respect to enhancing performance, increasing reliability, and extending infrastructure to meet future user demands and increased data processing requirements. The contractor shall provide engineering support and make recommendations for enabling interface and/or data exchange mechanisms with external applications and baseline software capabilities. The contractor shall develop recommendations and specifications for cross domain solutions, if required. The contractor shall participate in technical working group meetings and Integrated Product Teams (IPT) to gather necessary technical data.

The contractor shall evaluate engineering services that could be integrated into the overall software effort. The contractor shall recommend industry best practices and design patterns for the efforts in this PWS, including recommendations for User Interface/User Experience (UI/UX) standardization, data exchange techniques, and for efficient methods of integrating and/or interoperating with other capabilities, as well as external data sources and systems. The contractor shall also evaluate and test possible alternative hosting or development/test environments (e.g., Amazon Web Services Government Cloud, etc.) and software integration environments (e.g., Joint Live, Virtual, Constructive Environments). This task will include participating in systems engineering and deployment, operations, and sustainment meetings. The contractor will provide recommendations in white papers.

The contractor shall also provide technology reports identifying any new technologies that are proposed to be integrated in the system and used by the contractor for the development, testing and operations of the system. The report shall contain the following for each technology: benefit/risk, IA impact and risk, source, purpose, version, software license, end of support information, and proposed approach for addressing technology obsolescence with related cost information.

Deliverables:

Government requested changes must be completed in five business days before each sprint.

Approximately eight sprint plans with updates per year.

approved IMS.

Updates delivered in accordance with the COR approved IMS as needed.

Diagrams with updates

The first report is due three months after TO award date.

Subsequent versions are due whenever there is an update and as required based on the outcomes of TEMs and IPT meetings.

(To address tasking in task(s) 6.4 and 6.5)

* Standard Distribution: One copy of the transmittal letter with the deliverable to the Primary COR and GEMSIS Configuration Manager. Deliverable and transmittal letter stored in accordance with the GEMSIS Configuration Management Plan.

6.4 Task 4 – Software Maintenance and Enhancement. (O&M, FFP) The objective of this task is for the contractor to implement robust Agile DevSecOps processes to manage the maintenance, enhancements, rollout, and operations of the capability, including actions that change the software baseline (adaptive, corrective, perfective, and preventative) as well as modification or upgrades that add capability or functionality. The contractor shall perform sprint execution under 6.4 based on the results of sprint planning and sprint development under 6.3. In addition, further objectives include the following:

· Maintain high-quality software code that follows a consistent style, is easily understood, is well documented, and appropriately tested.

· Establish an Agile software development process consistent with industry best-practices.

TS/SCI clearance is required for the contractor to obtain appropriate access to JWICS. The contractor must have access to SIPRNet and JWICS to successfully perform work under this task. This access is required to support the application maintenance, enhancement, and data development on NIPRNet and SIPRNet.

6.4.1 Subtask 1 – Maintenance

The objective of this task is to provide software releases that meet cybersecurity and user requirements and do not contain defects. The contractor shall prepare maintenance releases to address CRs COTS upgrades or replacements, integration of additional data sources, interface with external data sources and applications, implementation of necessary user interface features, and support of administrative functions. Software sustainment activities include sustainment for all software efforts identified in the task order.

The sustainment releases shall include fixes and enhancements that are documented in CRs by users, have been prioritized and recommended by the PCB for implementation, and approved by the CCB. The contractor shall report on progress made on implementing the CRs and inform the COR of capacity available to support additional changes. The contractor shall engage the user community and obtain their feedback to ensure existing user interface and workflow requirements are properly captured as part of the new software release.

The contractor shall ensure the performance of each release is acceptable. The contractor shall test the emerging release against the previous release’s performance baseline. If necessary, the contractor shall test the previous release to define the previous release’s performance baseline for comparison purposes. The baselines will include a Government-defined set of performance measures, which may be modified by the Government periodically to align with software release requirements. The performance baseline report will be provided monthly for six months preceding each scheduled sustainment release.

The contractor level of effort will include support for integration of the modernized E2ESS software with the NTIA’s EL-CID Online capability. This includes integration and maintenance of web services with NTIA, database mapping, data maintenance forms, folder security, alerts and notifications including field help level messages.

For all software covered with this requirement, the contractor shall follow existing CCB policies and procedures, as defined in the Configuration Management Plan. The contractor shall support the CCB/PCB and BCB processes. The contractor shall provide inputs to and monitor the CR log in the designated CR tracker, and scope CRs prioritized by the COR and the PCB. The contractor shall provide estimates on time to implement fixes to defects. The contractor shall make changes to software as approved by the CCB within the resources allocated to development. The contractor shall make updates to documentation (e.g., Installation Guide, User Guide) as required to reflect any changes in installation procedures or software operation.

The contractor shall provide a system that minimizes the potential time of data refresh. While the data is being refreshed in the system, users will need to be able to continue their work without interruption. The contractor shall also provide software maintenance for the Data Maps which map source data to the JSDR, as necessary to accommodate format changes, IA Vulnerability Management (IAVMs) and required component patches.

The contractor shall perform and document results of regression testing. All maintenance releases will be delivered to the Government Configuration Management (CM) site ready for installation with complete IA compliance, documentation, and Request for Change (RFC). The contractor shall deliver TDPs or updates to TDP component documents to reflect any changes resulting with the release.

If Government testing or operations uncovers severity level 1 or 2 defects in a software release, the software release is considered unacceptable, and the contractor shall provide an updated release fixing the defects. The contractor shall have a robust test plan and test environment to prevent defects and to limit deviations between the development and production environments.

Existing TDP components will be provided by the Government. The contractor shall prepare new or update applicable sections of TDPs for all software releases.

6.4.2 Subtask 2 – Enhancement

The contractor shall provide a Development Lead to oversee and manage the requirements within this task. The contractor shall provide a consistent and intuitive user experience for all types of users (frequent and infrequent) that includes easy-to-use job aides to minimize the need for refresher training. The contractor shall streamline user interactions by transparently managing workflows and data management across impact levels (ILs). The contractor shall minimize time required for users to setup and begin using the capability.

The contractor shall maintain the interfaces with programs currently developing interfaces with JSDR (e.g., the EWPMT program and SSF program). The contractor shall maintain the existing interface with the ESPACE portal. The contractor shall create CRs to integrate changes to the JSDR baseline in defined sprints and releases.

The contractor shall perform research, gather data, generate documents, and collaborate with the program office, the DoD, and with other contractors to:

The contractor shall utilize to the extent possible the current architecture, APIs, services, and engineering code to meet requirements. The contractor shall enable services available within other external systems to be integrated into the environment as required. The contractor shall enable data mediation services to assist with cross-service EMS tool communication. The contractor shall maximize utilization of COTS and GOTS capabilities, where possible, to minimize custom code development. The addition of new data sources and visualization and analysis features shall not degrade current system performance. Architectural enhancements deemed necessary to maintain a responsive, performant system shall be identified and approved under Task 3 and implemented under Task 4.

A copy of the current software baseline shall be provided to the contractor upon contract start. A listing of all the current software components and associated versions is provided in the JSDR v3.2 Version Description Document (VDD).

The contractor shall execute approved sprint plans under this task. The sprint plans shall provide TDPs that meet requirements and the Acceptable Quality Level (AQL).

The contractor shall address CRs and IAVMs associated with new functionality implemented in sprints, as identified in the sprint plan. Contractor will continue to perform baseline sustainment activities, including addressing CRs and IAVMs associated with the baseline system.

The software shall operate in accordance with Key Performance Parameters (KPP) on web browsers available on Government-provided and approved Commercial Cloud Services (C2S) SIPRNet, DISA SIPRNet, Navy Marine Corps Spectrum Center (NMSC), Army and United States Air Force (USAF) classified networks, as applicable.

The contractor shall provide multiple releases according to the Government approved IMS. The contractor shall plan for releases, specified in the task order, to be delivered each year and as many unscheduled (i.e., emergency) releases as necessary to address Severity Level 1 or 2 defects, critical security issues and IA issues. The contractor shall deliver updates to the TDP for each release to reflect applicable changes to any of the components of the TDP.

The contractor shall integrate IA early in the software design process. The contractor shall comply with the GEMSIS IA Strategy and the following requirements.

The contractor shall ensure that automated, repeatable security scans and tests are applied to the software product to produce the necessary artifacts for meeting RMF controls for the security team; the scans and tests must cover the following areas (See the reference section for documents containing specific security-related requirements):

· Static Application Security Testing

· Dynamic Application Security Testing

· End to End Testing

· Container Scanning/Monitoring

· Threat Analysis/ Security Controls Traceability Matrix

· Secrets Finding

· Code Coverage Analysis

· Dependency Scanning

· Linting for code smells and vulnerabilities

· Vulnerability Reports

· Dashboards for: Security, Vulnerability, Compliance.

· Data Flow Diagram The contractor shall apply thorough testing to ensure a successful deployment and consistent product behavior across all required Impact Levels (IL), particularly when moving from unclassified to classified ILs.

The contractor shall identify and implement coding standards and user interface standards and conduct internal code and user interface reviews. The contractor shall lead one “Code and User Interface Quality Demonstration” per sprint for a Government-defined audience that demonstrates how software code from the current sprint is documented, with correct modularization and human-readable internal documentation and successfully demonstrate code quality. The contractor shall permit the Government to evaluate any completed code and user interface. The contractor shall produce minutes for each quality demonstration and address any issues identified in the demonstration.

The contractor shall use current industry best practice testing methodologies throughout the software lifecycle to ensure a high-quality product is delivered. All verification activities must be traceable to the defined requirements. All product deliveries to the Government shall be verified at the component and overall product level. The contractor shall provide automated testing and shall ensure requirements are met and test results documented in the TDP Test Report. The contractor shall provide test cases used for automated testing to the Government. Contractor testing shall ensure requirements are met and test results documented in the TDP Test Report. Results of automated code reviews, along with mitigation text for STIG issues identified.

Upon completion of each sprint, the contractor shall host a session for the Government and Government representatives to operate the software in the contractor test environment. The contractor shall provide at least four computers for the exercise, and provide the software, data, corresponding documentation, and technical assistance for the exercise. The contractor shall support the exercise until the Government has completed their evaluation.

The contractor shall configure and maintain a development and test environment that is representative of the operational environment. The operational environment shall include STIG and related security controls identical to the operational environment to meet Controlled Unclassified Information (CUI) requirements. The contractor shall purchase all necessary licenses for each software component to perform research, development, and test activities. The test environment must support hands on testing by the Government’s designated staff – up to eight concurrent testers. The contractor shall expose a test and demonstration internet site with representative test data to support unclassified integration testing with external programs, unclassified demonstrations, user engagement, and remote testing. The contractor shall secure the system to the same standards as the classified version, restrict access to authorized users, and update it to the latest delivered or developmental release upon Government request. The contractor shall allow access to the site based on Government approval. The contractor shall enable access to test versions of the under-development software upon Government request to enable remote testing of sprint results.

The contractor shall document corporate software development, configuration management, and development-related processes and procedures applicable to this task. The contractor shall use an automated system that provides version control. The automated system shall be capable of tracking changes in computer files and coordinating work among software programmers collaboratively developing source code. Documented procedures may be requested prior to contract and/or task order award.

The contractor shall follow software development and management best practices for all Software Development Lifecycle (SDLC) all tasks specified in the contract and task order. This includes requirements definition and analysis, software design, code development and inspection, test and integration, deployment, operations and maintenance, documentation, user interface development testing, configuration management, interface definition and controls, risk management, quality…