Attachment 8 Performance Work Statement.docx

CUI Source Selection Information-See FAR 2.101 and 3.104

CUI

PERFORMANCE WORK STATEMENT (PWS) Comment by Santel, Joseph L CIV DISA PSD (USA): Was this an inadvertent change? Comment by Cruys, Chad R CIV DISA J-9 (USA): Looks to be. Deleted

Award/Mod Effective

Version Date

Award

1. Contracting Officer’s Representative (COR).

1.1. Primary COR

See DITCO Additional Text G1 - Points of Contact

1.2. Alternate COR

See DITCO Additional Text G1 - Points of Contact

1.3. Property Administrator

See DITCO Additional Text G1 - Points of Contact

2. Contract Title. Enterprise Storage Solutions (ESS) IV Capacity Services

3. Background. Defense Information Systems Agency (DISA) is a provider of information technology (IT) solutions for the Department of War (DoW). DoW customers require processing, storage, and communications services. DISA must have the ability to provide storage capacity to the data centers and strategic partners. ESS provides storage infrastructure capacity to meet new and emerging customer requirements and the ability to replace existing DISA storage capacity that has exceeded its technical or economic life, as determined by the Government. Throughout this PWS, storage infrastructure is defined as all hardware, software, microcode and other ancillary equipment, services, and components in government-approved locations to ensure government customers receive uninterrupted, continuous access to electronically stored information. Comment by White, Billie L CIV DISA J-9 (USA): Not capitalizing ‘Government’ when used as ‘the Government’, is a contradiction to the Performance Work Statement Review Checklist updated Oct 2025 that CORs are instructed to follow. (Item #16.) Please notify Policy section or the PSD owner of the PWS checklist. The inconsistency results in many administrative changes. Comment by White, Billie L CIV DISA J-9 (USA): @Santel, Joseph L CIV DISA PSD (USA) Comment by Santel, Joseph L CIV DISA PSD (USA): Addressed to DISA Policy team. Comment by Santel, Joseph L CIV DISA PSD (USA): Per DoW Issuance Style Guide: The designation “government” is capitalized only if used as a part of a proper name, as a proper name, or as a proper adjective. For example, “U.S. Government,” but “government” (in general sense), “European governments.”

It may be used to refer to State, local, or foreign governments. If you intend to refer only to the Federal Government of the United States, use “U.S. Government” or “Federal Government.”

Escalating to CoCO to get thoughts on pursuing since policy is not on board yet.

4. Objective. The Government is seeking to enhance its storage capabilities through a contract that provides reliable, responsive, and cost-effective managed services along with on-demand storage solutions for approved locations within the continental United States (CONUS) and outside of the continental United States (OCONUS). The current challenge is the requirement for a scalable storage system that can dynamically adapt to varying storage and throughput demands via an on-demand service model. This approach must allow for cost flexibility, being billed on a utility basis depending on actual usage throughout the contract's lifecycle. In addition, the required managed services should include comprehensive provision and maintenance of all necessary assets, such as hardware, software, licensing, and all relevant design, logistics, field maintenance, and systems engineering services. The primary objective is to ensure seamless, adaptive, and efficient storage management that can meet the evolving requirements of the Government's operations.

5. Scope. The scope of this contract requires a managed storage service for the Government that provides solutions for all application workloads. The solution includes the hardware, the operating software, network management tools/software, technical services, and operational control. This managed service will provide the Government with the flexibility required to satisfy requirements for security, availability, scalability, and modernization of the storage infrastructure.

5.1 Contractor Responsibilities. The contractor’s responsibilities must include the following for all capabilities as defined in PWS Section 6. Comment by White, Billie L CIV DISA J-9 (USA): We used the word ‘shall’ because of the guidance from the PWS checklist, (11.Ensure contractor tasks are written as “the contractor shall”.) Same meaning either way, just curious. Comment by Singler, Tricia L CIV DISA PSD (USA): I was going of guidance from Procurement innovation lab and US Gov't plain language website. For the most part the words are interchangeable but "must" is just a little more clear Comment by Singler, Tricia L CIV DISA PSD (USA): https://www.plainlanguage.gov/guidelines/conversational/shall-and-must/

· Provide, deliver, install, configure, maintain, and deinstall storage assets.

· Provide hardware/software licensing for all solutions.

· Provide all software required to manage/monitor all storage solutions provided.

· Provide service for all storage assets provided in for the contract including all maintenance and troubleshooting.

· Update and maintain all software, including operating systems and patch management, for provided solutions.

· Provide metered usage reports for consumed capacity.

5.2 Government Responsibilities. The Government will maintain operational management of all solutions provided and may complete the installation of software updates after the initial delivery, unless otherwise specified.

5.3 Current Storage Environment. The contractor shall ensure that all storage assets provided are compatible with and operate seamlessly with the Government’s processor and communications infrastructure.

5.3.1 Processor (Hardware) Infrastructure Compatibility. Storage solutions must be compatible with any operating environment the Government may require, including the latest available version (N) and two previous versions (N-1 and N-2). The following hardware chipsets/operating environments are included in the current processor contract and compatibility with these environments is required.

· International Business Machines (IBM) System z (zero downtime) - IBM z/Operating System (OS), IBM z/VM, Red Hat Enterprise Linux, SUSE Linux Enterprise server)

· X-86

· Windows Server

· Red Hat Enterprise Linux

· SUSE Linux Enterprise Server

· Solaris

· VMware

· vSphere Enterprise Plus

· Red Hat OpenShift

· Scalable Processor Architecture (SPARC) Solaris

· IBM System p: Advanced Interactive eXecutive (AIX)

· Amazon Web Services

· Microsoft Azure

· Google Cloud Platform

· Any other operating system software that DISA may require in the future.

5.3.2 Communications (Network) Infrastructure Compatibility. All contractor solutions shall be compatible with the Government’s current Storage Area Network (SAN) and Internet Protocol (IP) communications architecture. The Government currently uses a network to manage all storage assets and storage replication. The contractor will not be required to provide communications IP equipment.

5.3.3 Unclassified (U) and Classified (C) Level Environments. The contractor will have access to the Non-classified Internet Protocol Router (NIPR) and Secret Internet Protocol Router (SIPR) environments and access to unclassified and classified data. To comply with DoDM 5200.01, the contractor shall deploy separate hardware for classified and unclassified storage environments and must provide all assets required for the storage infrastructure regardless of the environment (classified or unclassified). Storage hardware that is part of the contractor’s solution may be installed in locations that have a classification level higher than Secret. Reference PWS Section 11.2 for individual personnel security requirements.

6. Performance Requirements. Comment by Santel, Joseph L CIV DISA PSD (USA): Do you require program management support? Weekly activity reports, schedule management, after action reports, PMO documentation support, ops support, etc. Comment by Cruys, Chad R CIV DISA J-9 (USA): Only the documented deliverables are required.

6.1 TASK 1 - Storage Solutions and Capabilities.

The contractor shall provide storage capacity as an ‘on-demand’ service capable of readily adjusting to changes in requirements, including both increases and decreases. The Government reserves the right to use any Sub-Line-Item Number (SLIN) or SLIN configuration from the contract B-table for any customer workload or any category of existing or future workload. Ensure all licensed features are included in the SLIN base unit price unless explicitly noted otherwise by the Government. All solutions must comply with the Security Technical Implementation Guides (STIGs) and have security accreditation prior to being ready for use (RFU). All solutions must comply with DoD Instruction 8520.03, which mandates identity authentication for information systems to ensure multi-factor authentication compliance and adherence to zero trust architecture principles. Enterprise class arrays shall not be paired with non-enterprise class arrays as an enterprise solution. The solution must not breach any of the manufacturer’s performance thresholds as defined in Appendix 13, including during internal component failover. The contractor’s solution shall meet all capacity requirements concurrently while ensuring maximum performance and data integrity. Additionally, SIPR access is required for all personnel responsible for maintaining both current and future customer workloads on the SECRET/SIPR network. Examples are provided in Appendix 1 as a sampling of the current hardware deployed within the DISA environment.

Deliverable/s: Solution quantities ordered via the Call Order Management System provided to the Government. Comment by Santel, Joseph L CIV DISA PSD (USA): This is not tied to the delivery schedule table. Comment by Cruys, Chad R CIV DISA J-9 (USA): Added to schedule table.

6.1.1 Subtask 1.1 - Technical Requirements and Architecture. The contractor shall provide utility storage solutions that can be delivered, installed, implemented, scaled, reconfigured, and maintained at optimal performance levels throughout their lifecycle, in accordance with Original Equipment Manufacturer (OEM) best practices, ensuring no disruption to services. Non-disruptive changes include increases and decreases in disk and port capacity, data rebalancing, dynamic data tiering, and firmware updates. Storage devices are required to provide these non-disruptive capabilities internally without relying on external hardware or software solutions (such as redundant switching, port failover, or host multipathing) to maintain data transport during firmware upgrades, hardware replacement, or troubleshooting. Storage Area Network devices must ensure non-disruptive capabilities during firmware upgrades. All contractors’ solutions shall provide a method for encrypting Data at Rest (DAR) and remain in compliance with current and future Federal Information Processing Standards (FIPS).

Solutions must be provided as structured in Appendix 12 in the corresponding categories as defined below. Comment by Santel, Joseph L CIV DISA PSD (USA): In appendix 12 only use the acronym if used multiple times in document and only spell out the acronym in the first use. Comment by Cruys, Chad R CIV DISA J-9 (USA): Appendix 12 updated.

Category Number - Description 0001A - Enterprise Block Storage 0001B - Enterprise Virtual Environment Storage 0001C - Storage Area Network (SAN) 0001D - Bulk, Block-Based Storage 0001E - Network Attached Storage (NAS) 0001F - Object Storage 0001G - Backup Appliance 0001H - Mainframe Virtual Tape System (VTS) 0001I - Storage Resource Management (SRM) 0001J - Software Defined Storage (SDS) 0001K - High Performance Computing (HPC) Storage 0001Z - Emerging Tech - Storage

6.1.2 Subtask 1.2 - Ancillary and Infrastructure Components. Reference Appendix 3, Appendix 4, and Appendix 5 for rack and power details.

6.1.2.1 Subtask 1.2.1 - Ancillary Components. The contractor shall provide solutions that include all required ancillary components (hardware and software) outlined in PWS Sections 6.1, 6.2 and 6.4. This includes racks, internal cables, external cables for designated patch panels and power cables, software and any additional components required for the solution to operate.

6.1.2.2 Subtask 1.2.2 - Infrastructure Components. The contractor shall provide infrastructure components such as racks, cables (including power cables), cable connectors, trunks, and conveyance systems. These components must be ordered once, consumed during the project's execution, and subsequently retained by the Government beyond the contract's duration. Furthermore, all supplied cables must meet plenum rating standards to comply with safety regulations.

6.2 TASK 2 - Additional Capabilities.

6.2.1 Subtask 2.1 - Migration Tools. The contractor shall provide a temporary solution to migrate a subset of data from the existing storage solutions listed in Appendix 1 including Fiber Channel (FC), block-based storage for Open Systems and Mainframe, NAS, Mainframe VTS, Object Storage, Backup Appliance, and Fiber Connection (FICON) to the contractor’s solutions. The provided migration tools must not involve a manual migration process or rely on native OS tools. The Government will determine the schedule and deployment of the migration tools and will be responsible for all data migrations utilizing the contractor’s migration tools.

6.2.1.1 Subtask 2.1.1 - Tool Implementation. The contractor's Subtask 2.1 under Task 6.2.1, Migration Tools, shall be deployable and configurable within one business day without disrupting storage access.

6.2.1.2 Subtask 2.1.2 - Data Migration. The migration of data utilizing the contractor’s 6.2.1 Subtask 2.1 Migration Tools must be executed with no more than one interruption to storage access. If an interruption is unavoidable, it must be brief and should not exceed the duration required for a system restart.

6.2.2 Subtask 2.2 - New Technology Testing. The contractor shall provide a strategy for enabling the Government to test new storage technologies at government-designated locations upon their availability. Following the testing period, the Government will assess the benefits of incorporating the technology into the contract and establish the optimal deployment strategy within the Government enterprise.

6.2.3 Subtask 2.3 - Best Practices. The contractor shall provide OEM best practices for configurations of all solutions provided, including recommendations on how to achieve optimal performance of solutions. These best practices shall encompass guidance on data protection in the configuration of the solutions provided. To maintain compliance, the contractor shall provide all OEM best practices updates to the Government within 30 calendar days of their release by the OEM.

6.2.4 Subtask 2.4 - Technical Documentation. The contractor shall provide the most current, detailed technical documentation for all capacity services solutions and utility pricing within 30 calendar days after the contract award and whenever updates to the technical documentation become available. The contractor’s solution shall include a remotely accessible document repository.

Deliverable/s: Technical documentation for all solutions and utility pricing provided to the Government.

6.2.5 Subtask 2.5 - Technical Training. The contractor is required to provide comprehensive technical training as part of the total managed service. This training shall include familiarization for the Government team and designated staff for all provided infrastructure and solutions. All associated costs must be included in the utility pricing. Training should be available for 1-15 personnel to an expert level and for 1-45 personnel to an intermediate level on all contractor-provided solutions. The contractor’s training plan shall comprise OEM documentation guides, Computer Based Training manuals, specific training hours, and options for in-person and/or virtual classroom training at both government and contractor facilities. While most training will occur within the first two years of the contract, it will continue as new technology and hardware are introduced to the storage environment. Additionally, a contractor-facilitated training plan for new technologies shall be provided to mitigate risks. Training for all contractor-provided solutions must commence within 30 calendar days after the contract award date.

Deliverable/s: Training plan and training availability provided to the Government.

6.3 TASK 3 - Infrastructure Interoperability.

6.3.1 Subtask 3.1 - Internet Protocol Version (IPv) 6. The contractor shall ensure that all components are IPv6 capable or updated to the most recent Internet Protocol compatible with DISA systems. This is defined as a system or product capable of receiving, processing, and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner like that of IPv4. To be considered IPv6 capable, components must meet the following criteria: 1) conformant with the IPv6 standards profile contained in the DoW IT Standard Registry, 2) maintaining interoperability in heterogeneous environments and with IPv4, 3) commitment to upgrade as the IPv6 standards evolve, and 4) availability of the contractor IPv6 technical support and assistance.

6.3.2 Subtask 3.2 - Baseline Compatibility. The contractor shall provide solutions that are compatible with the current installed government storage baseline. Reference Appendix 1, Current Storage Equipment Inventory.

6.3.3 Subtask 3.3 - Enterprise Systems Management (ESM) Interoperability. The contractor shall provide solutions that are interoperable and compatible with the Government’s chosen ESM architecture and automation platform. Reference Appendix 2, Enterprise Management Products for the list of ESM architecture major components and automation platform.

6.3.4 Subtask 3.4 - Communications and Server Interoperability. The contractor shall provide solutions that operate seamlessly with the Government’s communication and server infrastructure, using the Government-provided bandwidth. The contractor’s solutions shall include all necessary components to interface with the Government-provided bandwidth and optimize its usage. Seamless operation requires integration into the existing infrastructure without additional requirements, and bandwidth optimization necessitates the least number of interfaces for connectivity.

6.3.5 Subtask 3.5 - Remote Management. The contractor shall ensure all infrastructure components for the contractor’s storage solution are capable of being managed remotely via a dedicated government remote management network.

The solutions provided in PWS Section 6.4 must be managed and operated by the contractor with government oversight. The solutions must be implemented at a minimum of two sites for redundancy/failover and meet the availability requirements as defined in section 6.5.1 Subtask 5.1 - Availability. The contractor shall ensure the solution includes regular and reoccurring backups to protect against unavailability and data loss, achieving a Recovery Point Objective of 24 hours with a Recovery Time Objective of 48 hours. The contractor shall maintain and configure the operating system and any applications to include software updates or additional software components. The contractor shall install and upgrade all hardware and software infrastructure components and provide technical expertise and maintenance for all products required for the contractor’s solution(s) to fully operate. All historical data must be maintained during and after any upgrades to existing solutions. The Government will have continuous access and the capability to utilize these solutions effectively. Version update requirements for software and applications will be determined by the Government, based on the contractor's recommendations. Additionally, the Government holds the authority to install, configure, and maintain any necessary host agent software. To ensure security, multi-factor authentication is required for all solutions, and software security requirements are detailed in Appendix 11.

6.4.1 Subtask 4.1 - Centralized Management. The contractor shall provide a vendor agnostic centralized management infrastructure solution to include automation, provisioning capabilities, hardware diagnostics, hardware monitoring, virtualization management, event logging, performance management and additional back-office processes required to reside in the infrastructure for the contractor’s technical solution.

6.4.1.1 Subtask 4.1.1 - Centralized Management Solution. The contractor's solution shall support both local and remote centralized management through a wide-area dedicated government management network. It must offer comprehensive operational control, performance monitoring, and error alert capabilities for storage and SAN switching networks. The solution is required to integrate with the Government’s internal reporting system using Simple Network Management Protocol (SNMP) for error and performance alerts. Performance monitoring should encompass array performance, switch fabric performance, and any other provided components, with detailed metrics on volume level performance, switch port performance, array front-end/back-end port performance, switch fabric latency/response time, array cache and central processing unit (CPU) performance, and array disk performance. Additionally, the solution should include centralized OEM software for managing various OEM element managers. The contractor shall deliver a fully operational centralized management solution within 90 calendar days from the contract award date.

Deliverable/s: Fully functional centralized management solution provided to the Government.

6.4.1.2 Subtask 4.1.2 - Analytics. Analytics utilizing built-in artificial intelligence (AI) must be incorporated into the contractor’s centralized management solution for real-time system and performance monitoring and cyber threat detection. Performance monitoring must include solutions for monitoring storage array performance, switch fabric performance, and any other components provided. The contractor’s solution must provide detailed monitoring that includes volume level performance, switch port performance, array front-end/back-end port performance, switch fabric and array latency/response time, storage array cache and CPU performance, and storage array disk performance. Comment by Santel, Joseph L CIV DISA PSD (USA): Is there a deliverable tied to the analytics monitoring? Comment by Cruys, Chad R CIV DISA J-9 (USA): Analytics will be part of the centralized management solution. New deliverable has been tied to that requirement.

6.4.2 Subtask 4.2 - SRM. The contractor shall deliver a unified, vendor-agnostic integrated SRM solution. This solution should encompass business process management, metered/usage-based (used capacity) billing to support charge-back features, and multi-tiered lifecycle management leveraging built-in AI technology. The SRM solution should fully sustain all storage services outlined in this contract and ensure maximum integration with the Government’s existing inventory.

6.4.2.1 Subtask 4.2.1 - SRM Solution. The SRM solution must provide server storage and array capacity utilization information for physical servers, virtual servers, and Kubernetes containers to be utilized for government financial billing purposes. The SRM solution must provide configuration and asset management information for tracking current configuration details and identify which components of a solution are in use and which are not in use. The solution must include tools for capacity planning applicable to all solutions provided. Additionally, it must support data exportation and/or linking through a web services interface. The solution should feature detailed reporting capabilities, with data filtering and granularity down to the volume level. The SRM solution is required to encompass all storage solutions outlined in the contract. The Government will define which assets and capacity quantities fall under the SRM solution’s scope. The contractor is expected to deliver a fully operational SRM solution within 90 calendar days following the contract award date.

Deliverable/s: Fully functional SRM solution provided to the Government.

6.5 TASK 5 - Performance/Availability.

6.5.1 Subtask 5.1 - Availability. The contractor shall provide storage solutions that are highly available with a minimum of 99.9999% for Enterprise class storage (Enterprise Block, Enterprise Virtual Environment, and HPC Storage), a minimum of 99.9% for Bulk Block based storage, and 99.99% for all other solutions (to include Centralized Management and SRM solutions). The solutions should be highly scalable to accommodate varying storage demands and ensure data integrity in case of component failures. Any disruption in data access for servers or applications due to hardware/software issues or maintenance is classified as system unavailability. Application degradation or outages, as specified in Appendix 13, caused by contractor-provided solutions resulting in elevated response times, are also considered unavailability. The metrics for availability and performance are outlined below. Maintenance-related downtimes, whether scheduled or unscheduled, should be deemed system unavailability. Scheduled maintenance activities must not lead to service interruptions, and solutions shall maintain continuous data service without performance degradation during such periods.

6.5.1.1 Subtask 5.1.1 - Availability Measures

Performance Measure 1: Operating Platform Availability 99.99%

· Explanation: The percentage of time each system is available for productive use.

· Measurement: (Total available hours for number of calendar days in reporting month) - Measurement Exceptions - Time storage is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month - Measurement Exceptions) *100=Service Level Attained. Total available hours = 24x number of calendar days in reporting month for each orderable system.

· Measurement Exception: government-initiated downtime and environmental failures not attributed to the contractor.

· Availability Objective: 24x number of calendar days in reporting month minus Measurement Exception (Reference definition above).

· Standard: Satisfactory = 99.99%

· Contractor Responsibility: Maintain operating platform, operating system software and related operating equipment in operating condition at a level to meet or exceed 99.99%.

Performance Measure 2: Enterprise Class Storage, Operating Platform Availability 99.9999%

· Explanation: The percentage of time each system is available for productive use.

· Measurement: 2a (summary): (Total available hours for number of calendar days in reporting month - Measurement Exceptions - Time storage is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month -Measurement Exceptions) *100=Service Level Attained. Total available hours = 24xnumber of calendar days in reporting month averaged over all orderable systems.

· Measurement 2b (per system): (Total available hours for number of calendar days in reporting month - Measurement Exceptions - Time storage is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month -Measurement Exceptions) *100=Service Level Attained. Total available hours = 24x number of calendar days in reporting month for each five nine’s orderable system.

· Measurement Exception: government-initiated downtime and environmental failures not attributed to the contractor.

· Availability Objective: 24x number of calendar days in reporting month minus Measurement Exceptions (Reference definition above).

· Standard: Satisfactory = 99.9999%

· Contractor Responsibility: Maintain operating platform, operating system software and related operating equipment in operating condition at a level to meet or exceed 99.9999%.

6.5.1.2 Subtask 5.1.2 - Workload Performance. The contractor’s solution shall always meet the manufacturer's documented performance capabilities. Prior to implementing any solution, all OEM performance documentation must be submitted to the Government. The contractor must collaborate with the Government to identify any performance issues and offer troubleshooting services until resolved. Should the contractor’s solution fail to meet the manufacturer’s documented performance capabilities, and the performance thresholds defined in Appendix 13, the contractor shall provide an acceptable solution at no additional cost to the Government within 30 calendar days of determining that the performance requirements are not met.

6.5.2 Subtask 5.2 - Diagnostics. The contractor shall provide centrally managed diagnostics and reporting capabilities for all hardware and software components essential for the operation of their solution.

6.5.2.1 Subtask 5.2.1 - Diagnostics Requirements. The contractor shall report on hardware utilization, performance monitoring, and error diagnostics for installed hardware components as specified in PWS Section 6.4.1. Additionally, the contractor shall establish a methodology enabling the Government to access OEM technical support for the operating systems utilized. Any permanent recorded system errors must be immediately reported to the designated remote service centers and include notifications for hardware, software, and necessary components integral to the contractor’s solution. Within 30 calendar days from the contract award date, the contractor shall furnish written confirmation that systems for reporting and remote diagnostics of the applicable equipment are in place. Furthermore, all unclassified hardware provided as part of the storage solution must include built-in diagnostics with phone home capabilities via Hyper Text Transfer Protocol Secure (HTTPS), Secure File Transfer Protocol, or secure shell protocols. Remote diagnostics conducted solely through verbal contact between the local maintenance technician and an off-site service technician are deemed unacceptable.

6.5.3 Subtask 5.3 - Hardware Maintenance. The contractor shall provide all Preventive Maintenance, Predictive Maintenance, and OEM Remedial Maintenance on all hardware operating as part of the solution. The solution must ensure that the contractor can schedule and execute maintenance activities with zero impact on production operating environments. Additionally, all personnel responsible for maintaining equipment components must possess SIPR access to manage both existing and future customer workloads located on the SECRET/SIPR network.

6.5.3.1 Subtask 5.3.1 - Maintenance Requirements. The day-to-day operational management of the hardware will not require contractor intervention. All software components must be remotely manageable within the Government network and compatible with the current government dedicated management system. All maintenance requirements must be included in the utility pricing schedule.

6.5.4 Subtask 5.4 - Maintenance Repair and Response. The contractor shall meet specific response and repair times for maintenance activities: within CONUS, a two-hour response time and four-hour repair time are mandated, OCONUS, a four-hour response time and eight-hour repair time are stipulated. To ensure compliance, the contractor shall implement a system to track response and repair times and promptly notify the Government if these thresholds are exceeded. The contractor shall offer 24/7/365 problem escalation and resolution services for both hardware and software components, which are essential for the full operation of their solution. The contractor shall maintain a U.S.-based help desk staffed exclusively by U.S. citizens, and provide Points of Contact (POC), phone numbers, and an escalation chart to facilitate effective problem resolution.

6.5.4.1 Subtask 5.4.1 - Escalation. The response and repair time begins when the contractor’s help desk provides the incident ticket number to the Government, reference Appendix 14. The contractor’s help desk shall provide an incident ticket number within 30 minutes of notification or request from the Government. These response and repair times do not alter the availability requirements identified in PWS Section 6.5.1 but rather pertain to the requirements for repairing hardware components that may cause a system or its components to fail or operate in a degraded state. The contractor is responsible for resolving failures of redundant system components that, while not immediately impacting system availability, create performance issues or introduce single points of failure into the storage solution. The contractor shall provide a multi-level escalation solution that includes OEM involvement and the contractor's senior leadership, which will be accessible during incident and problem resolution when an incident or problem remains unresolved beyond the prescribed response and repair times. Additionally, the contractor shall implement management-level escalation procedures to resolve any issues that may adversely affect the operation of contractor-provided services. The escalation system must address all the following levels:

Level 1 - Subsystem is down; loss of access to any data (must meet response and repair times from PWS section 6.5.4).

Level 2 - Subsystem is functional with access to all data, but loss of other critical functionality is impacting the Government (must meet response and repair times from PWS section 6.5.4).

Level 3 - Subsystem is functional with some component(s) offline or reconfigured and there is no business impact affecting the Government (must meet response and repair times from PWS section 6.5.4).

Level 4 - Subsystem is functional with the Government requesting educational information (must meet a response time of next business day).

The contractor shall notify the Government program manager if maintenance response and repair actions will exceed the PWS requirements for all Level 1 and Level 2 incidents.

Deliverable/s: Escalation procedures provided to the Government.

6.5.5 Subtask 5.5 - Predictive Maintenance.

Predictive maintenance includes all services performed to prevent equipment failures. This includes the continuous monitoring of equipment for error activity through automated identification and reporting systems, alert mechanisms, and diagnostic routines, all operating within the Government's SIPR and compartmentalized enclaves. The contractor shall use remote diagnostics, as defined in PWS Section 6.5.2, to monitor equipment and component performance, ensuring operation within established specifications. All hardware and software required for the contractor's monitoring solution must reside and operate entirely within the Government’s environment. Specifically, if remote diagnostics indicate imminent hardware or component failure, or operation outside of OEM specifications (including, but not limited to, temperature thresholds, performance degradation, and error rate spikes), the contractor shall proactively schedule and perform the necessary repairs. This proactive maintenance must occur even in the absence of a government-initiated remedial maintenance request. This includes analyzing error activity data captured by the automated systems, alerts, and diagnostic routines, and taking corrective action before an actual equipment failure occurs.

6.5.6 Subtask 5.6 - Remedial Maintenance.

Remedial maintenance includes all unscheduled maintenance activities performed to diagnose and repair malfunctioning or failed equipment. For unclassified storage environments, remedial maintenance should primarily utilize phone-home capabilities. Upon equipment malfunction, the contractor shall initiate maintenance procedures, including generating a government hardware incident ticket following procedures provided after contract award. The Government may also initiate remedial maintenance by contacting the contractor's toll-free help desk. The contractor shall respond to all requests, perform necessary repairs and/or engage with the OEM as required. All remedial maintenance activities must be completed within the response and repair times specified in PWS Section 6.5.4 to meet availability requirements. This includes addressing issues with hardware, operating system software, and any other software necessary for the contractor's solution. Within five business days after the end of each month, the contractor shall submit a report detailing all remedial maintenance actions performed during that month, including the actual response and repair times for each incident. This report is a required deliverable.

Deliverable/s: Monthly remedial maintenance report provided to the Government.

6.5.6.1 Subtask 5.6.1 - To initiate on-site predictive or remedial maintenance, the contractor shall notify the DISA Global Service Desk via email at disa.global.servicedesk.mbx.enterprise-services-ticket-request@mail.mil or by phone at 844-DISA-4IT (844-347-2457) and request an incident ticket. This notification must occur prior to arrival at the site. Upon arrival, the contractor technician shall comply with all applicable reporting and identification requirements. Critically, no production environment access or maintenance actions are permitted without prior coordination with the on-site personnel and a properly completed incident ticket obtained through the DISA Global Service Desk. Failure to adhere to this requirement may result in permanent debarment from all DISA processing centers. When contacting the DISA Global Service Desk, the contractor technician must be prepared to provide all necessary information pertaining to the requested maintenance:

DISA Site Location:

Site POC (Information Technology Service Management (ITSM)+ group):

Serial Number:

Vendor:

Vendor Phone Number and PIN:

Vendor Case Number:

Date/Time Engineer expected:

Barcode:

Floor Location:

Physical Address:

Short Description of Malfunction:

Contract Number:

6.5.7 Subtask 5.7 - Preventive Maintenance.

Preventive maintenance includes all regularly scheduled procedures, as recommended by the OEM, to ensure equipment remains fully operational. This includes utilizing contractor-provided or other approved monitoring systems, which do not disrupt operations, to predict potential equipment failures. All preventive maintenance by the contractor shall be scheduled in coordination with the Government POC, the local government site, and the contractor. Data servicing components of the solutions detailed in PWS Section 6.1.1 must remain online during preventive maintenance activities. The Government reserves the right to determine if a given preventive maintenance activity requires coordination with affected system users. In such cases, the Government POC will schedule an Authorized Service Activity (ASA)/Authorized Service Interruption (ASI) and coordinate the date and time with affected users and the contractor. The contractor shall initiate preventive maintenance according to the approved schedule within 90 calendar days of contract award. This maintenance must be performed outside normal business hours (0600-1800 local time). The contractor shall submit a written preventive maintenance schedule to the contracting officer (KO) within 90 calendar days of contract award. This schedule, which must meet or exceed OEM recommendations, will be subject to modification as required by mutual agreement between the Government and the contractor, at no additional cost to the Government. At a minimum, the schedule must include the following information:

Nomenclature of hardware item Model Serial Number Remote diagnostics and reporting capabilities Frequency and duration of preventive maintenance and type of service to be performed

ASA: An action that is being taken where no disruption to service is anticipated.

ASI: An outage that will impact the customer system causing unavailability.

Deliverable/s: Preventive maintenance schedule provided to the Government.

6.5.7.1 Subtask 5.7.1 - Preventive Maintenance Malfunctions. If a malfunction is discovered during preventive maintenance, the contractor shall immediately notify the Government and perform Remedial Maintenance (see Section 6.5.6) to correct the issue. This corrective action must ensure the continued availability of each orderable system, as specified in the capacity availability requirements of Section 6.5.1.

6.5.8 Subtask 5.8 - Root Cause Analysis/After Action Report. The contractor shall provide a root cause analysis and after-action report for all failures that occur on the contractor-provided solutions within five business days of all incidents resulting in a failure in the contractor’s solution. The root cause analysis must include the reason for the failure, lessons learned, corrective actions/mitigations, timeline to implement corrective actions/mitigations, and updated procedures.

Deliverable/s: Root cause analysis and after-action report provided to the Government.

6.6 TASK 6 - Delivery, Installation and Configuration.

6.6.1 Subtask 6.1 - Delivery Timelines.

6.6.1.1 Subtask 6.1.1 - Delivery, Installation and RFU. The contractor shall complete delivery, installation, and RFU of all contractor-provided solutions within 30 calendar days for CONUS locations and 45 calendar days for OCONUS locations following the contractor's acceptance of the call order.

6.6.1.2 Subtask 6.1.2 - Capacity Expansion. Following acceptance of a call order, the contractor shall complete capacity expansion within ten calendar days, regardless of whether the location is within the CONUS or OCONUS. Capacity expansion is defined as increasing the capacity and/or functionality of any existing, installed serialized asset.

6.6.1.3 Subtask 6.1.3 - Capacity Enablement. The contractor shall enable the required capacity within three calendar days of call order acceptance. Capacity enablement, defined as the activation of pre-installed capacity/functionality on existing assets (identified by serial number), applies to both CONUS and OCONUS locations.

6.6.1.4 Subtask 6.1.4 - Equipment Report. The contractor shall, no less than five calendar days prior to delivering any new hardware, submit a report to the designated Installation mail group (to be provided by the Government after contract award). This report shall include the make, model, and serial number of each hardware item to enable the Government to prepare for and facilitate receipt of the equipment.

Deliverable/s: Equipment report provided to the Government.

6.6.2 Subtask 6.2 - Equipment Installation/Deinstallation. The contractor shall perform all equipment installation and deinstallation activities, required for their solution, during normal business hours (0600-1800 local time), Monday through Friday, excluding Federal holidays. The contractor shall be prepared to work outside of normal business hours, including weekends and Federal holidays, for delivery and installation and deinstallation of call order items, provided the Government makes personnel and accommodation available. All installation/deinstallation costs must be included in the utility pricing unless otherwise directed by the Government. The contractor’s solution should not disrupt service to the Government’s production environment during installation, deinstallation, or any post-installation modifications. The contractor shall complete all installation, deinstallation, and power-up configuration activities subject to government approval. The Government will assume operational control upon RFU completion.

6.6.2.1 Subtask 6.2.1 - Off-Hours Installation. Should the Government be unable to provide personnel and/or accommodations for off-hours equipment installation/deinstallation, and the SLA-required RFU date falls on a weekend, a Federal holiday, or a business day when the Government facility is unavailable or unprepared, the contractor shall be deemed compliant with the SLA upon full completion of the installation/deinstallation within two business days following the Government's provision of both facility and personnel.

6.6.2.2 Subtask 6.2.2 - Standby. The contractor may be required to provide on-site and/or off-site standby support outside of normal business hours, including weekends and Federal holidays. All standby hours, including the availability of a contractor field engineer as requested, shall be incorporated into the Technical Assistance pricing SLINs. Comment by Singler, Tricia L CIV DISA PSD (USA): This appears to be personal services Comment by Cruys, Chad R CIV DISA J-9 (USA): This is strictly for maintenance/engineering support of the contractor solutions. For example, if the Government must perform a firmware or software upgrade to one or more of the contractor’s solutions, we may request they have a field engineer on standby in case issues occur during that process. It’s a way for the Government to ensure the contractor is notified and ready to support if needed.

6.6.2.3 Subtask 6.2.3 - Removal of Equipment. The contractor shall deinstall and remove any contract hardware, upon government request, both during the contract period and at its conclusion, at no additional cost to the Government. Deinstallation and removal from the site must occur within 15 calendar days of the contractor accepting the deactivation call order, for both CONUS and OCONUS locations. The removal of all contractor-owned equipment must be coordinated with the Government site's Accountable Property Custodian or designated property management group.

6.7 TASK 7 - Quality Program. Government performance evaluations will be conducted using the Quality Assurance Surveillance Plan (QASP). The QASP focuses on government activities to ensure contractor performance IAW established performance standards. It defines the application of performance standards, surveillance frequency, and minimum acceptable defect rate(s). The contractor shall implement a quality program based on Information Technology Infrastructure Library (ITIL) fundamentals. All personnel installing and/or maintaining current and future customer workloads residing on the SECRET/SIPR network require SIPR access.

6.7 6.7.2

6.7.1 Subtask 7.1 - Industry Standards. The following ITIL principles must be included in the contractor’s proposal:

· Change Management

· Configuration Management

· Incident Management

· Asset Management

· Release Management

6.7.2 Subtask 7.2 - Change Management. The contractor shall develop and maintain a process for continuous management of changes to the storage infrastructure. This process must accommodate technology evolution, software revisions, manufacturer hardware phase-outs, government requests for new or revised functionality, and changes to government business processes and mission focus—all of which may occur over the ten-year contract period (five-year base with five option years) and be incorporated into the Technical Refresh Program. The contractor’s change management plan shall address EOL and supportability issues that may arise during the contract lifecycle.

Deliverable/s: Change management plan provided to the Government.

6.7.3 Subtask 7.3 - Configuration Management. The contractor shall establish a process for standardizing and managing the infrastructure’s configuration to reduce complexity and reduce break/fix down time. The contractor shall provide a monthly configuration report within five business days after the end of each month.

Deliverable/s: Monthly configuration report provided to the Government.

6.7.4 Subtask 7.4 - Incident Management. The contractor shall provide a written process for handling incident management escalation that complies with PWS Section 6.5.4.1 within 30 calendar days after contract award.

6.7.5 Subtask 7.5 - Asset Management. The contractor shall establish a process for coordinating all assets with the Government prior to deployment into the environment. The process must include asset returns and redeployment within the same location or redeployment to another approved location. The contractor must provide a monthly asset summary report five business days after the end of each month.

Deliverable/s: Monthly asset management report provided to the Government.

6.7.6 Subtask 7.6 - Release Management. The contractor shall provide a written process for performing package releases to the infrastructure. This release management process must ensure the correct introduction of assets into the infrastructure. Prior to implementation, the contractor shall coordinate with government staff regarding the release and implementation of all microcode and software to ensure compatibility across all components. The Government must develop and maintain standard documentation for all locations at specific levels, IAW change and configuration management programs.

6.7.7 Subtask 7.7 - Technology Refresh Program. The contractor shall incorporate any advancements in storage technology throughout the lifecycle of…