Attachment J-1 - Performance Work Statement 06.02.2025 34 Pages.pdf

Solicitation No. 89233125RNA000262 Attachment J-1

P a g e | 1

Performance Work Statement for Clearance Action Tracking System

(CATS) Development & Maintenance

Sponsored by the U.S. Department of Energy (DOE), National Nuclear Security Administration (NNSA), NA-74, Office of Personnel and Facility Clearances and Classification (OPFCC)

June 2, 2025

P a g e | 2

TABLE OF CONTENTS

1.0 Introduction & Background

2.0 Required Positions and Position Qualifications

A. Project Manager (Key Personnel)

B. Solutions Architects

C. Business Analysts

D. Software Engineer Levels I - III

E. Software Engineer Levels IV - V

F. Quality Assurance Specialists

G. Software Testing & Quality Engineer

H. Cloud Engineer

I. Cyber Security Analyst

3.0 Project Requirements

A. Agile Scrum Methodology

B. Azure DevOps (ADO)

C. Software Configuration Management

D. Quality

E. Governance

F. Training Videos

G. Cloud Migration & Hosting

H. Monitoring

I. Customer Service

4.0 Technical Requirements

A. Technology Stack

B. Third Party Libraries and Tools

C. DevSecOps and Continuous Integration / Continuous Delivery (CI/CD)

D. Enterprise Capable

E. Data Management

F. Authentication and Authorization

Attachment 1 Contract No.

P a g e | 3

G. Internal Technical Testing

H. User Acceptance Testing (UAT)

I. Customer Service Portal

J. User Guide & Online Help

K. Hosting and Operations and Maintenance (O&M)

5.0 CATS Governance Board

6.0 NA-IM Integration

A. Oversight

B. Change Management

C. Administrative

7.0 Existing & Planned Development Initiatives

A. Personnel Vetting Reform & Trusted Workforce 2.0

B. Legacy CATS Clearance Module Re-Write

C. Reports

D. Application Programming Interfaces (API)

E. Human Reliability Program Module

F. Document/Template Repository and System Generated Emails

G. User Experience & Interface Design Enhancements

H. Follow-Up Action Tracking Workflow

I. Budget Module with Accounting & Billing Services

8.0 Data Migration

9.0 Training Support

10.0 System Maintenance & Customer Support

A. Case/Action Level Fixes

B. Bug/Defect Management

C. Contractor Response Times

11.0 Applicable Documents

12.0 Quality Control

13.0 Quality Assurance

P a g e | 4

14.0 Performance Measures

15.0 Reporting Requirements

16.0 Security Requirements

17.0 Remote Work

18.0 Government Furnished Equipment & Information

19.0 Work Schedules

20.0 Travel

21.0 Overtime

1.0 INTRODUCTION & BACKGROUND

The NA-74, Office of Personnel and Facility Clearances and Classification (OPFCC), located on Kirtland Air Force Base in Albuquerque, New Mexico, is responsible for implementing all Department of Energy (DOE) personnel security and facility clearance requirements for all National Nuclear Security Administration (NNSA) field sites. NA-74 is also responsible for the continued maintenance and enhancements of the Clearance Action Tracking System (CATS), DOE’s enterprise application used to manage all Personnel Vetting requirements for the cleared and uncleared federal and contractor workforce.

The CATS development project was initiated in 2015 by NA-74 to replace NNSA’s existing clearance case management system. The application deployed in June 2019. CATS is highly customized, fully automated, case management system that replicates the DOE’s personnel vetting processes, end-to-end. In essence, it accomplishes this automation by “flowing” a case through the process from inception (customer request), all the way through the lifecycle of the case, up to the point of expunging the record (when required) after the case has been terminated.

Unlike its predecessor, CATS was designed as an enterprise system, and is now used by all seven DOE Cognizant Personnel Security Offices (CPSO). Furthermore, the application is being expanded to support additional stakeholders, such as Human Reliability Program (HRP) Certifying Officials, the Office of Intelligence & Counterintelligence, Human Capital, DOE’s Power Administrations, and M&O contractor customers. CATS currently houses roughly 300K cases and has roughly 500 users geographically located across the United States. Over 10K case actions are completed in CATS each month. As such, continued maintenance of this application is critical to meeting the DOE/NNSA mission. NA-74 requires an information technology support services contract in support of CATS maintenance.

P a g e | 5

In addition, NA-74 also requires program support services in support of implementing Trusted Workforce 2.0 and other personnel security, intelligence/counterintelligence, cyber and human capital requirements. TW 2.0 was launched in 2018 by the Director of National Intelligence and aims to better support agencies’ missions by reducing the time required to bring new hires onboard, enabling mobility of the Federal workforce, and improving insight into workforce behaviors. It is the most far-reaching reform of the Federal Government's personnel vetting process ever. The approach used today for personnel vetting was developed decades ago. Over time, it has been modified as new threats were identified, but the underlying framework remains the same. Personnel vetting processes require modern transformational reform in line with today’s complex missions, societal norms, threat landscape, changing workforce, and evolving technology. As such, DOE requires an innovative approach to re-brand the CATS application, further secure our data, and automate additional processes stemming from personnel vetting reform. The contractor will be required to gather and refine requirements identified by the Department, assist various CPSOs and program offices with process gap analysis/resolution, and provide technical guidance and schedules for DOE development initiatives.

CATS is currently hosted by the NNSA Office of Information Management (NA-IM) on the Albuquerque Complex Network (ACN). Historically, all NNSA applications were developed, maintained, and hosted/overseen by NA-IM. The CATS project is unique in that NA-74 was responsible for the development & maintenance activities, while NA-IM was still responsible for operations and cyber activities. NA-74 will be working with NA-IM and Microsoft to migrate CATS to the cloud. This effort requires additional resources with a new set of skills/capabilities. The contractor will assume responsibility for planning, migration, and operations of the cloud while NA-IM will continue to oversee all cyber activities.

2.0 REQUIRED POSITIONS AND POSITION QUALIFICATIONS

The following positions are required to fulfill the contract requirements. A high volume of development and maintenance activity is anticipated.

A. PROJECT MANAGER (KEY PERSONNEL)

A Project Manager (PM) shall be assigned under this contract and will be responsible for ensuring satisfactory and timely performance of the requirements identified in the PWS. The PM shall be the single point-of-contact who is responsible for the following:

i. Management, planning, coordination, and reporting of all activities to the COR and Integrated Project Team (IPT). Additionally, the PM shall be required to coordinate all activities performed with NA-IM operations and cyber divisions, and DOE IT Services as necessary.

P a g e | 6

ii. The PM is expected to participate as a member of the IPT that will provide joint NA- 74-Contractor management oversight of the project. The IPT will meet for bi-weekly demonstrations. NA-74 reserves the right to adjust IPT membership and the frequency of these meeting as necessary.

iii. Within one business day following the completion of each Sprint, the PM will provide the COR with a demonstration, presentation or status report, documenting the actual bugs and PBIs completed within that Sprint, the amount of resources, and level of effort.

iv. The PM will provide the COR with reports summarizing accomplishments and development completed when requested.

v. Report formats shall be consistent and approved by the COR.

At minimum, the PM must possess a Bachelor’s Degree in Business Information Systems or similar Information Technology related discipline, paired with at least 15 years of experience in information systems/technology, five of which must be as a manager for cross-functional software engineering teams supporting DOE or NNSA. Strongly desired certifications include Project Management, Agile, SAFe for Government, and Capability Maturity Model Integration (CMMI) level 3 (or higher) accreditation.

The PM must have experience in agile software engineering/development and in directing an organization with a diverse mix of management, technical and administrative functions. The incumbent must possess excellent oral and written communication skills; have the ability to meet deadlines and perform under pressure; and have a thorough and detailed knowledge of DOE and NNSA Information Technology programs, policies, and processes. Experience in achieving or maintaining accreditation of Capability Maturity Model Integration (CMMI) Level 3 or higher and experience in or knowledge of Personnel Vetting programs, policies, and processes is strongly desired.

B. SOLUTIONS ARCHITECTS

At minimum, one Solutions Architect (SA) and one Senior Solutions Architect (SSA) shall be assigned under this contract and will be the SMEs responsible for developing and managing the CATS and cloud architectures. These positions will serve as the technical liaisons with NA- IM and other external customers and will design and coordinate external application integrations and interfaces.

At minimum, the SSA must possess a bachelor’s degree in an Information Technology related discipline paired with at least 10 years of experience supporting DOE/NNSA Information Technology programs. Strongly desired certifications include Project Management, Agile, SAFe

P a g e | 7 for Government, Azure, Information Technology Infrastructure Library (ITIL), Certified Information Systems Security Professional (CISSP), Cloud/Network Engineering, and Capability Maturity Model Integration (CMMI) level 3 (or higher) accreditation. Experience in achieving or maintaining accreditation of Capability Maturity Model Integration (CMMI) Level 3 or higher and experience in or knowledge of Personnel Vetting programs, policies, and processes is strongly desired.

At minimum, SA must possess a bachelor’s degree in an Information Technology related discipline, paired with at least five years of experience in Information Technology supporting cross functional teams. Desired certifications include Project Management, Agile, SAFe for Government, Azure, Information Technology Infrastructure Library (ITIL), Certified Information Systems Security Processional (CISSP), Cloud/Network Engineering, and Capability Maturity Model Integration (CMMI) accreditation.

C. BUSINESS ANALYSTS

At minimum, two Business Analysts (BA) and one Senior Business Analyst (SBA) shall be assigned under this contract and will serve as the primary customer point of contact to facilitate process management and for communications with NA-74 and other DOE users of the system to coordinate product demonstrations, Sprint planning, work item triage, prioritization, and requirements gathering, analysis and preparation of business requirement documents as directed. The BAs must possess strong written and verbal communication skills, experience working in the Agile methodology, knowledge of Capability Maturity Model Integration (CMMI) processes and best practices, and a strong aptitude for critical thinking.

At minimum, Senior Business Analyst should have a bachelor’s degree plus two years of experience working on a cross functional software engineering team. An additional four years of experience may be substituted for education. Experience in or knowledge of DOE/NNSA Personnel Vetting programs, strong written and verbal communication skills, experience working in the Agile methodology, knowledge of Capability Maturity Model Integration (CMMI) processes and best practices, and a strong aptitude for critical thinking is strongly desired.

At minimum, Business Analyst should have an associate’s degree and two years of experience in a similar role. Experience may be substituted for education on a year for year basis.

Experience in or knowledge of Personnel Vetting programs is desired.

D. SOFTWARE ENGINEER LEVELS I - III

At minimum, six Software Engineer Levels I - III shall be assigned under this contract who are knowledgeable of all technical tools and techniques relevant to the role. The Software

P a g e | 8

Engineers will interpret requirements and create technical solutions with programming code, databases, and user interfaces. The Software Engineers will abide by NA-IM security and process requirements.

At minimum, Software Engineer I should have a high school diploma plus a software development technical certificate. Software Engineer II should have an associate’s degree and one year experience on a software team. Software Engineer III should have a bachelor’s degree and three years of experience in a software engineering role. Experience may be substituted for education on a year for year basis.

E. SOFTWARE ENGINEER LEVELS IV - V

At minimum, four Software Engineer Levels IV - V shall be assigned under this contract who are knowledgeable of all technical tools and techniques relevant to the role. The Software Engineers will interpret requirements and create technical solutions with programming code, databases, and user interfaces. The Software Engineers will abide by NA-IM security and process requirements.

At minimum, Software Engineer IV should have a bachelor’s degree and five years of experience in a software engineering role. Software Engineer V should have a bachelor’s degree and 10 years of experience in a software engineering role. Experience may be substituted for education on a year for year basis.

F. QUALITY ASSURANCE SPECIALISTS

At minimum, three Quality Assurance (QA) Specialists shall be assigned under this contract and will be required to adequately test the application prior to all deployments to Stage and Production.

At minimum, Quality Assurance Specialist should have a bachelor’s degree plus two years of experience testing software on a technical team. Experience may be substituted for education on a year for year basis. Experience in or knowledge of DOE/NNSA Personnel Vetting programs is strongly desired.

G. SOFTWARE TESTING & QUALITY ENGINEER

At minimum, one Software Testing & Quality Engineer IV shall be assigned under this contract to facilitate automated software testing and pipelines to enhance traditional manual testing performed by QA Specialists. The Test Engineer will maintain testing tools and scripts, integrate with static and dynamic code analysis scanning tools, develop and manage solutions for simulating data/transactions within CATS, and ensure automated testing is part of Azure DevOps build pipelines.

P a g e | 9

At minimum, Software Testing & Quality Engineer should have a bachelor’s degree and five years of experience with automated testing and software quality on a software engineering team. Experience may be substituted for education on a year for year basis.

H. CLOUD ENGINEER

At minimum, one Cloud Engineer III shall be assigned under this contract. The Cloud Engineer will assume all engineering and operational duties associated with hosting an application in a cloud environment, including the design, testing, management, monitoring, and documentation for all cloud resources that support CATS. Additionally, the Cloud Engineer would be responsible for managing Azure DevOps pipelines and common DevOps processes.

At minimum, the Cloud Engineer should have an associate’s degree or cloud certification (AWS or Azure, Azure preferred) with 3 years managing complex cloud-based systems.

I. CYBER SECURITY ANALYST

At minimum, one Cyber Security Analyst shall be assigned under this contract. The Cyber Security Analyst will be responsible for technical and programmatic activities related the overall security of the CATS application and security practices of the development team, to include control testing, security training, facilitate static and dynamic code analysis, software vulnerability and 3rd party library tracking, liaising with cybersecurity oversight, security monitoring and logging, and security documentation.

At minimum, the Cyber Security Analyst should have a relevant cyber certification with three years managing Federally/NIST accredited systems.

3.0 PROJECT REQUIREMENTS

A. AGILE SCRUM METHODOLOGY

The contractor will employ the Agile Scrum project management methodology. Development will occur in short, two-week iterations (“Sprints”). Agile ceremonies will be used to plan, conduct, and report on status, to include Sprint Planning, Daily Scrum, Retrospective, Product Demonstrations, Prioritization, and Triage. The Agile concept will be used to flexibly and iteratively prioritize and plan work as well as deliver small, meaningful value more frequently.

B. AZURE DEVOPS (ADO)

To facilitate Scrum as well as all software configuration and release management practices, the Contractor shall use Azure DevOps (ADO). ADO should be used to track all backlog items, Sprints, requirements, acceptance criteria, work items, approvals, support requests, source code, and release notes. Additionally, it can be used to as a team Calendar, as a Wiki for various

P a g e | 10 informal team and process documentation, and to provide real-time transparency through reporting and dashboards.

Key information to be managed and reported using ADO:

i. Sprint burndown chart.

ii. Current Sprint backlog.

iii. Product backlog, inclusive of all work yet to be completed.

iv. Product-wide list of bugs and their current state.

v. Project calendar.

vi. Process guidance.

vii. General documents and information.

a) Release notes.

b) Requirements documents.

c) Acceptance criteria.

d) Design documents.

e) Meeting minutes.

C. SOFTWARE CONFIGURATION MANAGEMENT

Software requirements and approvals must follow an established and formal Software Configuration Management Plan. Using ADO, any given work item should have full traceability to see who created it, who approved requirements, who did the development, who tested it (QA), and who approved it out of UAT (which COR). Requirements for work items will be gathered and made workable by the BAs, then must be approved by the COR. If necessary, Requirements meetings can be conducted to give the development team an opportunity to ask clarifying questions. It is expected that by the time a work item is committed to a Sprint that requirements and acceptance criteria will be well known.

D. QUALITY

The Contractor is expected to develop and manage processes that support a high-quality application. This includes documenting and enforcing process and coding standards, performing internal QA (functional) testing on all new development prior to UAT and release, ensuring business requirements and acceptance criteria are properly recorded and approved, and using automation where possible to limit human error.

E. GOVERNANCE

The Contractor shall be responsible for authoring and maintaining strategic documentation, to include:

P a g e | 11

i. Systems Design Documentation

ii. Business Impact Analysis (BIA)

iii. Service Level Agreement (SLA)

iv. Software Configuration Management Plan

v. Disaster Recovery Manual (cloud)

vi. Resource Runbooks (cloud)

Additionally, the contractor shall provide assistance to NA-IM, as needed, for additional documentation essential to the continued Authorization and Accreditation (A&A) of CATS, to include:

i. FIPS-199 risk assessments

ii. Information Systems Security Plan (ISSP)

iii. Disaster Recovery and Continuity of Operations (DR/COOP) plan

iv. Incident Response (IR) plan

F. TRAINING VIDEOS

When deemed necessary, primarily for significant changes or the introduction of new functionality, or whenever directed by the COR, the Contractor shall produce videos sufficiently explaining the change. These videos shall be posted within the Customer Service Portal.

G. CLOUD MIGRATION & HOSTING

Plans are currently underway to move CATS from traditional, on-premises hosting to the cloud. The Contractor shall be responsible for all efforts to design, test, document, migrate, update, and operate CATS in the cloud. This includes any and all updates to accommodate a hybrid Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) resource model with all cloud operations and maintenance (O&M) activities being performed by the Contractor going forward.

H. MONITORING

The Contractor shall develop and provide monitoring data, gathered from the CATS database or otherwise, on the use and activities of CATS end-users and administrators as well as background processes. This should include, but is not limited to:

i. New user creation.

ii. Changes to CATS Admin group.

iii. When a user is placed in username/password mode.

iv. When a user is disabled but has assigned/open actions.

v. When a disabled user is reenabled.

P a g e | 12

vi. Active users and session statistics.

vii. Daily DIF counts.

viii. Automated data input/output validation and error reporting.

ix. Stale accounts.

x. User lists.

xi. Action completion statistics.

xii. Bridge transactions statistics.

Additionally, the Contractor shall be required to provide certain system and security logs, routinely or ad hoc, to NA-IM for Cybersecurity purposes.

I. CUSTOMER SERVICE

The Contractor shall provide any/all assistance required in support of end-user requests or problems, as escalated by the CATS Support team or COR. The Contractor shall provide professional, courteous, and timely customer service and track requests in ADO, as necessary.

Additionally, the Contractor shall be expected to provide off-hours support, as necessary, to support software releases, troubleshoot problems, respond to outages, perform system administration, and execute special projects.

4.0 TECHNICAL REQUIREMENTS

A. TECHNOLOGY STACK

The Contractor shall use existing CATS technologies, tools, frameworks, and architectures unless otherwise authorized in writing by the COR. CATS is currently being developed using .NET 7 and the Command and Query Responsibility Segregation (CQRS) design pattern, which has become industry standard for data and workflow driven web applications. All new development utilizes the latest .NET feature, Blazor. The team will utilize design and script libraries such as BootStrap to create a consistent look and feel throughout the application.

This provides ease-of-use, continuity of workflow operations throughout the user interface, and ensures maintainability after the application is in production and in maintenance mode.

The team is currently using Telerik Webcraft web components for rapid application development of the user interface to create intuitive workflows for the end user throughout the application. The team has been approved to use Microsoft SQL Server for the database management system, Power BI for integrated reports, SQL Integration Services for automated data input/output, Windows Server for OS, and IIS as the web server. The development platform may change/evolve during contract performance depending on technology changes and/or NNSA/DOE IT requirements. Any changes to the development platform affecting scope or cost must be approved by the Contracting Officer.

B. THIRD PARTY LIBRARIES AND TOOLS

P a g e | 13

The Contractor shall minimize costs related to the use of third-party libraries or software necessary to develop or operate CATS. In the event it becomes necessary to introduce additional licensing, software, or hardware, the approval of the Project Manager, NA-IM, DOE EITS, and/or the COR is required.

C. DEVSECOPS AND CONTINUOUS INTEGRATION / CONTINUOUS DELIVERY (CI/CD)

The Contractor shall leverage the industry standard concepts of DevSecOps and Continuous Integration/Continuous Delivery to create and manage automated build and release pipelines, support various value streams (see User Acceptance Testing), and create a cross-functional, highly performing team. Additionally, DevSecOps and CI/CD processes are used to comply with separation of duties concerns and software configuration management requirements.

D. ENTERPRISE CAPABLE

The Contractor shall design, develop, and implement CATS to fit the needs of the entire DOE/NNSA enterprise. Where possible, actions, security/permissions, and data accessibility should be constrained to Cognizant Personnel Security Offices (CPSOs) and/or other access models, such as Limited Access Users. This means CATS must have the ability to:

i. Add/change CPSOs.

ii. Set action and permission boundaries at the CPSO level.

iii. Associate users with designated CPSOs.

iv. Restrict user data views based on their assigned CPSO(s) and user permissions.

v. Identify incoming work by CPSO/site and assign it to the correct CPSO.

vi. Provide data reports that account for CPSO boundaries.

E. DATA MANAGEMENT

The Contractor shall be responsible for data accuracy, analysis, management, and input/output activities, to include:

i. Developing CATS such that data generated from the application is accurately recorded, to include an audit trail.

ii. Encrypting files and databases.

iii. Developing and managing APIs and/or automated file imports/exports for processing and sharing of data with external parties.

iv. Data research and analysis, inclusive of data in/from external systems.

v. Mass data updates and transactions.

P a g e | 14

F. AUTHENTICATION AND AUTHORIZATION

The Contractor shall build and maintain CATS such that PIV Authentication is the primary and universal method of authentication to satisfy multifactor authentication requirements. A secondary mechanism for temporary username and password authentication should also be supported. Access to controlled activities within CATS should be limited to defined permissions, and permissions should be bundled into roles that can be assigned to users.

G. INTERNAL TECHNICAL TESTING

The Contractor shall use software quality testing tools and processes to perform load testing, vulnerability testing, and regression/functional testing. It is expected that integrated vulnerability tests (dynamic and/or static code analysis) will occur through automated ADO pipelines and detected vulnerabilities will be managed according to the NA-IM Vulnerability Management Program Plan, unless otherwise directed by NA-IM Cybersecurity. Unless otherwise authorized by the COR and NA-IM, Checkmarx is to be used for static code analysis, and WebInspect (owned and managed by NA-IM) is to be used for dynamic code analysis until such time that they transition to Invicti, in which it is expected the Contractor will leverage automated testing scripts and tools and will assume operational responsibility for these scans.

H. USER ACCEPTANCE TESTING (UAT)

Completed work items will be demonstrated to applicable stakeholders and then pushed to an appropriate Stage environment for UAT, as necessary. This provides an opportunity for end users to test new/changed functionality for a final level of quality assurance and acceptance, and is an important part of software configuration management requirements.

Three value-streams determine how/if a given work item requires UAT – Full UAT items shall be published in an environment where slower and bigger testing from a broader audience can be performed; Limited UAT items shall be published in a separate environment where the Product Owners/CORs can test exclusively for quicker turnaround; and No UAT items do not require approval before release to Production. Value-stream determination is to be made by COR during the Triage ceremony.

I. CUSTOMER SERVICE PORTAL

The Contractor shall build and manage functionality to support a Customer Service Portal (CSP). The CSP is used to share various support information, news, and documents to the CATS user base. Release Notes shall be published to the CSP for every Production release using automation as part of release pipelines. Other content is to be managed manually and at the discretion of the COR.

J. USER GUIDE & ONLINE HELP

P a g e | 15

The Contractor shall continue to design, develop, and publish a user guide and interactive on-screen help functionality. Both the user guide and help function shall:

i. Be accessible to all CATS users.

ii. Fully explain system functionality, action flows, recommendation options, and expected outcomes.

iii. Include screenshots, pictures, or other examples when necessary.

iv. Define all data-fields, icons, and labels.

v. Have the ability to search and/or filter.

vi. Be in sync with changes introduced in Production releases.

K. HOSTING AND OPERATIONS AND MAINTENANCE (O&M)

The Contractor shall provide technical O&M of all underlying CATS components and services, scoped to the application layer and above in the on-premises hosting model (NA-IM manages OS and down) and all CATS-specific cloud resources.

5.0 CATS GOVERNANCE BOARD

The CATS Governance Board (CGB) was established to identify, approve, and prioritize new requirements for continuous development and enhancements of CATS. The CGB is expected to meet quarterly. The contractor will be required to attend and participate in all CGB meetings and activities. The contractor will be required to gather and refine requirements identified by the CGB, assist with CPSO/DOE program office process gap analysis/resolution, and provide technical guidance and schedules for the development initiatives identified by the CGB. The contractors selected for participation on the board must be knowledgeable of DOE’s personnel security program operations/requirements and existing system design and functionality.

6.0 NA-IM INTEGRATION

A. OVERSIGHT

NA-IM provides all IT and Cybersecurity oversight, including the Accreditation and Authorization of CATS and creation and/or dissemination of all applicable Federal and Departmental IT policies, laws, and SOPs. The Contractor is expected to follow all guidance and work closely with NA-IM to ensure CATS is developed and maintained accordingly.

Additionally, NA-IM provides the hosting environments in which CATS will operate. The Contractor shall provide systems design and operations and maintenance (O&M) support for all systems/components allowable by NA-IM, to include servers, IIS, SQL, PowerBI, SSL certificates, domain and identity management, networking, storage, and all relevant formal documentation. The Contractor shall participate in all NA-IM testing, training, and planning exercises necessary.

P a g e | 16

B. CHANGE MANAGEMENT

The Contractor shall abide by NA-IM policies and procedures related to the request and approval of all system-level changes.

C. ADMINISTRATIVE

The Contractor is expected to perform O&M activities as defined in Service Level Agreement (SLA) between NA-74 and NA-IM, currently limited to cloud activities only. As needed, the Contractor will communicate and collaborate with NA-IM on administrative and security issues, provide testing and forensics, provide log data/integration, formal documentation, and generally support all efforts required to operate CATS.

7.0 EXISTING & PLANNED DEVELOPMENT INITIATIVES

The application currently consists of ten major components: Customer Web Portal (eCAR Portal);

Processing; Adjudication; Administrative Review; ePSF; System Administration; Reports;

Customer Service Portal; PIV processing; and multiple APIs that send/receive data to/from other systems (i.e. SSIMS, eDelivery, CPCI Data Bridge, etc.). A generic list and general descriptions of current/planned development initiatives is provided below.

Additional development initiatives will be derived from new or updated policies, procedures, and regulations (local, department-level, national, etc.), user feedback, changes to department/organizational structures, and/or new/changing technology. All development activities will be prioritized and approved by the COR. The contractor will be responsible for refining, designing, developing, testing, resolving issues, bugs, or defects based on UAT, and for coordinating with NA-IM operations and cyber to ensure a successful deployment to CATS production.

Note: Some requirements may change, become obsolete, overcome by events, or ruled out by the

CGB.

A. PERSONNEL VETTING REFORM & TRUSTED WORKFORCE 2.0

The contractor shall design/develop solutions to support personnel vetting reform initiatives, led by the Office of the Director of National Intelligence (ODNI). This includes, but is not limited to, system modifications and/or new workflow(s) to ensure DOE’s compliance with Trusted Workforce 2.0. Software Engineer levels IV-V will be employed for these efforts.

B. LEGACY CATS CLEARANCE MODULE RE-WRITE

P a g e | 17

The clearance module within CATS (legacy portion of the application) shall be updated/re-coded to mirror the flow-based architecture of the uncleared PIV module. This will allow for new functionality to fit more easily into existing business processes and increase the speed of future development, preventing a translation between new and old design standards and functionality. With constantly evolving business requirements, this change will provide the flexibility to rapidly add and customize workflows within the system.

C. REPORTS

The contractor shall continue to design, develop, and implement the ability to create canned grid and SSRS reports that are customizable and sharable. The Reports Module will be limited to those with permission to access, and the data displayed within the reports will be filtered based on the user’s CPSO permission(s). All reports generated by the system shall include the appropriate markings when Personally Identifiable Information (PII) is present.

D. APPLICATION PROGRAMMING INTERFACES (API)

The contractor shall design, develop and implement APIs that will allow CATS to interface and securely exchange data with other NNSA, DOE, and national applications and trusted data sources where appropriate and authorized. Current and planned API initiatives include, but are not limited to, the following:

CPCI Data Bridge:

CPCI is the DOE system of record for clearances. The system feeds several other National databases. The CPCI Data Bridge is an API that allows data entered through CATS to be transmitted to CPCI, eliminating the need for duplicate entry. The contractor shall ensure that none of the work completed under this PWS conflicts with or creates issues with the data bridge, unless it is previously approved by the COR. The contractor shall be required to attend regularly scheduled meetings and collaborate with the CPCI Development Team to continuously develop/maintain the data bridge and data integrity between the two systems.

Any conflicts between the teams shall be communicated to the COR for resolution.

E. HUMAN RELIABILITY PROGRAM MODULE

Some CPSOs are responsible for managing HRP. The contractor shall design, develop, and implement a module for each CPSO to manage their HRP population, to include (but is not limited to) the ability to automate and electronically flow the HRP certification, track HRP participants, and store associated documents within an electronic HRP file, which will be stored separate from the ePSF.

F. DOCUMENT/TEMPLATE REPOSITORY AND SYSTEM GENERATED EMAILS

P a g e | 18

The Contractor shall design, develop and implement a service for electronic production of the following correspondence, in which CPSOs can design, develop, modify, store, and remove:

i. Clearance and PIV processing correspondence;

ii. Clearance and PIV adjudication and Administrative Review/appeal correspondence;

and

iii. Email notifications of actions.

The contractor will also develop a solution to integrate encryption for exporting/sending these electronic documents.

G. USER EXPERIENCE & INTERFACE DESIGN ENHANCEMENTS

The contractor shall improve the overall usability and accessibility of the system, and improve the look and feel of the graphical user interface (GUI).

H. FOLLOW-UP ACTION TRACKING WORKFLOW

Some CPSOs require the ability to recommend follow up actions to occur on an individual after a specified amount of time has passed (i.e. pull credit report in three months, conduct annual psychiatric evaluations, follow up contact after a certain date, etc.). The contractor shall:

i. Add follow up recommendations to existing adjudicative workflows.

ii. Develop workflows for each follow up recommendation.

iii. Give users the ability to set a future date of when the follow up action is to occur.

iv. Auto-create follow up actions/workflows based on dates set by users.

v. Create reports to track and monitor follow up activities.

I. BUDGET MODULE WITH ACCOUNTING & BILLING SERVICES

The contractor shall design, develop, and implement a module for each CPSO to track and manage their investigations and personnel security budgets. At minimum, the module shall include the ability to:

i. Automatically (based on workflow activities) and manually Track/monitor investigations and other products/services purchased (i.e. psych evaluations, credit reports, transcripts, etc.) in support of the Personnel Security Program.

ii. Electronically generate billing statements, reports, and other documentation to facilitate budget management.

P a g e | 19

iii. Allow CPSOs to manage their own product/service pricing and track historical price changes.

iv. Track reinvestigations and other products due.

v. Filter all of the above information by CPSO, Site, employer, or sponsor organization.

8.0 DATA MIGRATION

As new workflows/modules are developed and legacy systems and applications are retired, the contractor may be required to develop and implement solutions to migrate data from external databases/systems into CATS.

9.0 TRAINING SUPPORT

The contractor shall provide support to CATS related training activities by providing technical interpretations and feedback and developing training materials for users.

10.0 SYSTEM MAINTENANCE & CUSTOMER SUPPORT

Users have been directed to report all issues to the CATS Support Help Desk, which is managed by NA-74 federal personnel and support services contractors (outside of this contract). The CATS Support Help Desk will make every attempt to verify and resolve issues prior to elevating the request to the contractor. The contractor shall be responsible for all system maintenance and will provide support to the CATS Support Help Desk by fixing bugs or resolving outages and accessibility issues that have been elevated to the contractor.

A. CASE/ACTION LEVEL FIXES

Unless otherwise approved by the COR, all case and action-level data/code fixes shall be completed within the following timeframes:

Urgency/Priority Type/Impact Definition/Example Completion Time

Critical Work Stoppage – High Impact

Unable to move forward with an action involving DOE or Federal Laws, Rules, & Regulations. One (1) business day

High Non-Work Stoppage – High Impact

Able to move forward with an action but will impact data integrity or involve additional re-work. Two (2) business days

Medium Work Stoppage – Low Impact

Unable to move forward with an action not involving any DOE or Federal Laws, Rules, & Regulations.

Three (3) business days

P a g e | 20

Urgency/Priority Type/Impact Definition/Example Completion Time

Low Non-Work Stoppage – Low Impact

Data/code updates to case/action that does not involve timelines, regulations, etc. and does not impact data integrity or involve additional re-work.

Five (5) business days

Note: a response will not be required until the issue is resolved.

B. BUG/DEFECT MANAGEMENT

Triage Type Impact Definition/Example Completion Time

Critical Work Stoppage – High Impact

• Defect with no defined workaround that is considered high-impact.

Examples:

o Action driven by DOE Order or other Federal Laws, Rules, & Regulations o Large quantities of cases/actions effected o User inaccessibility o Server Error o Loss of data

One (1) business day

High Non-Work Stoppage – High Impact

• Defect with no defined workaround but is considered low-impact o Action not driven by DOE Order or other Federal Laws, Rules, & Regulations o Small quantities of cases/actions effected

• Defect with a defined workaround involving DOE or Federal Laws, Rules, & Regulations

• Defect with a defined workaround that may impact data integrity or involve additional re-work

Two (2) business days

Medium Work Stoppage – Low Impact

• Defect with a defined workaround not impacting data integrity or involving additional re-work

Three (3) business days

Low Non-Work Stoppage – Low Impact

• Data/code updates to case/action that does not involve timelines, regulations, etc. and does not impact data integrity or involve additional re-work.

Five (5) business days

P a g e | 21

Triage Type Impact Definition/Example Completion Time

• Anything that doesn’t fall within the other 3 categories o Cosmetic o UI consistency

C. CONTRACTOR RESPONSE TIMES

The contractor is required to respond to the government on the following request types within the following timeframes:

Urgency/Priority Definition/Example Response Time

Critical Service outage, interruption, or non-response One (1) business hour

High Failure of component, failure of service imminent, critical vulnerability, suspected abuse that could impact data confidentiality or integrity, restores.

Two (2) business hours

Medium Request for new or changed service, change request Two (2) business days

Low Usage/monitoring statistic requests One (1) business week

NOTE: a response does not equate to incident or request resolution, only the initial contact.

11.0 APPLICABLE DOCUMENTS

The Contractor shall comply with all applicable federal, DOE, NNSA and NA-74 policies, regulations, orders and other directives. See attachment 2 – List of Applicable References.

12.0 QUALITY CONTROL

The Contractor shall develop and maintain a quality control program to ensure services are performed in accordance with the performance objectives identified within this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of Contractor repetitive failures. The Contractor’s quality control program is the means by which a Contractor ensures all work complies with the requirements of the contract. A Quality Assurance Surveillance Plan (QASP) shall be delivered to the CO no later than (30) days after award of the contract. After the Government’s review of the QASP, the Contractor shall receive any proposed CO changes to the quality control system. Once all Contractor changes are accomplished and approved, the Contractor shall receive the Government’s written acceptance.

P a g e | 22

13.0 QUALITY ASSURANCE

The Government shall evaluate the Contractor’s performance under this contract in accordance with the QASP identified above and performance objectives identified under Section 14.0 of this

PWS.

P a g e | 23

14.0 PERFORMANCE MEASURES

The government’s assessment of the Contractor’s performance and deliverables will be based on the following performance standards to determine final acceptance and completion of tasks described within the PWS.

Requirement/ Deliverable

PWS

Reference

Minimum Performance

Standard

Assessment Methods (Random sampling, periodic sampling, visual exam, trend analysis, customer complaint, reports, 100 % sampling)

Impacts & Incentives

Effective Workload Management

2.0 A

3.0 A, B, C

Sprint burn rates must be at least 80% of the work committed for that sprint.

100% review of Azure DevOps (or other system-generated) burn reports.

If a Sprint falls below 80% within the period of performance the contractor will first receive a verbal warning from the COR;

second, a negative CPARS rating for this deliverable; third notice may result in termination for default.

An overall average burn rate for the period of performance that is above 85% (and no sprints were below 80%) will result in a rating above a Satisfactory CPARS rating for this deliverable.

Maintaining Strategic Documentation

3.0 E Strategic documents

listed in section 3.0 E i-vi must be reviewed before the end of each calendar year.

100% review of documents.

A verbal warning will be given to the contractor for any reviews not completed before the end of each calendar year.

Any additional strategic documents that are reviewed/created during the performance

P a g e | 24

Requirement/ Deliverable

PWS

Reference

Minimum Performance

Standard

Assessment Methods (Random sampling, periodic sampling, visual exam, trend analysis, customer complaint, reports, 100 % sampling)

Impacts & Incentives period will result in a CPARS rating above Satisfactory for this performance measure.

Training Videos 3.0 F Training videos requested by the COR shall be posted on the Customer Service Portal no later than five business days following Production deployment.

100% review of Customer Service Portal

Videos posted prior to Stage/Production deployments will be result in a CPARS rating of Exceptional for this performance measure.

Videos posted within two days following Production deployment will result in a CPARS rating of above Satisfactory for this performance measure.

Videos posted within three to five days of Production deployment will result in a CPARS rating of Satisfactory for this performance measure.

Videos posted after the minimum performance standard will first result in a verbal warning; second a negative CPARS rating for this performance standard.

P a g e | 25

Requirement/ Deliverable

PWS

Reference

Minimum Performance

Standard

Assessment Methods (Random sampling, periodic sampling, visual exam, trend analysis, customer complaint, reports, 100 % sampling)

Impacts & Incentives

Release Notes 4.0 I Release notes shall be published to the CSP for all user-derived PBIs and critical/high bug fixes no later than five business days following Production deployment.

Periodic review of release notes.

Automated release notes published at the time of deployment will be given a CPARS rating of Exceptional for this performance measure.

Verbal warning will be given if the release notes are not in place within the five-day requirement. If it occurs again within the period of performance, the contractor will receive a negative CPARS rating.

Updated User Guide & Help Function

4.0 J User Guide & Help

Function shall be updated within five business days of Stage deployment.

Updated user guide (including any changes that occurred due to UAT) will be deployed at the time of production.

User Acceptance Testing and periodic reviews of the User Guide.

Verbal warning will be given if the updates are not in place within the five-day requirement. If updates are not in place prior to a production release the contractor will first receive a notice to correct within five (5) business days. If it occurs again within the period of performance, the contractor will receive a negative CPARS rating. Third occurrence may result in termination for default.

P a g e | 26

Requirement/ Deliverable

PWS

Reference

Minimum Performance

Standard

Assessment Methods (Random sampling, periodic sampling, visual exam, trend analysis, customer complaint, reports, 100 % sampling)

Impacts & Incentives

NA-IM

Integration

6.0

The contractor is required to coordinate and communicate all deployments, system outages, cyber review requirements, hardware or platform requirements changes, etc. with all required NNSA/DOE IT resources, as determined by COR.

Quarterly customer and stakeholder feedback and Program Review Meetings

Failure to properly communicate and coordinate with NNSA/DOE IT will result in a verbal warning; second, will received a negative CPARS rating for this deliverable below a Satisfactory; and the third occurrence may result in termination for default.

Effective Communication at NNSA, DOE, CPSO, & Site Level

5.0

6.0

The contractor will be required to attend and actively participate in all regularly scheduled meetings, sprint planning sessions, requirements

Quarterly customer and stakeholder feedback

Verbal warning will be given for the contractor not having representation during these meetings. Second occurrence will result with a negative CPARS rating below Satisfactory. Third occurrence within the period of performance may result in a termination for default.

P a g e | 27

Requirement/ Deliverable

PWS

Reference

Minimum Performance

Standard

Assessment Methods (Random sampling, periodic sampling, visual exam, trend analysis, customer complaint, reports, 100 % sampling)

Impacts & Incentives gathering sessions, etc.

Documentation Gathering

3.0 B, E All requirements, design documents, meeting minutes, and documents as requested by the COR will be uploaded into Azure DevOps.

Periodic sampling of Azure DevOps

Verbal warning will be given for information not being uploaded to Azure DevOps. Second occurrence will result in a negative CPARS rating below Satisfactory.

Third occurrence within the period of performance may result in termination for default.

All functionality will be tested for bugs, spelling, grammar, etc. by the contractor prior to being deployed to stage and production.

Any issues shall be identified and backlogged/ communicated to

4.0 G-H Bugs/defects are

defined in section 10.0, B of this document.

Stage deployments:

• Should contain no more than three unknown critical or high bugs/issues, and no more than

User Acceptance Testing, CATS Support Reporting, and analysis of backlog

Stage deployments involving more than three critical bugs will result in a verbal warning for the first two occurrences and a negative CPARS rating for the third occurrence within the period of performance.

Any critical bugs that were previously reported during UAT and not corrected prior to production deployment (unless approved by COR) will result in a verbal warning for the first occurrence; a negative

P a g e | 28

Requirement/ Deliverable

PWS

Reference

Minimum Performance

Standard

Assessment Methods (Random sampling, periodic sampling, visual exam, trend analysis, customer complaint, reports, 100 % sampling)

Impacts & Incentives the government prior to the stage/ production deployment.

three spelling/grammar errors, etc.

• All critical bugs/issues identified as well as all spelling and grammar errors shall be corrected prior to being deployed to production (unless otherwise approved by COR).

• All high bugs/issues identified must have a viable solution/work-around in place prior to being deployed to

CPARS rating for the second occurrence;

and may result in…