B02-HQ0423-20-C-0006_Award_Monarch-Bilateral.pdf

SEE ADDENDUM

(No Collect Calls)

HQ042320R0048 31-Jul-2020

b. TELEPHONE NUMBER

614-701-2782

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 12 Aug 2020

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

X

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.410-844-9095

HQ04239. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

HQ042320C0006 01-Sep-2020

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

NEVAE L. ROBERSON

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

REF: 00000849

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

NITYV20AC443

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

See Schedule $422,100.00

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS: SEE SCHEDULE

.10-Aug-2020 YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE 7QKG2 FACILITY

OFFEROR CODE

DEFENSE FINANCE AND ACCOUNTING SERVICE

CONTRACT SERVICES DIRECTORATE

BLDG 21/ 2B218

3990 EAST BROAD STREET

COLUMBUS OH 43213-1152

IMMERSION CYKOR, LLC

CYKOR

DANIELLE LEMEK

100 CATHEDRAL ST STE 9

ANNAPOLIS MD 21401-2702

DEFENSE FINANCE AND ACCOUNTING SERVICE

ATTN INVP DAFS

8899 EAST 56TH STREET

INDIANAPOLIS IN 46249-1510

18a. PAYMENT WILL BE MADE BY CODE HQ0347

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE

SEE ITEM 9

15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

X SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

614-701-2918FAX:

TEL: 614-701-4927 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$41,500,000

NAICS:

511210

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

Brandy Bennaman, VP Operations 08/25/2020 Stephanie Smith

614-701-2787 stephanie.n.smith60.civ@mail.mil

08/25/2020

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

HQ042320C0006

Section SF 1449 - CONTINUATION SHEET

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) Reduce Legacy Systems (RLS) Solution Systems Initiative - Retirement of Online Report Viewing (OLRV) with Corporate Electronic Document Management System (CEDMS)

Enhancement

1.0 Background Information

In September 2019, DFAS began identifying Solution Systems with functionality that are included in the DFAS FM Roadmap to support the Business Environment Modernization (BEM) effort. The migration of systems within this category supports the overall FM Functional Strategy and priority to simplify the FM environment. OLRV was the first Solution System addressed as its’ end-of-life is scheduled for December 2020, and DFAS continues to manage volatility in the OLRV operating environment.

In order to support the Monarch Automator application’s ability to take in raw data from source systems and convert into reports that are published to SharePoint the DFAS Development team needs knowledge regarding how to best model reports. DFAS currently has over 15,000 different models that are used in OLRV today that are applied to over 41 million documents, consisting of 8 Terabytes of data that needs to be migrated from our existing environment to a new environment within the CEDMS boundary that will support the new CEDMS Monarch SharePoint solution. These models need to be rebuilt in Monarch and DFAS needs training/knowledge/information to learn the best practices and most efficient methods for modeling.

2.0 Scope

The scope of the requirement is to provide professional services and Monarch software licenses to DFAS. The software project planning and design are described in section 4 of this PWS. The software installation, testing, training, maintenance, and support are described in section 4.

Paragraphs 3.1, 3.2, 4.2, and 4.5 of this PWS include requirements for the Contractor to provide certain Professional Services support work. Some Professional Services support work will be required and requested by the COR ad hoc. When required by the government, the Contractor shall provide partial days (i.e. 1 hour increments) of Professional Services support work. For partial days, 8 incremental hours of professional services must be provided before a full day is realized and decremented from the total number of days provided in this contract for Professional Services support work. Unless directed otherwise by the COR, the Contractor shall use remote methods (Screen sharing, conference calls/telecommunications, email, etc…) to provide Professional Services support work (e.g., conduct training, knowledge sharing, etc...). When required by the government, the Contractor shall provide partial training days (i.e. 1 hour increments) of Professional Services support work The Contractor will only invoice Professional Service support work after the services are provided and deliverables are accepted. Professional Services support will not be paid in advance.

Performance Objectives/Tasks

3.0 The Contractor shall provide Professional Services support towards developing software solution options, strategies, designs, and plans.

3.1 Consulting: The Contractor shall provide professional consulting services to DFAS on Monarch Automator software and tools. The services shall be provided as part of Professional

Service support (para. 2.0). In delivering these services, the Contractor shall conduct research on better methods to utilize Monarch Automator software and tools in DFAS. The Contractor shall provide advice and feedback (written or oral) on system performance issues and attend meetings discussing such issues. The Contractor shall advise on DFAS’s use of the Monarch products and services including reviewing documentation. The Contractor shall interpret data generated as an output of the Monarch Automator software and toolset as well as prepare reports and documentation to facilitate DFAS’s use of licensed Monarch products and services. The professional consulting services the Contractor provides shall include design testing strategies and assisting Partner’s Customer to carry out testing of DFAS’s use of licensed Monarch Automator software and services as well as implementation of said items.

The Contractor shall develop strategies to improve DFAS’ use of the licensed Monarch Automator software and services in a manner that is relevant to DFAS’s business. The Contractor shall transfer knowledge to DFAS to improve its ongoing use of the Monarch products and services (including providing ad hoc question and answer sessions regarding Partner’s Customer’s configuration options and practices). The Contractor shall provide ad hoc guidance and support to DFAS regarding the Monarch products and services. The Contractor shall also provide technical support of and guidance for administration of Monarch Automator software, including technical support of and guidance for optimization of tools and functions.

Advisory for Monarch Automator Modeling Functionality: Contractor shall provide professional technical services, including technical guidance, advice and assistance to identify best practices for Monarch Automator modeling capability and functionality. The Contractor shall provide specific analysis of existing models being utilized in DFAS’ OLRV system today and best practice approaches for consolidation, reuse, and redevelopment into the future CEDMS Monarch SharePoint environment.

Contractor shall provide professional technical services, including technical guidance, advice and assistance for Monarch Automator capability and functionality:

* Model Building

* Script building

* Process building and optimization

* Meta Data Optimization

* Manifest and lookup file building

Contractor shall provide professional technical services, including technical guidance, advice and assistance for Monarch Automator capability and functionality to implement the following Use Cases:

* Burst

* Model

* PDF

* FileHandler

* Multi Model

* Burst Model

* Burst Multi Model

* Model Based Recognition

* Additional Use Cases that we may discover as we dive into our current OLRV servers that need to be migrated to the new solution

Contractor shall provide professional technical services including technical guidance, advice and assistance for Monarch Automator capability and functionality to standardize Monarch Processes for each use case described in the paragraph above.

Contractor shall provide professional technical services including technical guidance, advice and assistance for Monarch Automator capability and functionality to optimize Monarch Environment:

* Manifests

* Scripts

* Minimize Processes

* Load Balancing setup

* Failover setup

* Error handling

3.2 Advisory for LC/AEM Architecture and Implementation: The Contractor shall provide professional technical advice and guidance for architectural planning, installation, and configuration of Monarch Automator in a secure DoD environment (this includes capacity and license planning). The services shall be provided as part of Professional Service support (para.

2.0). The Contractor shall review and advise on backup and recovery practices of Monarch Automator on Windows Monarch servers with SQL databases on Windows. The Contractor shall advise and support DFAS administrators to improve the existing backup and recovery strategy and practices. The Contractor shall advise and support DFAS with performance tuning and capacity planning issues with Monarch Automator on Windows Monarch servers with SQL databases on Windows. The Contractor shall advise and support DFAS with administrative maintenance support best practices, including purge processes, for Windows based Monarch server products. The Contractor shall also advise DFAS on the use of Public Key Infrastructure (PKI) code in support of Monarch Automator.

Technical Architecture Assessment (TAA): The Contractor shall perform an assessment and evaluation of current DFAS use and configuration of Monarch Automator software and documents its results in a report. The results of the analysis shall include written report and oral presentation of recommendations for best practices regarding application design and operation.

Report shall be completed within 30 days of award. This shall include recommendations on linking to database/web servers for SQL and Microsoft products.

Advisory for Monarch Automator Architecture and Implementation: Contractor shall provide professional technical services to create technical advisory guidance, advice and assistance to identify best practices for Monarch Automator installation, configuration, capacity and license planning, backup and recovery, performance tuning, maintenance/purge processes.

4.0 The Contractor shall provide software items and services to assist the government install, operate, and maintain the software.

LINE

NUMBER PART NUMBER DESCRIPTION QTY

KW-SRVR-AUTO-AN Altair Monarch Server

- Automation Edition Subscription Service – Lease

Monarch Automater Server Subscription licenses for unlimited users in Production environment - Base Year 2 EA

KW-MON-SRVR-SRVRAUTO-1P-ADD-AN-

A Altair Monarch Server - Automation Edition Subscription, Single Process Add-On – Lease

Altair Monarch Server - Automation Edition Subscription, Single Process Add-On - Lease - Base Year 40000 EA

LINE

NUMBER PART NUMBER DESCRIPTION QTY

3 KW-MON- Professional Services Monarch Professional Services 16 days Base Year 16 Day

KW-SRVR-AUTO-AN Altair Monarch Server

- Automation Edition Subscription Service – Lease

Monarch Automater Server Subscription licenses for unlimited users in Production environment - Option Year 1 2 EA

KW-MON-SRVR-AUTO-TEST-R Altair Knowledge Works Auto Server Subscription(Test/dev)

Altair Automater Test /Development Server Subscription Renewal Option Year 1 1 EA

KW-MON-SRVR-SRVRAUTO-1P-ADD-AN-

A Altair Monarch Server - Automation Edition Subscription, Single Process Add-On – Lease

Altair Monarch Server - Automation Edition Subscription, Single Process Add-On - Lease Option Year 1 40000 EA

KW-MON-COMP-SUBR. Monarch Complete Desktop Subscription Renewal

Altair Monarch Complete Desktop Subscription Renewal – Option Year 1 148 EA

KW-MON-COMP-ADD-CNV-AN. COM

Automation Add On for Monarch Subscription Renewal

Altair Monarch Com Auto Add-on Subscription Renewal – Option Year 1 4 EA

KW-SRVR-AUTO-AN Altair Monarch Server

- Automation Edition Subscription Service – Lease

Monarch Automater Server Subscription licenses for unlimited users in Production environment - Option Year 2 2 EA

KW-MON-SRVR-AUTO-TEST-R Altair Knowledge Works Auto Server Subscription(Test/dev)

Monarch Automater Server Subscription licenses for unlimited users in Pre-Production environment -Lease Option Year 2 1 EA

KW-MON-SRVR-SRVRAUTO-1P-ADD-AN-

A Altair Monarch Server - Automation Edition Subscription, Single Process Add-On – Lease

Altair Monarch Server - Automation Edition Subscription, Single Process Add-On - Lease Option Year 2 40000 EA

KW-MON-COMP-SUBR. Monarch Complete Desktop Subscription Renewal

Altair Monarch Complete Desktop Subscription Renewal – Option Year 2 148 EA

KW-MON-COMP-ADD-CNV-AN. COM

Automation Add On for Monarch Subscription Renewal

Altair Monarch Com Auto Add-on Subscription Renewal – Option Year 2 4 EA

KW-SRVR-AUTO-AN Altair Monarch Server

- Automation Edition Subscription Service – Lease

Monarch Automater Server Subscription licenses for unlimited users in Production environment - Option Year 3 2 EA

KW-MON-SRVR-AUTO-TEST-R Altair Knowledge Works Auto Server Subscription(Test/dev)

Monarch Automater Server Subscription licenses for unlimited users in Pre-Production environment -Lease Option Year 3 1 EA

KW-MON-SRVR-SRVRAUTO-1P-ADD-AN-

A Altair Monarch Server - Automation Edition Subscription, Single Process Add-On – Lease

Altair Monarch Server - Automation Edition Subscription, Single Process Add-On - Lease Option Year 3 40000 EA

LINE

NUMBER PART NUMBER DESCRIPTION QTY

KW-MON-COMP-SUBR. Monarch Complete Desktop Subscription Renewal

Altair Monarch Complete Desktop Subscription Renewal – Option Year 3 148 EA

KW-MON-COMP-ADD-CNV-AN. COM

Automation Add On for Monarch Subscription Renewal

Altair Monarch Com Auto Add-on Subscription Renewal – Option Year 3 4 EA

KW-SRVR-AUTO-AN Altair Monarch Server

- Automation Edition Subscription Service – Lease

Monarch Automater Server Subscription licenses for unlimited users in Production environment - Option Year 4 2 EA

KW-MON-SRVR-AUTO-TEST-R Altair Knowledge Works Auto Server Subscription(Test/dev)

Monarch Automater Server Subscription licenses for unlimited users in Pre-Production environment -Lease Option Year 4 1 EA

KW-MON-SRVR-SRVRAUTO-1P-ADD-AN-

A Altair Monarch Server - Automation Edition Subscription, Single Process Add-On – Lease

Altair Monarch Server - Automation Edition Subscription, Single Process Add-On - Lease Option Year 4 40000 EA

KW-MON-COMP-SUBR. Monarch Complete Desktop Subscription Renewal

Altair Monarch Complete Desktop Subscription Renewal – Option Year 4 148 EA

KW-MON-COMP-ADD-CNV-AN. COM

Automation Add On for Monarch Subscription Renewal

Altair Monarch Com Auto Add-on Subscription Renewal – Option Year 4 4 EA

KW-SRVR-AUTO-AN Altair Monarch Server

- Automation Edition Subscription Service – Lease

Monarch Automater Server Subscription licenses for unlimited users in Production environment -option for potential increased demand 1 EA

KW-MON- Monarch Complete Desktop

COMP-AN

Monarch Complete Desktop – option for potential increased demand 50 EA

KW-MON- Monarch Complete Desktop

COMP-AN

Monarch Complete Desktop – option for potential increased demand 100 EA

4.0.1 The Contractor shall provide software that is in compliance with the latest DoDI

8510.01 Risk Management Framework, DISA Security Technical Implementation Guides (STIG)s security policies, and NIST SP 800-53 (Security & Privacy Controls for Federal Information Systems and Organizations) supporting Information Assurance..

National Information Technology Laboratory (Computer Security Resource Center) NIST Website: https://csrc.nist.gov/publications/sp https://csrc.nist.gov/publications/sp

Defense Information System Agency - DISA: Home Page https://disa.mil/ Cloud computing information, Enterprise Email, and Anti-Virus.

DISA Security Technical Information Guides: Page https://cyber.mil/stigs/compilations/

The contractor shall provide software that can readily be configured to avoid any CAT 1 to Critical Cat 2 STIG violations without any degradation in software functionality or performance.

Any STIG violations discovered prior to acceptance must be adjudicated without degradation in software functionality or performance before the software is determined as conforming and accepted. The contractor shall continue to provide support to DFAS to resolve any additional STIG violations after acceptance through the base period and option periods. Additionally, the contractor shall promptly resolve through successful adjudication any STIG violations that the only the OEM, contractor, or successor party has the ability to fix through the base period and option periods.

4.1 Software Installation and Testing:

The Contractor shall provide support during installation and initial implementation of the software. The services shall be provided as part of Professional Service support (para. 2.0).

4.1.1 Installation support includes: software installation plan, and configuration documentation shall be provided when new software releases are provided.

The Contractor shall perform the below tasks:

4.1.2 Software installation, patching and upgrade to the most current secure software version, and standard configuration in the DFAS target deployment environment,

4.1.3 Software that operates fully within DFAS environment and in compliance with all DoD security controls which includes and are not limited to NIST, FISCAM, Risk Management Framework (RMF).

4.1.4 Assist with design, implementation, and testing of backup and recovery and disaster recovery (COOP) of software and repository data.

4.1.5 Implementation of Public Key Infrastructure (PKI) web and desktop client Common Access Card (CAC) access in accordance with (IAW) DoD security controls. As required vendor will provide any PKI modules to satisfy DoD PKI requirements.

https://disa.mil/

4.1.6 Verify that all core software functions operate correctly and without errors to include starting and stopping the software, accessing from web and client toolsets, and accessing all core components of the product.

4.1.7 Verify that all logging in the Application is set properly and operational.

4.1.8 Provide status updates to the COR on a weekly basis and when milestones are hit. This will make sure the COR is informed that the project is moving forward.

4.2 Configuration Support:

The Contractor shall perform the below tasks:

4.2.1 Configure the software lifecycle workflows as directed.

4.2.2 Provide post configuration professional service support to include, confirming that all software meets DFAS software development workflow requirements and assist in moving the initial projects over to the new tool.

4.2.3 Verify that all core software functions still operates correctly and without errors and verify new functionality added via configuration support works correctly and without errors.

4.2.4 The Contractor shall guide DFAS staff through each configuration step. The vendor may not have full access to the system. A DFAS employee will be available to work with the vendor.

4.2.5 The services shall be provided as part of Professional Service support (para. 2.0).

4.3 SOFTWARE MAINTENANCE:

4.3.1 The Contractor shall provide Software maintenance that:

• enables the Software installed for operational to continue to perform as intended;

• preserves the software’s integrity when the software is modified;

• includes improvements, implementation, migration, and related activities;

• addresses defects;

• improves reliability, performance, or other attributes;

• addresses security vulnerabilities;

• enables the product to run in the DFAS environment;

• diagnoses and corrects latent errors in the code, including fixes to new or preexisting security vulnerabilities;

• modifies software to improve its performance, functionality, or maintainability;

• provides roll back capability;

4.3.2 The Contractor shall provide progress status updates as the software is being developed.

This includes but not limited to milestone charts/reports, change logs, defects found, and bugs.

The Contractor will inform DFAS of the above information before the start of the release followed by an update at halfway point of development. An update will be provided when the software development is completed and then when testing has been completed. This will keep DFAS informed of the changes that are to be released.

4.3.3 The Contractor shall provide software updates for its software via downloads from its software distribution or support website, which will be installed by DFAS staff.

4.3.4 The Contractor shall provide Software Maintenance that includes security patches throughout the performance of the contract.

4.3.5 Software maintenance shall be included in the purchase price of the license for the base year period of performance and all of the option years 1-4 excercised by DFAS for software licensing listed in the software table (para 4.0).

4.3.6 As part of software maintenance the contractor shall provide Corrective Maintenance -diagnosis and correction of latent errors in the code; this includes fixes to new or pre-existing security vulnerabilities.

4.3.7 As part of software maintenance the contractor shall provide Adaptive Maintenance -modification to keep software usable when running in a new system environment.

4.3.8 As part of software maintenance the contractor shall provide Perfective Maintenance

- modification of software after delivery to improve its performance or maintainability;

provide new or improved functionality, reliability, or performance.

4.3.9 The Contractor shall provide perfective maintenance upgrades or patches, as agreed upon between the COR and contractor, depending on number and severity of software defects and severity of any security vulnerabilities.

4.4 CUSTOMER SUPPORT:

The Contractor shall provide real time customer support for its product by providing a phone number and/or email address for product support issues. Product support shall include access to a self-service web portal containing documentation, how-to guides, best practices, and troubleshooting checklists. Self-service portal may allow creation of support request tickets and remote communication via email or online collaboration for lower priority issues. However, escalation for higher priority issues resulting in on-site support staff will be available.

Response times begin when the Contractor receives a support request from DFAS. The contractor shall respond according to the Severity Levels described below:

1. Critical

a. Any event or combination of events, which causes a 100% loss of system availability. Response may be telephone or on-site.

b. 30 Minutes

2. High

a. Any event or multiple events causing a continuous or chronic impact to service.

b. 2 Hours

3. Medium

a. Any event or multiple event indication with the potential to cause a service impact.

b. 4 Hours

4. Non-Service Affecting

a. A condition having no immediate impact on customer service but requiring maintenance action.

b. Next Business Day

4.4.1 Standard Support Services: The Contractor shall provide standard maintenance and support as part of their license agreement that would include (1) telephone or email support from Monday through Friday during normal business hours, except public holidays for general support issues such as configuration, application security, application Security Technical Information Guidance (STIG), application communication, application authentication, application performance; (2) maintenance releases of the software through releases, bug fixes, corrections, enhancements, as updates and new releases to the Software; and (3) notification of product problems and solutions.

4.4.2 Premium Services: The Contractor shall provide telephone or email support after normal business hours for 24 hours/day x 7 days/week coverage .

4.4.3 Plan of Action and Milestones (POAM): Contractor shall provide a detailed (POA&M), for problems reported through Trouble Tickets.

4.5 TRAINING:

4.5.1 The Contractor shall train 10-16 employees designated by the Government. The Contractor shall provide all training materials. The services shall be provided as part of Professional Service support (para. 2.0).

4.5.2 The Contractor shall schedule all training through the COR.

4.5.3 The Contractor shall provide Software configuration and administration training and education support that describes (at a minimum), how to:

• Install, Configure, Maintain (patch and upgrade) the software and repository IAW DoD RMF and STIG security requirements within a DoD environment. In addition, configure, and maintain the Software and repository data within DoD environment;

• Leverage contractor and industry best practices to more effectively utilize the toolset; and

• Employ best practices concerning backup, recovery, and disaster recovery solutions

5.0 Constraints

5.1 Contractor shall provide professional technical services during existing operating hours.

5.2 Place of Performance: Unless directed otherwise by the COR, the Contractor shall use remote methods (Screen sharing, conference calls/telecommunications, email, etc…) from the Contractor’s facility to provide Professional Services support work (e.g., conduct training, knowledge sharing, etc...) to Government employees. By exception, when required as determined by the COR and after travel under the contract is negotiated through the contracting officer,some services may may be required at a DFAS site.

If training is conducted at a DFASsite, the site will have:

• Classrooms with suitable computers and audio-visual equipment for the sessions.

• Connectivity to any Monarch training servers/environments will be provided for students to our environment

5.3 Security Requirements: The Contractor will not have direct access to any functions. A government Database Administrator (DBA) will be provided and present for system operations.

The Contractor will not be issued a Common Access Card (CAC) for system access, nor passwords to access any system that is owned by the Defense Finance and Accounting Service (DFAS). The Contractor will be issued a visitors badge when entering the DFAS properties, and will be escorted at all times.

5.4 Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

6.0 Deliverables

Description PWS reference

Frequency Date of first submission

Date of subsequent submission

Consulting documents

3.1 Ongoing throughout

migration

Initial findings/advice 30 calendar days after effective date of contract.

Monthly update on any deltas or new findings learned about during migration.

Architecture Implementatio n documents

3.2 To be agreed upon

between the Requirement Owner & contractor

30 calendar days after effective date of contract

N/A

Technical Architecture Assessment

(TAA)

3.2 One submittal 30 calendar days

after effective date of contract

N/A

Premium Service documents

3.3 One submittal To be agreed

upon between the Requirement Owner & contractor

N/A

Software licenses

4.0 One submittal 10 calendar days

after effective date of contract

N/A

7.0 Inspection and Acceptance

7.1 The DFAS System Manager will review the deliverables. If adequate according to the DFAS System Manager, the DFAS System Manager will advise the contractor and the COR and the deliverable will be considered acceptable.

7.2 The Contractor shall resubmit corrected deliverables in writing (email is OK, and the Contracting Officer should be copied) within business 5 days of notification of deficiencies by the Government. The Notice of deficiencies should be specific enough for the contractor to idenfity the deficiency.

Task Acceptable Level of Performance (ALP)

Monitoring Method Revisions/changes

Service – Timeline Contractor completes the tasks NLT the schedule identified in the quote.

COR or COTR will monitor performance.

COR or COTR will identify whether ALP is achieved. The COR will provide feedback in writing within 5 business days.

The contractor shall provide revisions/changes to the deliverables NLT 5 business days from requested date.

Service – Quality Contractor COR or COTR will The contractor shall

Task Acceptable Level of Performance (ALP)

Monitoring Method Revisions/changes successfully executes outcomes identified in the Call monitor performance.

COR or COTR will identify whether ALP is achieved. The COR will provide feedback in writing within 5 business days.

provide revisions/changes to the deliverables NLT 5 business days from requested date.

Customer Support Contractor shall provide customer service support 24 hours per day/7 days per week/365 days per year. see section 4.5.

COR or COTR will monitor performance.

COR or COTR will identify whether ALP is achieved. The COR will provide feedback in writing within 5 business days.

N/A

Licenses Meet form, fit, and function requirements

COR or COTR will monitor performance.

COR or COTR will identify whether ALP is achieved.

N/A

8.0 Government Furnished Property/Equipment/Material

8.1. Training Services: The Government will provide:

• Classrooms with suitable computers and audio-visual equipment for the sessions.

• Connectivity to our LiveCycle servers will be provided for students to our environment

8.2 Facilities: The Government will provide:

• When performing services at a Government site, the necessary workspace for the

Contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

9.0 Place/Period of Performance:

9.1 The place of performance will occur in the following location(s):

• Contractor facility

• By exception, Professional Services provided at:

o Defense Finance and Accounting Services, 3900 East Broad Street, Building 21, Columbus, OH 43229

9.2 The period of performance shall be for one (1) Base period and four one-year periods.

Base Period 09/01/2020 to 06/29/2021

Option Period 1 06/30/2021 to 06/29/2022 Option Period 2 06/30/2022 to 06/29/2023 Option Period 3 06/30/2023 to 06/29/2024 Option Period 4 06/30/2024 to 06/29/2025

10.0 Applicable Documents & Policies

10.1 The Contractor must abide by all applicable Federal, DoD, and DFAS regulations, publications, manuals, and local policies and procedures.

11.0 Supplementary Engagement Notices

11.1 Disclosure of Information. Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without a written authorization from the COR.

The Contractor agrees to assume responsibility for protecting the confidentiality of all Government records, which are not public information. Any employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed only for a purpose and to the extent authorized therein.

11.2 Limited Use of Data. Performance of this contract may require the Contractor to access and use data and information proprietary to a Government agency which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government. Contractor and contractor personnel shall not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government, except to an authorized Government personnel or upon written approval from the COR. The Contractor shall not use, disclose, or reproduce data that bears a restrictive legend, other than as required in the performance of this effort. Nothing herein shall preclude the use of any data independently acquired by the Contractor without such limitations.

11.3 Commercial License. Commercial license rights apply to software, in accordance with FAR 52.227-19 Commercial Computer Software (Dec 2007). This clause gives DFAS and DoD Components the right to use software for Monarch software functionality. This also allows the license holders the right to use software in DFAS and DISA testing or evaluation facilities.

11.4 Personal Service. It has been determined that use of the contract in order to satisfy this requirement is in the best interest of the Government, economic and other factors considered, and this contract is not being used to procure personal services prohibited by the FAR Part 37.104, Personal Services Contracts.

11.5 Information Assurance. Contractor personnel performing one or more cybersecurity function identified in DoD 8570.01-M Information Assurance Workforce Improvement Program, regardless of contract labor category, must comply with the cybersecurity requirements listed in the manual.

11.6 Privacy Act. Work under this PWS requires that personnel have access to Privacy Information. Contractor personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable DoD rules and regulations.

11.7 Documentation Submission. Unless otherwise directed in writing by the COR, the Contractor shall submit all documentation digitally via email or an agreed upon medium.

12.0 Security Requirements.

12.1 Security Requirements. Contractor personnel will follow the security and training requirements in DFAS 2000.1, “Force Protection Program,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” and DFAS 5200.1-I, “Information Security Program.”

Contractor personnel will follow all host security requirements in accordance with DoD 5220.22- M, paragraph 6-105. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), Contracting Officer Representative (COR) and the Personnel Security Office.

12.2(a) DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information.

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R.

731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at http://ogc.osd.mil/doha/SEAD4_20170608.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities. However, in all cases DFAS Personnel Security has the authority to, and will make every effort to, afford contractor personnel the same due process rights as those otherwise afforded to federal civilian employees or NISP contractors, unless the nature of the incident in question is so egregious as to warrant the immediate removal of the contractor employee from their position with DFAS.

12.2(b) Incident Reporting Requirements. Whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, a report shall be made immediately following the incident, or as soon as practicable thereafter, to their DFAS civilian supervisor and the supervisor, if there is one, of the area to which they are assigned, the COR, and in all cases, the Personnel Security Office.

Reporting to Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil , or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information http://ogc.osd.mil/doha/SEAD4_20170608.pdf mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil regarding the incident forwarded to the Department of Defense, Consolidated Adjudications Facility (DoD-CAF) for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States;

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

12.2(c) Examples of Incidents That Require Reporting to Personnel Security:

a. An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This includes Driving Under the Influence of Alcohol or Drugs, and Reckless Driving;

b. Violation of any court order;

c. Delinquencies on any debt for 180 days or longer;

d. Federal, State or Local tax issues or delinquencies;*

e. Delinquencies on any Federal debt;*

f. Child Support delinquencies;

g. Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court;

h. Having a close personal friendship with a Foreign National (person from a foreign country) with regularly occurring contact;

i. Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee; and

j. Ownership of property or financial accounts in a foreign country.

* It should be noted that persons delinquent on Federal debt of any kind may not obtain or maintain a favorable personnel security adjudication, or be considered for a contractor position with DFAS, unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

This list is not all-inclusive; any incident in which a contractor is involved in and unsure as to whether it should be reported should report the incident to Personnel Security, who will then determine if further action is warranted.

12.2(d) Security requirements for Foreign Travel by DFAS Contractor Personnel While employed as a contractor for DFAS, any contractor employee traveling outside* the continental United States, whether on Official U.S. Government Business or personal time, is required to complete a DFAS Form 9133, Notification of OCONUS Travel, not less than fourteen (14) calendar days prior to the scheduled travel. One copy shall be sent the DFAS Personnel Security groupbox at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Security/Force Protection Office of the DFAS site where they are stationed. Upon receipt of the completed Form 9133, the Site Security/Force Protection Office will contact the contractor employee and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

*This requirement does not apply to travel to Alaska, Hawaii, or any U.S. territory.

12.3 Security Education and Training. Contractor personnel will receive initial, continuous and refresher security education training in accordance with DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” and DFAS 5200.1-I.

Contractor personnel will also complete all required contractor training requirements identified in this Statement of Work.

12.4 Access To, Accountability For, and Safeguarding Of Classified Information and Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel will safeguard CUI in accordance with DoDI 5200.48, “DoD Controlled Unclasssified Information” and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

13.0 Installation Entry and Common Access Card (CAC) Requirements.

13.1 The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

13.2 All contractors who require unescorted access to DFAS facilities will be required to obtain a DoD CAC. Contractor will work with the assigned DFAS Contracting Officer Representative (COR)/Trusted Agent (TA) to obtain a CAC using the Trusted Associate Sponsorship System (TASS). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html

13.3 All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/TA upon departure from the program or at the conclusion of the contract, whichever comes first. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/TA and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/TA will follow agency CAC procedures in order to issue a new CAC.

13.4 The CAC contains personally identifiable information (PII) and must be treated as a controlled item. Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/TA will report any violation or suspected violation to the Contracting Officer and DFAS Trusted Agent Security Manager (TASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from a previous engagement with another agency that CAC must be returned to that agency before issuance of a new CAC.

14.0 Training.

14.1 DoD Mandatory Contractor Personnel Training Requirements: Also referred to in this document as DFAS SPIRIT Training, the contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

14.1.1 Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

14.1.2 In addition, these modules shall be completed annually to retain accessibility.

Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

a. Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

b. Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available from Defense Information Systems Agency (DISA) “Online IA Training” link at:

http://iase.disa.mil/eta

Upon completion of the training Contractor personnel will maintain a copy of the training certificate in PDF, submit a copy to the Contracting Officer Representative (COR), attached to the request for network access as proof of completion.

http://iase.disa.mil/eta

c. DFAS Force Protection's Virtual SPIRIT Conference (SPIRITCON) 2018.

Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

d. Antiterrorism Level One. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

e. Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

f. Combating Trafficking in Persons (CTIP) Awareness Training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

http://ctip.defense.gov/

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

g. Records Management. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

h. Insider Threat (InT) Awareness Training. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

NOTE: This list of training requirements is subject to change.

14.2 Training Time: The average estimated time for completion of each training module is approximately one hour or less. The DFAS Force Protection's Virtual SPIRIT Conference (SPIRITCON) 2018 will take approximately 90 minutes to complete.

14.3 Training Methods:

14.3.1 Network Training: Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

14.3.2 Web-based Training: for Cyber Awareness Challenge, Antiterrorism Level One, and Combating Trafficking in Persons (CTIP) Awareness Training: If an individual does not have https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf http://ctip.defense.gov/ network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel will take the training through the DFAS Portal upon receipt of DFAS network. The contractor personnel will retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training.

The COR will maintain a file for proof of…