B08 Attachment 0003 AESD MSP PWS 14 Sep 2021 v.3.pdf

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 1

ARMY ENTERPRISE SERVICE

MANAGEMENT PLATFORM (AESMP)

ARMY ENTERPRISE SERVICE DESK

MANAGED SERVICE PROVIDER TASK

ORDER

PERFORMANCE WORK STATEMENT

Version Date: September 14, 2021

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 2

Table of Contents

1.0 Introduction

2.0 Summary Scope

3.0 Place of Performance and Hours of Operation

4.0 Services to be provided by the Contractor

5.0 Staffing

6.0 Contractor Furnished Equipment

7.0 Government Furnished Equipment (GFE)

8.0 Performance Requirements

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 3

1.0 Introduction

This task order will establish and configure the cloud-based Software as a Service (SaaS) environment to support the Army’s implementation of the Army Enterprise Service Management Framework (AESMF) for service delivery and provide Tier 0 and Tier 1 support of over 1.3M end users for IT services on DODIN-A. The AESMP and service support operations will enable the Army to continue existing Army Enterprise Service Desk (AESD) operations, optimize AESMF-based service delivery processes, and expand the functionality provided by the SaaS environment via optional capabilities which may be exercised over the life of the task order.

2.0 Summary Scope

The Contractor shall provide a scalable and configurable cloud-based SaaS environment that supports the processes and functions defined in the AESMF.

The Contractor shall provide two full service (turnkey) customer service centers capable of supporting AESD’s mission, agents on-site at designed Government locations, functional management including subscriber maintenance, and ongoing operational maintenance of the Army-wide AESMP provided on a SaaS basis for Government and Contractor use under a separate task order.

The turnkey operations shall include all staff, telephony support systems, Workforce Management Systems, and AESMP functional management support. Additionally, the Contractor shall provide project management, ITIL, and onboarding services. The Contractor shall integrate the telephony support systems and designated Government systems with the

AESMP.

All these services are provided from the Contractor's United States-based facilities having network connectivity to the Army NIPR network and from Government furnished facilities at Ft.

Huachuca, AZ; Ft. Shafter, HI; and Camp Humphreys, South Korea which have network connectivity to the Army NIPR/SIPR network. Travel may be necessary to support government requirements.

3.0 Place of Performance and Hours of Operation

The work under this task order shall be performed at the following Government-provided NIPR/SIPR service desk sites augmented by approved contractor-provided NIPR sites and contractor-provided remote agents to meet required service levels.

Facility Type Location NIPR/SIPR

Government-owned and contractor-operated

Ft. Huachuca, AZ

NIPR/SIPR

Ft. Belvoir, VA NIPR/SIPR

Ft. Shafter, HI

Camp Humphreys, South Korea

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 4

Facility Type Location NIPR/SIPR

Contractor-owned and operated

TBD NIPR

TBD NIPR

Remote NIPR

The Contractor shall operate AESD 24x7x365 from a primary contractor location and provide a secondary Contractor location for Continuity of Operations Plan (COOP) in order to confirm continued operations in the event of problems at the primary site. In addition, four SIPR sites are required to support Government operations. The contractor must staff agents at the following three sites: Ft Huachuca, Ft. Shafter and Camp Humphreys. The following Government facilities are available for contractor use:

Ft. Huachuca (up to 28 agent seats) (24x7x365 hours of operation)

Ft. Belvoir (up to 12 agent seats) (24x7x365 hours of operation)

Ft. Shafter (up to 22 agent seats) (24x7x365 hours of operation)

Korea - Camp Humphreys (up to 15 agent seats) (12x5x52 weeks per year hours of operation).

The Ft. Belvoir facility may be substituted by commercial SIPR facilities if the contractor has a facility that meets all current security and technological requirements.

The Contractor shall provide personnel as required in order to support on-boarding for up to 15 onboarding actions per year and may be required to travel to government designated locations to support the new work.

All Contractor personnel providing services and managed capabilities may be considered Emergency Essential, regardless of assigned working location.

4.0 Services to be provided by the Contractor

The Contractor shall provide technical and management services including program management, technology management, information assurance, customer relationship management, workforce management, knowledge management, incident management, performance management, quality assurance/quality improvement, management reporting, contingency/disaster recovery, onboarding, and continuous service improvement.

The Contractor shall stand up AESD-Worldwide (AESD-W), AESD-Pacific (AESD-P), and AESD-Korea (AESD-K) operations and assume within six months of contract award the service and support responsibilities from the incumbent AESD contractor. At 6 months the contractor shall use the AESMP ITSM SAAS for NIPR enterprise services ticketing, while continuing to use the government furnished ESMS and SIPR SIF systems, for NIPR and SIPR C4IM services ticketing, until those government systems are also replaced by the AESMP

ITSM SAAS.

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 5

The Contractor shall comply with the processes defined in the AESMF and configure the AESMP ITSM SaaS for operations supporting the Army. The Contractor shall provide AESMP ITSM SaaS access to authorized end users and enable Army subscribers to use the AESMP ITSM SaaS for AESMF processes that are the responsibility of the Army. On this task order, the government is outsourcing only Tier 0 and Tier 1 service support and is not outsourcing responsibility for the execution of the remaining AESMF processes for Army activities such as Army Asset Management.

The Contractor shall provide the AESMF functionality to Army subscribers with 4 optional capabilities: an optional capability for Discovery & Service Mapping, an optional capability for Business Management, an optional capability for Software Management and an optional capability for Field Service Management. In the table below, the AESMF processes and functions being provided for Army subscriber use are identified by optional capability:

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 6

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 7

From the initial award, the Contractor shall migrate operations and any necessary data to the AESMP ITSM SaaS from:

(1) the ITSM provided by the incumbent AESD contractor supporting NIPR enterprise services ticketing within six months of contract award;

(2) the ITSM known as the ESMS provided by the Government supporting both NIPR and SIPR C4IM services ticketing within one year of contract award; and

(3) the ITSM known as the SIF supporting SIPR enterprise services within one year of contract award.

The migration shall include:

1. Obtaining the Authority to Operate (ATO) for the AESMP ITSM SaaS application in accordance with the Department of Defense (DoD) Risk Management Framework described in DoD Instruction 8510.01 dated March 12, 2014.

Loading, maintaining, and optimizing Government information in the AESMP ITSM SaaS, Training Government Subscribers on use of the AESMP ITSM SaaS, and

Interfacing the NIPR AESMP ITSM SaaS with the contractor provided telephony system and the following NIPR Government systems:

Enterprise Access Management Service-Army (EAMS-A)/Single Sign ON (CAC Access), NETPLUS/TMS (Call Management System), ARCYBER Data warehouse, DISA JRSS, NETCOOL, SPECTRUM, DCOD, ARMS (Scheduling Application) and

Through transition to additional and replacement common services provided by cArmy (See attachment 0034 cArmy Cloud Common Shared Services List).

Please also see Attachment 0030 Current System and Service Profile for understanding of System coverage.

OPTIONAL CAPABILITY FOR ASSET DISCOVERY & SERVICE MAPPING:

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 8

Within 6 months of exercise of the Asset Discovery & Service Mapping optional capability, the Contractor shall configure asset discovery and service mapping capabilities and reconfigure existing asset discovery processes in operation to support the migration for up to 5 NECs, (at a minimum FT Detrick, Ft Drum, and FT Natick NECs). The Contractor shall train Government subscribers on use of the asset discovery and service mapping capabilities. Upon successful implementation for those NECs, the Government will establish a schedule with the Contractor for the Contractor to incrementally train and onboard the remaining ARCYBER/NETCOM/Signal Commands/Brigades/NECs worldwide to the asset discovery and service mapping capabilities in a 1 year period or less.

OPTIONAL CAPABILITY FOR AESMF BUSINESS MANAGEMENT PROCESSES:

When directed by the Government to provide the AESMF business management processes, the Contractor shall expand the configuration and capabilities of the AESMP ITSM SaaS to provide Government subscriber use of the AESMP ITSM SaaS for the execution of the additional AESMF processes and functions identified above. The Contractor shall train subscribers identified by the Government for these additional capabilities. The Government will establish a schedule with the Contractor for the Contractor to incrementally train and onboard ARCYBER/NETCOM/Signal Commands/Brigades/NECs worldwide to the AESMF business management processes in a 1 year period or less.

OPTIONAL CAPABILITY FOR SOFTWARE MANAGEMENT:

When directed by the Government to provide the software management optional capability, the Contractor shall expand asset management capabilities to provide software asset management that enables software license management, integrates with existing discovery capabilities to identify active in-use quantities, supports license use optimization, and provides a summary dashboard of software use activities in comparison to software license positions with supporting drill-downs to individual software licenses status. The Contractor shall train subscribers identified by the Government for these additional capabilities. The Government will establish a schedule with the Contractor for the Contractor to incrementally train and onboard ARCYBER/NETCOM/Signal Commands/Brigades/NECs worldwide to use of the software management capabilities in a six month period or less.

OPTIONAL CAPABILITY FOR FIELD SERVICE MANAGEMENT:

When directed by the Government to provide the field service management optional capability, the Contractor shall provide enhanced mobile device and desktop workspaces enabling field service and technical management tasks to include project estimating, work order assignment to include external 3rd party work assignments, work order scheduling, dispatch and routing of service technicians, onsite equipment scanning and lookup, installation and repair checklists, work order status tracking, and an overall dispatch/work order dashboard. The Contractor shall train subscribers identified by the Government for these additional capabilities. The Government will establish a schedule with the Contractor for the Contractor to incrementally train and

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 9

onboard ARCYBER/NETCOM/Signal Commands/Brigades/NECs worldwide to use of the field service management capabilities in a two year period or less.

OPTIONAL CAPABILITY FOR SECURITY OPERATIONS MANAGEMENT:

When directed by the Government to provide the security operations management optional capability, the Contractor shall provide enhanced IT operations management orchestration that uses workflow, scripting, and automation to enable mass device changes based on CMDB data populated from discovery or other means. This functionality shall enable the Government to identify, prioritize, and remediate device configurations providing proactive, coordinated responses to vulnerabilities or other security concerns.

The Contractor shall provide Information Assurance (IA) services for AESD and its stakeholders. These IA efforts shall enable AESD to achieve its stated missions, goals, and objectives. These include maintaining the IA levels in accordance with DoD and Army policies and regulations; providing subject matter expertise in accordance with the Risk Management Framework (RMF), all aspects of populating and managing eMASS, including artifacts and documents; and other IA policies and regulations. The skill sets and experience levels shall be commensurate with the complexity and challenges of operating in a DoD environment.

The Contractor shall provide account administration and training of the Government-provided BOMGAR technology for use by AESD agents. The Contractor shall provide Systems Administration (SA) services for AESD and its stakeholders. These SA efforts shall enable AESD to achieve its stated missions, goals, and objectives, including system administration and vulnerability management for CAP and GFE within the security boundary for which the Contractor has access and privilege. This includes items, such as installation, upgrading, and monitoring software and hardware; maintaining operating systems, remote access tools (e.g., BOMGAR), security tools, web-servers, local and wide area networking; and troubleshooting software and hardware. Personnel shall have the required training and/or certifications necessary for the various hardware, software, and/or applications operating within the network environment.

The Contractor shall provide a working papers repository allowing unlimited Government Program Office access in accordance with the working papers contract deliverable.

The Contractor shall adjust staffing levels to address projected ticket volume ranges and SLAs/KPIs while providing support for the following services:

Enterprise Services and applications for users located worldwide:

Email for basic class users and the following Commands for other service classes and entitlements:

o NIPR (17 commands for Business Class and above) – AFC, AMC, ARCYBER, ARNORTH, ARSOUTH, ATEC, FORSCOM, IMCOM, NETCOM, UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 10

RESERVES, SMDC, USACE, USAASC, USACIDC, USARPAC, USASOC,

and USMA.

o SIPR (33 commands for Business Class and above) AFC, AFRICOM, AMC, ARCENT, ARCYBER, ARNORTH, ARSOUTH, ATEC, AWC, EUCOM, FORSCOM, GUARD, HRC, HQDA, IMCOM, INSCOM, MDW, MEDCOM, RESERVES, SDDC, SMDC, SOUTHCOM, TRADOC,USAASC, USACE, USANTO-BDE, USACIDC, USAEUR, USARPAC, USARAF, USMA, USMEPCOM, and USASOC.

Defense Mobility Unclassified Capability (DMUC) (Supporting Android/iOS devices) (Purebred/Email+)

Army Knowledge Online (AKO) and AKO-SIPR

Enterprise Content Management Collaboration System (ECMCS)

Army Contracting Command (ACC)

Procurement Automated Data and Document System (PADDS)

Office of the Deputy Assistant Secretary of the Army (Procurement) (ODASA (P)):

o Standard Procurement Systems (SPS) o Virtual Contracting Enterprise (VCE) o Federal Procurement Data System – Next Generation (FPDS-NG) o Army Contract Writing System (ACWS) (Currently Onboarding)

Web Emergency Operations Center (WebEOC)

Army Data Center Consolidation Plan (ADCCP)

Army Training Management System (ATMS)

Army Endpoint Security System (AESS)

US Army Reserve Command, Secure Army Reserve Network (USARC SARNET)

Office of the Administrative Assistant to the Secretary of the Army Migration (OAA)

Installation Management Command, Moral, Welfare, and Recreation Systems Support Division (IMCOM MWR SSD)

Army Futures Command (AFC)

EAMS-A

Army Food Management Information System (AFMIS)

Army Endpoint Management Solution (AEMS)

Electronic Financial Liability of Property Loss (EFLPL)

Army Enterprise Staffing Management System

Reserve Component Automation System (RCAS)

Defense Readiness Reporting System-Army (DRRS-A)

Force Management System (FMS)

Army 365

Army-wide AESMP ITSM SaaS access and maintenance

Army Enterprise Information Technology as a Service Microsoft (AEITaaS-M) (Currently Onboarding)

AEITaaS – Verizon (Currently Onboarding)

AEITaaS – AT&T (Currently Onboarding)

ARCYBER Headquarters G6 (ARCYBER HQS) (Currently Onboarding)

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 11

Virtual Mobile Infrastructure – Bring your own device/NIPR (VMI-B/N) (Currently Onboarding)

Command, Control, Computers, Communications, Information Management (C4IM) for the following command and installations:

93rd Signal Brigade, 7th Signal Command

Mid-Atlantic RNEC: Aberdeen Proving Ground

NE RNEC: Ft. Drum RNEC:Ft.

Campbell

Adelphi (Currently Onboarding) Ft. Devens Ft. Knox

Carlisle Barracks Ft. Dix Stand-alone NECs

RNEC: Redstone Arsenal Ft. Hamilton Ft. Bragg

Detroit Arsenal Natick SSC Ft. Gordon

Rock Island Arsenal Picatinny Arsenal Ft. Benning

SW RNEC: Ft. Stewart West Point Ft. Buchanan

Ft. Jackson RNEC: Ft. Eustis (JBLE)

Ft. Rucker Ft. Lee

106th Signal Brigade, 7th Signal Command

West RNEC: Ft. Carson NE RNEC: Joint Base San Antonio

Camp Hunter-Liggett Ft. Polk

Camp Parks Stand-alone NECs

Dugway Proving Grounds Ft. Bliss

Ft. Huachuca White Sands Missile Range

Ft. Irwin Ft. Hood

Presidio of Monterey Ft. Lewis (JBLM)

Midwest RNEC: Ft. Riley

Ft. Leavenworth

Ft. Leonard Wood

Ft. McCoy

Ft. Sill

21st Signal Brigade, 7th Signal Command

Stand-alone NECs

Ft. AP Hill

Ft. Belvoir

Ft. Detrick

Ft. Meade

Ft. Myer/McNair

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 12

AESD Pacific (311th Signal Command/516th Signal Brigade)

Hawaii Japan

Ft. Shafter Camp Zama

JB Pearl Harbor-Hickman Sagami Army Depot

Schofield Barracks Ft. Buckner/Torii Station

Wheeler Army Airfield Guam

Alaska Andersen Air Base

JB Elmendorf-Richardson Kwajalein

Ft. Greely Bucholz Army Airfield

Ft. Wainwright

SW RNEC: Ft. Stewart

Ft. Jackson

Ft. Rucker

AESD Korea (311th Signal Command/1st Signal Brigade Area NEC’s 1-4)

Area I NECs Area III NECs

Camp Casey Camp Humphreys

Camp Red Cloud K55/Osan Air Base

Camp Bonifas K-51 Kwangju Airbase

Camp Hovey Area IV NECs

Camp Stanley Camp Walker

Camp Kang Sa Ri K2/Daegu Air Base

Area II NECs K8/Kunsan Air Base

Yongsan Garrison Camp Henry

FEDE Compound Camp Carroll

Camp Kim Chinhae Naval Base

K16/Seoul Air Base Pier 8, Busan

CP Tango Busan Storage Facility

Camp Mujuk

Camp Seongju

DLA DRMO

K-1 Gimhae Airbase

The Contractor shall provide Service Management Reporting in the form of dashboards and required deliverables as outlined in the contract. The interactive dashboards shall have the ability to filter, sort, summarize, and drill down for variable periods (such as daily, weekly, monthly, and annually) using real time and historical activity metrics and providing:

Performance against all SLAs/KPIs

Call volume analytics such as calls by queue and type; average handle time by call type; other call attributes captured by the call management system

Email volume analytics such as emails by queue and type

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 13

Ticket volume analytics such as tickets by origination, type, ticket status, mean time to restore (MTTR), VIP ticket handling

Users/seats volume analytics such as by type, organization, new/total, active/inactive

Integrations and interfaces analytics such as by name, type, and data volume.

The Contractor shall provide the necessary personnel and automation to facilitate Continual Service Improvement (CSI) in order to increase efficiency/ improve effectiveness through reduction in mean time to restore, standardization, technology insertion, process optimization, and strategies to move IT support resolution knowledge closer to users/less technical agents.

The contractor shall facilitate process improvement support for, but not expressly limited to:

Active Directory management services

Enterprise service account management services

Desktop Software Delivery to AESD-W

Ad hoc CSI changes/recommendations

Support to 7th Signal Command and CONUS

Support to 311th Signal Command and the Pacific Theater

Project Office Enterprise Email

Defense Enterprise Email (DEE) Support, Defense Enterprise Provisioning Online

(DEPO)

The Contractor shall provide customer relationship management for all supported services and locations in order to establish and maintain positive customer relationships between the Contractor and the organizations supported by AESD.

The Contractor shall provide the Government with a monthly program review of Contractor performance in the past month against established SLAs/KPIs, projected business needs, and other supporting information as detailed in the contract deliverable Exhibit A.

The Contractor shall assist the Government Project Management Office (PMO) to initiate and document a strategic planning process aligned under the service strategy component. This must, at a minimum, provide 6, 12, and 24-month views of a strategic plan. The views shall encompass plans for technological evolution, process improvement, service migration and transition, ATO compliance, and cost performance optimization. The Contractor shall also conduct a quarterly review of the strategic plan while providing summary assessments as detailed in contract deliverable Exhibit A of the past quarter of ongoing continuous improvement projects, onboarding actions, and system/service desk past performance information as obtained from monthly reports and dashboards.

As directed by the Government, the Contractor shall also use additional Government-provided ticketing or service management systems. The Contractor shall execute all AESD operations

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 14

activities to the extent possible given the level of administrative rights and access afforded the Contractor in each Government-provided ticketing or service management system.

When directed by the Government after the initial AESMP ITSM SaaS training provided by the Contractor prior to implementation, the Contractor shall provide Government personnel with training on the configured AESMP ITSM SaaS in accordance with the recommended best practices of AESMP ITSM SaaS tool being provided by the AESMP ITSM SaaS provider.

When performing software or integration development such as configuration and integration of the AESMP ITSM SaaS with Government systems or addition of Government required functionality, the Contractor shall:

4.13.1 Build to the highest abstraction of cloud services in order to meet functional, technical, performance and cost goals. These services include commercial SaaS, Platform as a Service (PaaS), Database Management as a Service, and others to accelerate testing, accreditation and fielding to the Army.

4.13.2 The contractor must use microservices architecture and automation where technically and economically feasible.

4.13.3 Comply with publishing all application programming interface (API) information within the Enterprise Data Services Catalog (EDSC).

4.13.4 Work with Army Future Command (AFC)'s Command, Control, Communications, Computers, Cyber, Intelligence, Surveillance and Reconnaissance Center (C5ISR) to establish Cyber Security Service Provider (CSSP) services (as required by DoDI 8530 and as described by the DISA Cloud Computing Security Requirements Guide) for Army services hosted in commercial cloud.

4.13.5 Ensure that all new and existing applications, systems, or services deemed non-legacy shall expose their data and functionality through service interfaces (for example, OpenAPI specification).

4.13.6 Ensure that all service interfaces, without exception be designed to be consumable from external sources and must plan and design to be able to expose the interface to developers.

4.13.7 Ensure that all Army data assets are registered in the Army Enterprise Data Service

Catalog (EDSC) and comply with Dublin Core Metadata Element Sets and International Standards Organization Metadata Registries requirements.

4.13.8 Ensure that All Army data sources are developed with built-in data exchange capabilities. Data mapping shall also be implemented to increase efficiency and ease of use of data assets as they are being translated or transformed. At a minimum, comply with the Global Force Management Data Initiative ; International Standards for dates; Geopolitical Entities, Names and Codes, Common (GENC); Joint Consultation, UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 15

Command and Control Exchange Data Model ; or Resource Description Framework standards and schemas.

4.13.9 Ensure that all cloud-related costs/price, which include but are not limited to: Cloud

Service Provider (CSP) costs, and cloud Operations and Maintenance (O&M) costs/prices are clearly identified and available for government reporting purposes.

5.0 Staffing

5.1 Staff To Be Provided

The Contractor shall provide qualified personnel in sufficient quantities to perform all tasks, including agents, project management, and support staff. The Contractor shall verify the staff has the appropriate clearances, qualifications, and skills required to perform the tasks. A secret clearance is required for all positions other than Entitlement Managers listed below.

The Contractor shall provide recruiting, screening, hiring, training, and monitoring of staff for all tasks. The Contractor shall facilitate confidentiality of data and conduct security background checks for each employee before an employee receiving work. A Government representative will do the fingerprinting process; however, the Contractor shall facilitate the FBI fingerprinting requirements for each contracted employee.

The Contractor shall require its employees supporting AESD to be citizens or legal residents of the United States. However, local nationals are acceptable at the Korea help desk. Employees must have the ability to speak, read, and write English fluently (Korean required at Camp Humphreys and Japanese at Ft. Shafter, a minimum of 1 agent per shift shall be available to support Korean / Japanese speaking end users ). The Contractor's direct employment of any Korean-National labor for performance of this contract shall be governed by Republic of Korea (ROK) labor law and United States Forces Korea (USFK) regulations pertaining to the direct employment and personnel administration of Korean National personnel.

5.2 Staff Training and Certifications

The Contractor is responsible for training to maintain skills and certifications for their staff and shall verify that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoDD 8140.01, Cyberspace Workforce Management. Contractor employees and sub-contractor employees performing work under this contract and who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR.

The Contractor shall maintain training data in order to confirm compliance for all contractor personnel in ATCTS. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing https://web-mech02.mail.mil/owa/redir.aspx?C=7bSLFWcE4HwCzMCclYAaX0sLGXjvN51XplkyyBFQou-3bLoNk1nYCA..&URL=https%3a%2f%2fatc.us.army.mil

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 16

professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

The Contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/appj/dwc/index.jsp

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

5.3 Information Assurance Training and Documentation

All contractor personnel shall comply with the following mandatory and recurring training requirement for AESD training:

Training Requirement

DoD Cyber Awareness Challenge* Annually

Derivative Classification* + Bi-Annually

Cyber Security Fundamentals Training One-time

Threat Awareness and Reporting Program * Annually

Personally Identifiable Information (PII)* Annually

Operation Security Awareness for Military Members, DoD Employees, and Contractors Course (GS130.16)

Annually+

Anti-Terrorism Level 1 Annually

Information Security Program Training Annually

*Training certificates shall be saved in PDF format and maintained by the Contractor.

+Training required only for personnel having SIPR access or any personnel performing derivative classification.

Contractor personnel shall comply with the following IA documentation requirements for AESMP ITSM SaaS accesses:

Document Requirement

PII Handling and Incident Response Annually Review

AESD PII Purpose and Inventory Annually Review

PEO EIS Cyber PII SOP Annually Review

PII Acceptance Document Annually

Acceptable Use Policy Annually

Privileged Level Access Agreement One-time (no expiration)

In addition to the IA training/certification requirements above, Contractor personnel requiring SIPR access shall complete the following:

Course Requirement

Derivative Classification Training IS 103.06 Initial and Annually Review

Marking Classified Information Initial and Annually Review https://web-mech02.mail.mil/owa/redir.aspx?C=077UrWX4yNSUM6jUJPxmwv_2aSvWGsy-8RAlZTBBMN8YzrwNk1nYCA..&URL=https%3a%2f%2fwww.dmdc.osd.mil%2fappj%2fdwc%2findex.jsp

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 17

Course Requirement

Insider Threat Awareness Training Initial and Annually Review

5.4 Industry Training

Contractors shall, as required, use Army Skillport to complete the MD 100 Windows 10:

Configuring Windows Devices Learning Program. Agents must complete the training and save the certificate.

Contractor personnel performing on this task order are required to obtain Information Assurance Technical (IAT) Level I Certification before beginning support of AESD. The following certifications meet this requirement per DoD 8140.01:

Certification

A+ Continuing Education (CE)

Cisco Certified Network Associate (CCNA)-Security

Network+ CE

Systems Security Certified Practitioner (SSCP)

Agents in Tier 1-2 and above are required to have the ITILv3 or above Foundations certification. If an agent from Tier 1-1 is promoted to a 1-2 position, that employee shall have 90 days from the date of promotion to attain the ITIL Foundations certification. Contractor shall be responsible for verifying the agent attains this certification.

The Contractor shall ensure that all Contractor personnel receive AESMP ITSM SaaS role training/certification applicable to their position as an agent, system administrator, or other AESMP ITSM SaaS maintenance position in accordance with the recommended best practices of AESMP ITSM SaaS tool being provided by the AESMP ITSM SaaS provider.

5.5 Other

Entitlement Manager positions shall have the following qualifications:

Qualification

Must be a U.S. Citizen

Must have a High School Diploma

Completed Trustworthiness/Public Trust investigation

6 months of experience

5.6 Key Personnel

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 18

The following roles are identified as Key Personnel for performance of all tasks. The Government requires one full time Program Manager, one full time Technical Capabilities Manager, and at least one full time Operations Manager (OPSMGR).

The Contractor shall provide complete resumes for key personnel supporting AESD in order to demonstrate alignment of individual skills and experience. In the event a position is vacated, the Contractor will submit a complete resume when they submit the application for a Common Access Card (CAC) for the person replacing the vacated position. Any key personnel position shall not remain vacant for more than 5 calendar days, the Contractor may propose a temporary substitute by providing a resume of the substitute personnel, if the substitute meets or exceeds the qualifications of the personnel being replaced. In addition, the Contractor will supply additional information requested by the Contracting Officer. Proposed permanent replacement personnel should have equal to or superior qualifications to those personnel being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receipt of the required information of the consent on replacement personnel. No change in fixed unit prices may occur because of key personnel substitution. A temporary substitute shall not be in place for longer than 30 business days, before a permanent replacement is found.

Core Competencies for Key Positions -- Key Position candidates, regardless of their particular subject matter expertise, shall have the following capabilities:

The ability to communicate in both oral and written forms, demonstrating an ability to communicate effectively with all levels of staff, as well as clients.

Familiarity with DoD security requirements as applied to their subject matter expertise.

Experience working in an environment similar in size (or larger) and scope to AESD.

Strong working knowledge of large, complex IT environments.

Program Manager (PM) – The Program Manager is defined as having responsibility for oversight of operational planning, establishment, execution, and evaluation of a multifaceted program/project typically consisting of a set of closely related sub-programs or associated activities. The PM should have the qualifications required in accordance with DoDD 8140.01, as well as the following qualifications:

Help Desk Institute Support Center Director (HDI SCD) Certification

ITIL v4 or higher Foundations and ITIL 4 Specialist, Create, Deliver, and Support (CDS)Certified

Secret Clearance

Current Program Management Institute Program Management Professional (PMI PMP) Certification

Oversees fiscal, operational, administrative, and human resources management of the program.

Serves as principal point of representation and liaison with external constituencies on operational matters.

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 19

Provides day-to-day technical/professional guidance and leadership, as appropriate, to

AESD.

The following experience is highly desirable:

Demonstrated excellence in planning, directing, and managing Call Center or sales efforts in a similar sized services organization to AESD

Demonstrated successful management and supervision of employees of various labor categories and skills in efforts similar in size and scope to AESD

Knowledge of industry accepted standards and best practices related to Call Center missions

Demonstrated experience in a DoD IT environment

Experience managing performance-based contract Task Orders and knowledge of Federal Acquisition Regulations (FAR)

Demonstrated ability for oral and written communication with the highest levels of management

Planning, directing, and managing IT projects/operations in an organization similar in size to AESD

Knowledge of industry accepted standards and best practices related to Information Management operations, and ITSM best practices.

Technical Capability Manager – The Technical Capability Manager is responsible for operational planning, implementation, and operation of technical capabilities provided by the Contractor for service desk use, such as the call management, workforce management, and ticketing systems. The Technical Capability Manager shall have the qualifications required in accordance with DoDD 8140.01, as well as the following qualifications:

Secret Clearance

ITIL v4 or higher Foundations or above certification

ITIL 4 Specialist, CDSCompTIA Security+ CE certification or equivalent

At least 4 years overall DoD IT environment and RMF experience

At least 4 years of IT Service Desk management or IT Service Desk operations experience

At least 1 year of experience in planning, directing, and managing large scale

IT operations in an organization similar in size to AESD

Knowledge of industry accepted standards and best practices related to Information Management operations, and with ITSM best practices

Familiarity with AR25-1 and AR25-2

Experience with AESS/HBSS, SCCM, NESSUS Assured Compliance Assessment Solution (ACAS), and POA&M submission

An understanding of DoD culture and standards.

Operations Manager (OPSMGR) – The Operations Manager is responsible for service desk operations and acts as the contractor liaison between the Government PM/COR and the Contractor’s service desk workforce. Provide oversight of the locations, including CONUS and

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 20

OCONUS. This individual will confirm that day-to-day activities are running efficiently and properly. The Operations Manager shall have the qualifications required in accordance with DoDD 8140.01, as well as the following qualifications:

Secret Clearance

ITIL v4 or higher Foundations certification

ITIL 4 Specialist,CDScertification

Help Desk Institute Support Center Manager certification

DoDD 8140.01 Baseline certifications, such as COMPTIA A+, Network+, or Security+

At least 4 years overall IT Service Desk management or IT Service Desk operations experience

At least 1 year of experience planning, directing, and managing service support operations in an organization similar in size to AESD

Knowledge of industry accepted standards and best practices related to Information Management operations and with ITSM best practices

Strong customer service skills and technical aptitude

An understanding of DoD culture and standards

Responsible for facilitating the timely process through which incidents and problems are managed. Includes problem recognition, research, isolation, resolution and follow-up steps

Resolve less complex problems immediately, while more complex problems are assigned to second level support or supervisor (to the PM or the appropriate Army operations center), typically involving the use of problem management database and help desk system

Provide guidance/training for less experienced personnel

The following experience is highly desirable:

Planning, directing, and managing IT projects/operations in an organization similar in size to AESD

Supervising employees in efforts similar in size and scope as referenced within the PWS.

Knowledge of industry accepted standards and best practices related to Information Management operations, and with ITSM best practices.

6.0 Contractor Furnished Equipment

The Contractor shall configure and provide the following:

United States-based primary and secondary COOP facilities

Automated Call Director (ACD) call processing technology

Phones and supporting standard office equipment such as copiers, fax machines, etc.

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 21

Workforce management software system providing automated cost accounting linking individual agent labor, calls/contacts, and tickets to specific supported AESD services and providing detailed analytics for work queue analysis and optimized IVR/ACD/service management system configuration and integration

Public Internet Connectivity subject to DoD firewalling and Information Assurance policies

Functional management including subscribers maintenance, and ongoing operational maintenance of the Army-wide fully IA accredited and configured AESMP ITSM SaaS including web-based portal with knowledge bases to support Tier 0 self-service and live agents.

7.0 Government Furnished Equipment (GFE)

The Government will provide the following:

Sponsorship in order for the Contractor to obtain NIPR/SIPR access

SIPR facilities, as required, to support SIPR-based operations for AESD

Sponsorship in order for the Contractor to obtain telecommunications services to support AESD Operations using Government- provided toll free numbers and Video Teleconferencing technologies.

Secure Host Baseline-Army for configuration of GFE desktop computers.

NIPR connectivity to the AESD contact centers and contractor access to existing Government ticketing/workflow/knowledge management service management systems

Technology to support the Contractor with obtaining and maintaining RMF compliance

Laptop/Desktop computers for Agents, PMO, and SMS technicians, as required. GFE computers are to be configured and maintained by the Contractor for AESD Agents

Provide and administer the BOMGAR server and provide the Contractor access to the BOMGAR remote tool and the ability to administer accounts and provide reporting.

Access to cloud-based common services (such as EAMS-A, ACAS, or others provided by cARMY) with which AESD needs to interface for operations and compliance

8.0 Performance Requirements

The Performance requirements for AESD are specified as Service Level Agreements (SLAs) and Key Performance Indicators (KPIs). The following table summarizes the SLAs and KPIs for AESD to be tracked by user community:

ITEM NAME TYPE

1 First Contact Resolution KPI

2 Average Speed to Answer SLA

3 Abandonment Rate SLA

4 Response Time to an Inquiry Submitted via Web Form KPI

5 Ticket Accuracy SLA

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 22

6 AESD Customer Satisfaction KPI

7 AESD MSP Responsiveness SLA

In addition, the Contractor shall accumulate performance metrics at least by call, call type, ticket, ticket type, originating user community, and agent, where applicable, in order to provide visibility to the Government on general performance, SLA, and KPI compliance for the Contractor and the AESD Operations.

The Contractor shall provide the Government transparency for its current agent staffing levels and skills training for the ability to handle each call type and ticket type by user community. The Contractor shall accumulate metrics on: (1) the total hours used in support of each user community by call type, call volume, ticket type, and ticket volume; (2) how many on-hand agents are trained/cross trained to service each call type and ticket type by user community; and (3) what are the current training requirements for each call type and ticket type by user community in terms of hours per agent in order for the agent to either attain or maintain skills necessary to handle that call type or ticket type.

The Government and the Contractor shall review the structure of SLAs and KPIs quarterly in order to add, modify, or remove SLAs or KPIs for the support services being provided by the Contractor for AESD.

Projected ticket volumes shall be reviewed quarterly by the Government and the Contractor with Service Owners for any adjustments.

The Contractor shall provide the Government and AESD customers the capability to access a reporting dashboard unique to their organization. Generally, this dashboard consists of the AESD operational profile (the supported services and locations of AESD customers and AESD End Users), call/ticket volumes by supported service, SLA/SLA activity measurements by supported service, AESD functional capabilities profile, contact center locations, and real time views of call center technologies such as real time call queues and wait times being captured by the telephony system.

These standardized metrics and other ticketing and telephony information shall be available to the Government and AESD customers, and reviewed weekly as a measure of AESD operational performance and to identify AESD service improvements. Along with communication of AESD operational activity to customers, the ticketing and telephony information is used in the execution of the AESD QASP for monitoring the performance of the underlying AESD supporting infrastructure. Because of this continuous operations analysis, if AESD Government management identifies projects it feels will improve service, a change request may be provided to the Contractor for review.

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 23

The following business rules will be used in determining when tickets should and should not be created:

Channel Event/Contact Result Exceptions

Inbound Call

An inbound call is received with an inquiry, incident, problem, or service request

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

The user is calling to check status on an existing ticket

The user is calling to provide additional information on an existing ticket

The user is calling to further discuss an existing ticket

The user is calling back because the initial call was disconnected

An inbound call is received from a user related to a problem reported by other users

A ticket is generated

A ticket for the specific user already exists for the problem

Outbound Call

An outbound call is placed in response to a web form request for call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a web chat request for call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a voicemail request for call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a user request for a call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a user request for a call-back related to a problem reported by other users

A ticket is generated

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 24

Channel Event/Contact Result Exceptions

Web Chat

A request to initiate a Web Chat session is received

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

The web chat is initiated for the purpose of checking status on an existing ticket

The web chat is initiated for the purpose of providing additional information on an existing ticket

The web chat is initiated for the purpose of further discussing an existing ticket

The web chat is initiated for the purpose of complaining or complimenting

The web chat is initiated because the initial session was disconnected or lost

A request to initiate a Web Chat session is received and the session is related to a problem reported by other users

A ticket is generated

A ticket for the specific user already exists for the problem

Web form

Web form is received with an inquiry, incident, problem, or service request

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

Web form is received related to a problem reported by other users

A ticket is generated

Detailed definitions of SLAs and KPIs are as follows:

1: First Contact Resolution

1. SLA SUMMARY

1A. TASK

AREA

Sub-Task 1 - Army Enterprise Service Desk Operations

1B. PERFORMANCE

CATEGORY

Responsiveness

1C. ITEM # 1 1D. SLA NAME

First Contact Resolution

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 25

2. SLA OVERVIEW

2A. SLA

DESCRIPTION

Measures the efficiency and timeliness of AESD operations as indicated by the proportion of inbound calls and web tickets to the AESD, which are resolved on the First Contact.

2B. RATIONALE

Incentivizes staffing of AESD with qualified AESD personnel to facilitate maximum customer satisfaction.

2C.

PERFORMANCE

PERIOD

This SLA is in effect on a continuous basis, 24 hours per day, 7 days per week, without interruption throughout the period of performance.

3. SLA MEASUREMENT

3A.

MEASUREMENT

INTERVAL

The Measurement Interval is 1 month.

3B.

MEASUREMENT

PERIOD

The Measurement Period begins at 00:01 on the first day of the month and ends at 24:00 on the last day of the month..

Zulu time is used for the 24-hour period of measurement.

3C. SOURCE OF

MEASUREMENT

DATA

The source of measurement data is weekly reports from the ticketing system used.

3D. METHOD OF

MEASUREMENT

SLA attainment is measured by:

1. A customer contacts AESD via phone or web portal

2. The incident is resolved within the Service Desk

3. If resolved on the First Call, the Agent asks the customer whether the incident has been resolved

4. If the customer responds in the affirmative, the Agent asks if the ticket can be resolved

5. If the customer responds in the affirmative, the Agent resolves the ticket In the Ticketing System

6. This incident is considered resolved on the First Contact

7. If resolved on the First Contact, the Agent resolves the ticket and a message is sent to the customer that the ticket is resolved. If the customer does not respond or re-open the ticket, the ticket is considered resolved on First Contact.

3E. TIMING OF

MEASUREMENT

SLA attainment is calculated after the end of the Measurement Interval.

3F. METHOD OF

GOVERNMENT

SURVEILLANCE

Subject to random or planned audit by the Government or its third party designee.

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 26

3G.

ASSUMPTIONS/

CONDITIONS

1. After resolution of the ticket, the ticketing system will automatically send the customer an email confirming their ticket has been resolved.

2. The ticket will include the ticket number and instructions to the customer on how to contact the Service Desk to re-open their ticket, if the incident is not resolved, or if the incident should re-occur before the ticket auto closes.

3. Warm transfers where the incident is resolved by Tier 1- 2 are considered Resolved on the First Contact.

4. Tickets escalated to Tier 1-2 or external subscriber groups and addressed through call-back are Unresolved on the First Contact.

5. Tickets that result in a callback by any Tier are considered Unresolved on the First Contact.

3H. EXCEPTIONS

1. Tickets generated during downtime of the Ticketing System due to a network outage or network performance degradation outside the control of AESD are excluded from the calculation.

2. New/Existing Onboarded Services that use AESD-W agents as a pass-through (log and route) will be excluded from the FCR calculation.

3. Contacts that occur during the following periods are excluded from the Numerator and Denominator for calculation purposes:

a. Ticketing System downtime approved by the

Government (e.g., for scheduled maintenance)

b. Ticketing System downtime due to events outside

AESD control and approved as such by the Government

c. Failure of Monitoring Tools.

4. Tickets that result in immediate escalation due to process, policy, or other factor outside of AESD control that does not allow AESD the opportunity to resolve are excluded from…