CAV-AF Performance Work Statement 30 May 2024.pdf

System Integrator Sustainment Support

Performance Work Statement (PWS) For

Commercial Asset Visibility – Air Force (CAV AF) System 3 0 M a y 2 0 2 4

Name: Air Force Program Executive Office (AFPEO) Business Enterprise System (BES)

Organization: AFLCMC/GBS, CAV AF Program Office

Address: 4225 Logistics Avenue, Bldg 262, WPAFB, OH 45433

Table of Contents

Table of Contents …………………………………………………………………………………………………………………………. 2

1. PURPOSE ………………………………………………………………………………………………………………………… 4

2. OVERVIEW ……………………………………………………………………………………………………………………… 4

3. REQUIREMENT(S)/DESCRIPTION OF SERVICE(S) ……………………………………………………………… 5

3.1 CAV AF Sustainment Support ……………………………………………………………………………………….…. 6

3.1.1 BES Process Directory ………………………………………………………………………………………………………. 6

3.1.2 Project Management ……………………………………………………………………………………………………… 6

3.1.3 Task Order Management ……………………………………………………………………………………………….. 7

3.1.4 Monthly Status Reporting …………………………………………………………….……………………………..… 9

3.1.5 Weekly Status Meetings ……………………………………………………………………………….………….…... 10

3.1.6 Program Management Reviews……………………………………………………………………………………… 10

3.1.7 CAV AF Materiel Solution Configuration Management ……………………………………………..….. 10

3.1.8 CAV AF Materiel Solution Requirements Management ……….………………………………….….….. 11

3.1.9 CAV AF Application Design Review… …………………………………………………………………….….….. 11

3.1.10 CAV AF Application Monitoring

3.1.11 CAV AF Materiel Solution Integration

3.1.12 RICE Object Requirements Analysis and Design ………………………………………………….….…… 12

3.1.13 RICE Object Development and Deployment ……………………………………………………….….……… 13

3.1.14 RICE Maintenance and Surveillance ………………………………………………………………………………. 14

3.1.15 Database Administration ………………………………………………………………………………………………. 14

3.1.16 Database Maintenance and Surveillance ……………………………………………………….……………... 15

3.1.17 Release Management …………………………………………………………………………………………..………… 15

3.1.18 Environment Management ………………………………………………………………………………………….…. 17

3.1.19 Environment Administration …………………………………………………………………………………………. 18

3.1.20 Computer Network Defense …………………………………………………………………………………………. 20

3.1.21 Information Assurance ………………………………………………………………………………………………….. 21

3.1.22 Help Desk Management ………………………………………………….………………………………………...…. 23

3.1.23 Functional Subject Matter Expertise ……………………………………………………….……………………… 23

3.2 Transition Support ………………………………………………………………………………….………………………. 24

3.2.1 CAV AF Software Transition Support …………………………………………………………………….………. 24

3.2.2 CAV AF Hosting Transition ……………………………………………………………………………………………. 26

3.2.3 Hosting ………………………………………………………………………………………………………………………... 27

4. CAV AF CONTRACTUAL REQUIREMENTS ………………………………………………………………….……. 28

4.1 Place of Performance ……………………………………………………………………………………..……………. 28

4.2 Normal Hours of Operation ………………………………………………………………………………………….. 28

4.3 Government Furnished Property ………………………………………………………………………………….. 28

4.4 Non-Personal Services ……………………………………………………………………………………………………. 28

4.5 Contractor Identification ………………………………………………………………………………………………. 28

4.6 Performance Reporting ………………………………………………………………………………………….……. 29

4.7 Documentation and Data Management ………………………………………………………………………. 29

4.8 Records, Files, and Documents ………………………………………………………………………………………. 29

4.9 Information Protection …………………………………………………………………………………………………. 29

4.10 Protection of System Data ……………………………………………………………………….……………………. 33

4.11 Security ………………………………………………………………………………………………………………………….. 30

4.11.1 National Agency Check with Written Inquiries ………………………………………………………………. 30

4.11.2 Common Access Card (CAC) …………………………………………………………………………………………... 31

4.11.3 In-Processing …………………………………………………………………………………………………………..…. 31

4.11.4 OPERATIONS SECURITY …………………………………………………………………………………..……………. 31

4.12 System and Network Authorization Access Requests ………………………………………………………. 32

4.13 Travel ………………………………………………………………………………………………………………………….…. 32

4.14 Data Accession List (DAL) ……………………………………………………………………………………….………. 32

4.15 Training ………………………………………………………………………………………………………….………..……. 32

4.16 Data Rights and Non-Commercial Computer Software ……………………………………………………. 32

4.17 Enterprise Software Initiative …………………………………………………………………………………………. 33

4.18 Software License Management ………………………………………………………………………………………. 33

5. SERVICES DELIVERY SUMMARY ………………………………………………………………………………………. 34

6. DATA DELIVERABLES ………………………………………………………………………………………………………. 39

6.1 Delivery of Data Items ……………………………………………………………………………………………………. 41

7. APPLICABLE STANDARDS AND REFERENCES …………………………………………………………….……. 41

8. ACRONYMS ……………………………………………………………………………………………………………………. 53

APPENDIX A – CAV AF Current Government Furnished Equipment ………………………………………………. 51 APPENDIX B – DR/PR Severity Ratings and Resolution Thresholds …………………………………………….…. 54 APPENDIX C – Other Direct Costs …………………………………………………………………………………………………. 56

1. PURPOSE

To describe the contractual performance requirements of non-personal labor necessary to host, sustain, secure, and maintain the CAV AF Materiel Solution securely and provide support to the Contract Depot Maintenance (CDM) Community.

2. OVERVIEW

The Commercial Asset Visibility Air Force (CAV AF) system is managed for the Air Force by PEO Business and Enterprise Systems (BES), Enterprise Logistics Systems Division, Requirements Branch (AFLCMC/GBS). The core CAV II application was built by Navy Supply Systems Command Business System Center (NAVSUP BSC) and delivered to the Air Force.

NAVSUP BSC is the current Information Technology (IT) developer of the core CAV II GOTS application. The GOTS application will be hereafter referred to as Commercial Asset Visibility version II (CAV II). NAVSUP will no longer be providing this function so it will transfer to the sustainment contractor.

The CAV AF System Integration Contractor (SI) develops and integrates Reports, Interface, Conversions, and Extensions (RICE) objects with the GOTs and oracle database to make up CAV AF. The CAV AF Materiel Solution requires integration and hosting services by the SI Contractor to deliver functional business requirements. The CAV AF application is currently deployed by the Air Force as a web-based software solution that resides on government owned servers and networking equipment at the System Integrator’s commercial hosting facility. The solution is accessed by Air Force personnel and repair vendor staff using a browser via the Internet. The SI shall host CAV AF in their Government approved secure commercial facility and maintain/sustain CAV AF as a secure high performing system and database. They shall also update the source code as required from the functional community.

The CAV AF Materiel Solution is an unclassified commercial (.com) system providing AF Item Managers (IM) with visibility of Government Furnished Property (GFP) and reparable assets undergoing repair at commercial vendor sites for software, aircraft, missile, engine, Other Major End Items (OMEI), exchangeable, storage, area support, base support and local manufacture commodity groups. CAV AF provides the means to track material in transit to and from the Designated Overhaul Point (DOP) and allows daily transaction reporting while minimizing workload impacts on the DOP.

The CAV AF Materiel Solution provides IMs and Production Management Specialists (PMS) with improved asset status reporting information assisting them in the management of reparable assets while enhancing status reporting between the repair activities and the Air Logistic Complex (ALC) leads to greater inventory accuracy and item accountability. ALC IM’s can determine Contractor performance criteria and average component repair times using the CAV AF Materiel Solution asset repair data.

CAV AF Users include various commercial repair Contractors, some of which are Foreign Nationals.

The CAV AF Materiel Solution provides a standard automated virtual environment to monitor and control asset repair contracts. CAV AF DOPs report the following types of transactions to the government daily, shown in the table below:

Table 1: CAV AF Transition Types CAV AF Transaction Types

Receipts Requisitions Inductions Modifiers Awaiting Parts (AWP) Cancellations Re-inductions Materiel Obligation Validation Replies Completions Follow-ups Scrap Government Furnished Material (GFM)

Receipts Borrow/Payback GFM Issues Shipments GFM Turn Ins Requests for Survey GFM Transfers Beyond Economic Repair/Maintenance Expenditure Limit Notifications

GFM Shipments

Report of Discrepancy for quantity and National Item Identification Number discrepancies

GFM Condemnations

All corresponding reversals GFM Plant Clearance

CAV AF uses an Oracle relational database and resides on a mid-tier server. CAV AF interfaces include a number of systems including legacy mainframe systems, commercial business systems, and through a Secure File Gateway. CAV AF transaction loads require mid-tier servers for operations and maintenance. These servers are located at the off-site Contractor’s facility. The facility provides physical security for CAV AF in accordance with Department of Defense (DoD), AF, and Air Force Materiel Command (AFMC). The SI ensures the CAV AF system is secure using a computer network defense support system (CNDSP). The facilities and infrastructure provide fire, water, power, security and computer grade environmental protection mechanisms. CAV AF is accessed using an Internet Explorer (IE) browser with 128-bit encryption on the User’s desktop. Individual ALC CAV AF Administrators will control their ALC’s User identification and password credentials to access the system. The CAV AF PMO control the PMO and ALC Administrators identification and password credentials.

The CAV AF Materiel Solution achieved Initial Operational Capability (IOC) in October 2006 and Full Operational Capability (FOC) in October 2008. Air Force Users of the CAV AF Materiel Solution primarily include Production Management Specialists and Item Management Specialists at the three ALCs in Oklahoma City, OK, Ogden, UT and Warner Robins, GA. In addition, Nuclear Weapons Related Materiel (NWRM) program personnel in Dayton, OH and Cryptologic and Cyber Systems Division (CCSD) Asset Management program personnel at Lackland AFB utilize CAV AF.

The CAV AF Materiel Solution support described within this PWS will be delivered and managed by the Air Force Materiel Command (AFMC) Air Force Life Cycle Management Center (AFLCMC) Legacy Maintenance Division – Requirements Systems Section (HIAR), CAV AF Program Management Office (PMO). Support managed by AFLCMC/GBS on this task order is outlined in Section 3.

3. REQUIREMENT(S)/DESCRIPTION OF SERVICE(S)

In coordination with the CAV AF PMO and the CAV AF Contracting Officer, the Contractor shall deliver sustainment support, integration, and hosting in accordance with the terms of this contract. Successful operation of the CAV AF Material Solution depends on continuous, reliable support from the following components and external partners. Any updates/revisions to these may result in the need for corresponding changes to the CAV AF Materiel

Commented [HLBGUAA1]: Need to look at what the RFI stated and adjust as needed.

Commented [HLBGUAA2]: Replace “task order” with “contract”

Solution:

Commercial Asset Visibility II (CAV II) Application: Contractor to provide CAV II application development for both Software Problem Report (SPR) and Program Change Requests (PCR) submitted by the CAV AF PMO on behalf of the functional customer base.

COTS Vendors: COTS Vendors: CAV II was developed utilizing Java with an Oracle database. CAV AF employs an additional number of COTS products in the support of various CAV AF application functions including general application operations, security, and file transfers. COTS products that support CAV AF are required to undergo regular review and analysis, security updates, and implementation and/or transition planning including risk analysis to determine their impact on the CAV AF system..

System Interfaces: CAV AF maintains interface agreements with other Automated Information Systems (AISs) as listed in the ITIPS and the Corporate Data Repository System (CDRS). These interfaces are shown in attachment A.

Non-Secure Internet Protocol Router Network (NIPRNET): Provides End-to-End client non-classified network connectivity.

Commercial Domain (.com): The domain name .com is the commercial top-level domain in the Domain Name System of the Internet. CAV AF must operate in the .com domain because of security restrictions on the military domain, (.mil). The .mil domain currently restricts foreign national access. CAV AF contractor maintenance includes foreign companies employing foreign nationals. Foreign Nationals cannot have higher access than an IT level III CAV AF User.

3.1 CAV AF Sustainment Support

3.1.1 BES Processes

o The Contractor shall employ and stay current with the disciplined systems engineering processes including, but not limited to: requirements development, technical management and control, operational activities, system/software design and architecture, integrated risk management, configuration management, data management, decision analysis and resolution, Project Management, organizational process definition and focus, test and evaluation, verification and validation practices throughout the period of performance.

o The Contractor shall follow and refer to the BES Processes and best practices common plans, procedures, checklists, forms, and templates supporting system life cycle management and systems engineering processes as it applies to Defense Acquisition, Technology, and Logistics or be able to demonstrate comparable processes and artifacts for Government acceptance.

o The Contractor shall develop solutions which employ principles of open technology development and a modular open systems architecture for hardware and software o The Contractor’s systems engineering planning and design activities shall also adhere to the DoD

Information Sharing and Net-Centric Strategies published by the DoD CIO, and the engineering body of knowledge and lessons-learned.

o The contractor shall provide updates to the source code as requested by the functional community.

3.1.2 Project Management

The Contractor shall provide a Program Management Plan describing the way the tasks and deliverables under this

Commented [HLBGUAA3]: Update as necessary with the current program as AF might own the code.

Commented [HLBGUAA4]: Need to look at – Kathy ;

look at website and determine if open technology is stilled used or has it been updated/

Commented [HLBGUAA5]: From this point until Program review need to relook and organize differently task order will be managed, monitored and tracked (CDRL A014) o 3.1.2 (a)The Contractor shall support any process changes the PMO has to make to satisfy the transition from DODI 5000.2 to DODI 5000.75 o 3.1.2 (b)The Contractor shall provide a Software Test Plan describing their approach to testing the entire CAV AF configuration (CDRL A005) o 3.1.2 (c)The Contractor shall provide a sound approach in project tracking and oversight during software development, maintenance, and technical refresh while maintaining an accurate Government Furnished Property (hardware and software) attachment (CDRL A018) o 3.1.2 (d)The Contractor shall identify a Program Manager or a Project Manager who shall be the primary representative responsible for all work awarded under this contract, participating in Program/Project Management Reviews (PMRs) and ensuring all standards referenced herein are adhered to. Quarterly Program Management Reviews (PMRs) shall be hosted by the Contractor for the purpose of reviewing issues, risk, goals, status, etc..

o 3.1.2 (e)The Contractor shall inform the Government of problems or potential problems affecting performance as soon as possible; means of notification will depend upon severity to include immediate phone call / email notification or during the weekly status meetings, in the Monthly Status Reports, and in PMR, as appropriate (CDRL A011) o 3.1.2 (f) The Contractor shall provide contract and project administrative support (e.g., planning meetings;

preparing correspondence, briefings, meeting minutes, facilitation of working groups, technical and administrative reports; surveys; and data analysis) (CDRLs A012, A013)

3.1.3 Task Order Management

The Contractor shall establish and provide a qualified workforce capable of performing the required tasks outlined in this PWS. While the knowledge and experience necessary to deliver the requirements of this task order are broad and the following list does not represent an exhaustive list, the Contractor shall at a minimum ensure the project team includes or has access to resources and backup resources with knowledge and experience with the following technologies, processes, and products:

3.1. (a)Microsoft Server Operating Systems

3.1.3 (b)Microsoft Internet Information Services (IIS)

3.1.3 (c)VMware ESXi platform

3.1.3 (d)WebLogic

3.1.3 (e)Virtual Center Server

3.1.3 (f)Procedural Language/Structured Query Language (PL/SQL), JAVA programming, Hyper Text

3.1.3 (g)Markup Language (HTML), Active Server Pages (ASP), Extensible Markup Language (XML), Program Key Infrastructure (PKI), Secure File Transfer Protocol (SFTP), Microsoft Visio modeling software, Microsoft Project software, as well as general procedural and object-oriented programming language principles, Security Technical Implementation Guides (STIG), Information Assurance Vulnerability Alerts (IAVA), Assured Compliance Assessment Solution (ACAS), Oracle database products, database management system tools and principles, CNDSP products, Oracle database design, deployment and maintenance methodologies and best practices.

Formatted: Normal, No bullets or numbering

Formatted: Font: (Default) Times New Roman, Condensed by 0.05 pt

Commented [HLBGUAA6]: Need to add reference titles and check if still valid; may want to include 8500 (Kathy can help with the reference)

Formatted: Font: (Default) Times New Roman, Condensed by 0.05 pt

Formatted: Normal, Indent: Left: 0.25", No bullets or numbering

Formatted: Font: (Default) Times New Roman

Commented [HLBGUAA7]: Need to move to another section; look to see if Software testing is covered in another section; also need a software development plan

Formatted: Font: (Default) Times New Roman

Formatted: Normal, Indent: Left: 0.25", No bullets or numbering

Formatted: Font: (Default) Times New Roman

Formatted: Normal, Indent: Left: 0.25", No bullets or numbering

Formatted: Font: (Default) Times New Roman

Formatted: Normal, Indent: Left: 0.25", No bullets or numbering

Formatted ... [1]

Formatted: Normal, Indent: Left: 0.25", No bullets or numbering

Formatted ... [2]

Commented [HLBGUAA8]: Need to put subbullets under this; I will get with Kathy about subbullets

Commented [HLBGUAA9]: Need to put each item in a bullet format; need to look at the list and make sure we haven’t missed anything

3.1.3.1 4 Monthly Status Reporting The Contractor shall provide the Government with a Monthly Status Report (MSR) (CDRL A011) to include, but not limited to:

o Staffing profiles and status of staffing actions o Major accomplishments and contractual activity o Release risks and issues; status of mitigation and issue resolution o Government requested statistics, to include but not limited to:

Help desk statistics CAV II application, database and RICE object measures of performance Requirements stability Total, Applicable and Implemented TCNOs, STIGs and IAVAs Security scan results Release test statistics Status of PR resolution o Status of Government requests / action items o Identification of required Government support, action and/or decisions o Planned future activities o System Downtime, cause of downtime, and corrective actions o Contract deliverables status o Testing status o Discrepancy reports and Problem report metrics o Performance Metrics o Planned Monthly Activity Schedule

The Contractor shall develop a metric performance baseline against the agreed upon metrics on which the actual performance shall be compared. All metric performance baselines shall be subject to PMO approval, and, once approved, shall not be changed without prior PMO approval. The performance metrics shall be proposed in the first monthly status report and there after documented in the monthly status report (CDRL A011)

The Contractor shall identify, assess and report on risks associated with CAV AF and provide mitigation plans for those risks. Risks shall be reported as soon as they are identified and a status update provided at the weekly Status Meeting, in the Monthly Status Report and at quarterly PMRs (CDRL A011)

3.1Weekly Status Meetings The Contractor shall facilitate weekly status meetings with the PMO at the PMO facility or by teleconference as agreed to by the PMO and the Contractor. The Weekly Status meeting shall include, but not be limited to:

o Project risks, issues and concerns o Major accomplishments and key contractual activity that occurred during the week o Status of active Sustainment Release schedules o Status of Government requests / action item o Planned future activities

Commented [HLBGUAA10]: Need to spell out

Commented [HLBGUAA11]: Need to include qtrly o Required Support

3.1.1 Program Management Reviews

The Contractor shall conduct PMRs to be held quarterly at the direction of the PMO. The PMRs shall be conducted at the PMO or via teleconference, unless otherwise agreed to by the PMO and the Contractor. Presentation Material (CDRLs A013) shall include, but not be limited to:

o Program overview o Contractual activity o Staffing profiles o Integrated Program Schedule o Cost and schedule information o Program/project milestones o Major accomplishments o Future activities o Program Manager (Contractor) assessment o Sustainment support activities o Security issues o Development status for each Sustainment Release o Deliverable status and metrics o DRs, BCRs, Technical Communications-Computer Systems Requirements Document (TCSRDs), and

Communications-Computer Systems Requirements Document (CSRDs) Problem Areas o Risks/Risk Status o Release Issues o Action item with current status o Projected Schedule

3.1.3 CAV AF Materiel Solution Configuration Management

The Contractor shall implement and maintain a formal Configuration Management (CM) program. The Contractor shall document the CM methodologies and techniques as they relate to the Configuration Management of all documentation, software patches, configuration updates, hardware, and other deliverables in a Contractor’s Program Management Plan (PMP). The Contractor shall employ automated CM tools integrated with their configuration management processes. The Contractor shall provide the Government with access to their automated CM tools. The Contractor shall preserve and make available to the Government Contracting Officer (CO) and PMO, as requested, copies of all records, documentation, code developed or acquired under this contract. The Contractor shall support Integrated Test Team (ITT) meetings, Functional Configuration Audits (FCA) and Physical Configuration Audits (PCA) and Test Readiness Reviews I (TRR I) conducted by the Government as required. The Contractor shall include the Contractor’s Configuration Management Plan (CMP) as an appendix to the PMP. (CDRLs A014, A015)

The Contractor shall maintain currency and version control of all existing CAV AF configuration managed items related to program documentation, configuration, hardware, and software components. Configuration Management of the CAV AF system includes all GOTs, COTs, and updates, and STIG implementations and configuration changes required to recreate the production system. Previous system configuration must be maintained for 6 months after the next release has been placed into production for roll back purposes. The Contractor shall notify the Government prior to the release of new documents, change pages, software documentation updates, hardware and software changes driven by software version updates or hardware purchases.

The Contractor shall accomplish CM activities as described in this performance work statement. CM activities include CAV AF Materiel Solution baseline identification, change control, status accounting, and auditing. (CDRL

Commented [HLBGUAA12]: Need to look at each paragraph titles; need to make sure they are standard

Commented [HLBGUAA13]: Need to add other meetings;

Tech Information Meetings and Meetings Associated with BES-BPD

A014) o The Contractor shall maintain a current baseline of the CAV AF Materiel Solution and supporting documentation o The Contractor shall provide hardware/software changes and problem fixes to the CAV AF Materiel Solution

– in coordination with PMO; updated documentation to be provided, as required o The Contractor shall establish and maintain development, government test, training, and production environments. The development, test and training environments shall mirror, as closely as possible, the operational production environment in order to perform training, testing, and regression testing of the entire system for each upgrade or patch installed to ensure continuing functionality o The Contractor shall maintain an audit trail for each CAV AF GOTS release and CAV AF Materiel Solution modification, the reason for the modification, and authorization for the modification (CDRL A002) o The Contractor shall control and audit all accesses to controlled configuration items including CAV AF GOTs releases.

3.1.4 CAV AF Materiel Solution Requirements Management

The Contractor shall accomplish Requirements Management (RM) activities to include functional baseline identification, change control, status accounting, and auditing.

o When requested by the Government, the Contractor shall document new and/or update CAV AF requirements for consideration and approval by the Functional community via the Government’s requirements tracking and approval system, currently the Information System Management Tool (ISMT) o The Contractor shall assess the completeness and clarity of all new and/or updated, functionally-vetted requirements; recommended changes should encompass those deemed necessary to enable the developer to draft a preliminary design o The Contractor shall participate in CAV AF change vehicle prioritization meetings and present any recommended requirement changes to language initially vetted in ISMT, as required o For requirements approved by the Customer, the Contractor shall prepare corresponding Navy used Program

Change Requests (PCRs) documentation for new and/or updated requirements approved for NAVSUP BSC Technical Assessment; the Contractor shall provide such documentation to the Government for submission to NAVSUP BSC o The Contractor shall ensure approved requirement updates as well as any Technical Assessment responses, to include Rough Order of Magnitude (ROM) Cost Estimate data, are reflected and kept current in the Government’s requirements tracking and approval system and ISMT.

o The Contractor shall maintain and provide updated versions of Software Requirements Specification (SRS) and Software Version Description (SVD) for the CAV AF Materiel Solution for each release (CDRL A002, A009)

3.1.5 CAV AF Application Design Reviews

The Contractor shall analyze Technical Assessment and Project Design Description (PDD) documentation to assess alignment to submitted CAV II PCR requirements and sound design concepts and provide administrative, substantive, major and critical comments (CDRL A013)

Commented [HLBGUAA14]: Need to add this paragraph to the CDRL o The Contractor shall analyze proposed Technical Assessment and PDD documentation and identify anticipated impacts to the overall CAV AF Materiel Solution o The Contractor shall document any resulting derived requirements that will necessitate SI changes to the

CAV AF Materiel Solution (i.e. existing deployed CAV AF GOTS, COTS hardware/software, RICE object development, and/or modifications to CAV AF database structure and parameters) (CDRL A002)

3.1.6 CAV AF Application Monitoring

The Contractor shall establish a CAV AF application performance profile to include industry standard measures of performance with corresponding threshold targets necessary to meet Government CAV AF Materiel Solution availability and security requirements; in addition the Contractor shall follow an application log monitoring processes (either manual and/or automated) to identify non-standard CAV AF application and/or database events and trends

(CDRL A013)

o Upon acceptance by the Government the Contractor shall document initial CAV AF application performance baselines against each measure o The Contractor shall implement procedures and tools to detect and diagnose CAV AF application performance issues, conduct root cause analysis and monthly report CAV AF application performance metrics

(CDRL A011)

o The Contractor shall recommend a listing of CAV AF application events and trends which require monitoring and recommend reporting timeframe thresholds for Government notification o Scheduled log reviews shall be conducted and tracked by the Contractor. Results will be reported to the

Government (CDRL ?)

o The Contractor shall manage the creation, modification, suspension and deletion of CAV AF application

U ser accounts in accordance with approved AF policies and CAV AF access control procedures o The Contractor shall retain approved DD form 2875s, information assurance training certificates and signed rules of behavior agreements for all CAV AF PMO staff and all CAV AF Functional Leads in accordance with approved AF policies and CAV AF access control procedures

3.1.7 CAV AF Materiel Solution Integration

The Contractor shall also be responsible to deploy this overarching solution as appropriate in all CAV AF environments while establishing and maintaining interfaces to other approved DoD, Air Force and commercial systems and data repositories.

o The Contractor shall maintain artifacts that describe the overall CAV AF Materiel Solution and the processes and procedures necessary to maintain its proper function (including topogolies, logic diagrams, operational procedures, and process flow diagrams) (CDRLs A003, A004, A010) o The Contractor shall provide updates as necessary to the installation instructions for each release (CDRL

A016)

Commented [HLBGUAA15]: Should we associate a CDRL with this bullet

Commented [HLBGUAA16]: Need to add a CDRL for this develiable o The Contractor shall develop a Software Test Description (STD) and associated test scripts for execution during Component Validation and Integration (CV&I) testing of Contractor developed RICE objects and updated CAV AF related software; the Contractor shall submit the STD and test scripts to the Government for acceptance prior to execution (CDRL A006) o The Contractor shall perform CV&I testing and applicable regression testing to ensure existing capabilities and functionality has not been diminished or damaged by changes or enhancements to the CAV AF Materiel Solution o The Contractor shall provide visibility of step by step test results as proof of accurate execution of each test script as an attachment to the Software Test Report (STR) (CDRL A007)

3.1.8 Requirements Analysis and Design

o The Contractor shall participate in CAV AF Functional Review Board (FRB) and Configuration Control Board (CCB) events and present any recommended requirement language changes to initially vetted change vehicles in ISMT, functionally approved CSRDs, any derived requirements, required software upgrades or patches, and configuration changes o For RICE, application, and system requirements, and also source code requirements the Contractor shall prepare and submit a Rough Order of Magnitude (ROM) containing cost and categorized labor hour information and a Technical Analysis (CDRL A013) describing how the Contractor intends to meet the functional and technical requirements to satisfy the requirement for:

Each new and/or updated, functionally-vetted CAV AF RICE or source code requirements approved at

FRB and CCB

Each CAV AF new and/or updated, functionally-vetted CAV AF requirements approved at FRB and CCB derived from proposed changes to the application o Depending on complexity of the release, the Contractor shall host one or more System Requirement Review (SRRs) for each release to ensure a common interpretation of the requirements exists between the Functionals, Users, PMO, and Developers.

o The Contractor shall present and get approval for any baseline changes that affect the CAV AF

Configuration, the reason for the change, and a proposed schedule for the changes.

o The Contractor shall participate in Technical Interchange Meetings (TIMs) necessary to define and document

CAV AF requirements, interface, and reporting requirements and to document CAV AF or interfacing system impacts due to proposed system modification(s) o The Contractor shall host PDR/CDR events to demonstrate an understanding of release requirements and to present proposed development solution(s) for Government approval (CDRLs A003, A004, A022, A023) o For requirements requiring the development of new CAV AF capabilities that must be acquired with

Research, Development, Test and Evaluation (RDT&E) funds as determined by the Government, the Contractor will prepare and submit an Engineering Change Proposal (ECP) (CDRL A020)

Commented [HLBGUAA17]: Need to change the delivery date of the CDRL; want draft at CDR

Commented [HLBGUAA18]: Need to determine what we want to call this once we own the code

3.1.9 Development and Deployment

Once Contractor development is complete, Integrated Development Test and Evaluation (IDT&E) is conducted to evaluate design, quality, performance, functionality, security, interoperability, supportability, suitability, usability, and maturity of a system or capability in an operationally relevant environment. IDT&E is composed of three phases to include Component Validation and Integration (CV&I), Qualification Test and Evaluation (QT&E) and User Evaluation Test (UET).

o Upon approval by the Government at CDR the Contractor shall provide final SDD and DBDD documentation and develop all items in accordance with the approved documentation (CDRLs A003, A004) o The Contractor shall document a Software Test Description (STD) with associated test scripts, including regression testing, for SI execution during CV&I testing of Contractor developed items and the CAV AF software; the Contractor shall submit the STD and test scripts to the Government for acceptance prior to execution (CDRL A006) o The Contractor shall execute and report the results of test scripts including regression testing and security testing to ensure existing capabilities and functionality has not been diminished, damaged, or compromised by changes or enhancements to the CAV AF Materiel Solution. The security testing will also include security and virus scans of software to be provided to satisfy the release requirements. (CDRL A007) o The Contractor shall provide visibility of step by step test results as proof of accurate execution of each test script as an attachment to the Software Test Report (STR) (CDRL A007) o The Contractor shall provide CM functions for all configration control items and required documentation o The Contractor shall provide a Software Version Description (SVD) for all items under Configuration

Management (CDRL A009) o The Contractor shall provide a Software Implementation Plan (SIP) for each release (CDRL A016) o Upon successful completion of the SI CV&I phase and TRR I has been completed, the Contractor shall deploy the the release into the test environment to support the Government’s execution of QT&E and UET o The Contractor shall support the Government Test phases identified as QT&E as well as User Evaluation

Testing (UET) as requested by the Government. UET can contain ad-hoc testing conducted by end users of the system o Upon approval of the successful release migration onto the training environment, the Contractor shall migrate the release into the production environment o The Contractor shall maintain software and data backups to be used for refresh efforts during testing o The Contractor shall provide to the Government all developed, modified, or converted source modules, processes, programs, scripts, operating instructions, databases, system files, documentation, test files and test conditions used to develop each approved systems change request.

o The Contractor shall resolve Government approved Discrepancy Reports (DR), Problem Reports (PR), Software Program Reports (SPR), and Information Support Request (ISR) within required timeframe (unless alternately specified, and agreed to by the Contractor and the PMO); see APPENDIX B for DR/PR/SPR/ISR Commented [HLBGUAA19]: Update appendix b with

SPR

Severity Ratings and Resolution Thresholds

3.1.10 Maintenance and Surveillance

The Contractor shall proactively monitor the performance of all CAV AF items; examples include, but are not limited to items that:

o Perform beginning and end-of-day database extracts o Generate and deliver CAV AF required reports and metrics o Process inbound and outbound data across all approved CAV AF interfaces o Process error files and system logs

The Contractor shall document new and/or updated interfaces, using the Corporate Data Repository System (CDRS), for consideration and approval by the Functional community and the PMO via Interface Control Documents (ICD), Service Level Agreement (SLA), Memorandum of Understanding (MOU) and Memorandum of Agreement (MOA).

3.1.11 Database Administration

o The Contractor shall document and perform Oracle database management administrative functions, to include but not limited to analyzing, planning, and implementing the import and export of data, maintaining application data and data structures, security, troubleshooting performance issues, maintaining data integrity, maintaining optimal performance, memory allocation and database tuning, configuring security controls, coordinating data backups, performing data restoration, maintaining configuration control, implementing user administration and access control, as well as testing, installing, upgrading and configuring relational database management software.

o The Contractor shall create and maintain documentation describing the database as deployed to encompass

CAV AF dictated structure, parameters, and configuration as well as Contractor designed extensions to enable CAV AF functionality (CDRL A004) o The Contractor shall document database diagrams and procedures to include an Entity Relationship Diagram

(ERD), a Physical Data Model (PDM) and a Logical Data Model (LDM); these will be analyzed and updated for impacts at each release (CDRL A004) o Upon receipt of CAV AF application and design documentation the Contractor shall analyze, plan, and schedule database upgrades and/or updates necessary to accommodate recommended design updates o The Contractor shall prepare and submit red-lined version of DBDD, ERD, PDM and LDM documentation that encompass all recommended upgrades and/or updates to the database (CDRL A004) o Upon Government approval of the Contractor’s release deployment schedule, the Contractor shall implement approved upgrades and/or updates to the database (CDRL A008) o The Contractor shall monitor NIST notifications and TCNOs for database items releavent to the CAV AF application o o The Contractor shall keep the CAV AF database secure and up to date with any IAVAs, STIGs, and patches.

Commented [HLBGUAA20]: How do I ensure I get this?

Formatted: Indent: Left: 0.25", Hanging: 0.25", No bullets or numbering

3.1.12 Database Maintenance and Surveillance

o The Contractor shall establish a database performance profile to include industry standard measures of performance with corresponding threshold targets necessary to meet Government CAV AF Materiel Solution availability requirements; in addition the Contractor shall document and implement database log monitoring processes to identify non-standard database events and trends (CDRL A013) o Upon acceptance by the Government, the Contractor shall document initial database performance baselines against each measure o The Contractor shall implement procedures and tools to detect and diagnose database performance issues and problems, conduct root cause analysis, report monthly database performance metrics and document recommended actions to resolve identified negative variances from database performance thresholds o The Contractor shall monitor, apply, and test modifications in support of a release, patch updates, and security updates on a monthly scheduled basis or emergency basis, as required o The Contractor shall recommend, and upon Government approval, perform upgrades to the Oracle database o The Contractor shall load production data into the development, test, and/or training environments , as required o The Contractor shall create and test backups of data, provide data cleansing services, verify data integrity, and implement access controls o The Contractor shall manage the creation, modification, suspension and deletion of database accounts as directed by the Government o The Contractor shall prepare a Database Change Request (DBCR) using the Government approved form and obtain Government authorization prior to implementing any database or data modification

3.1.13 Release Management

The Contractor shall develop and deploy a minimum of three CAV AF Materiel Solution releases per year if approved changes have been assigned to a release by the CCB. The Contractor shall deploy releases per year, as required. The Contractor shall deploy PR, DR, and SPR fixes as approved by the Government.

The scope of CAV AF Materiel Solution releases are dependent upon the unique set of approved requirements for each release and may include new or modified application files, Contractor managed items, upgraded or re-configured COTS hardware/software, as well as database upgrades and/or alterations to database structures, parameters and processes.

Upon Government approval of all applicable requirement documents associated with a CAV AF Materiel Solution release, the Contractor shall develop, maintain, and provide to the Government a Work Breakdown Structure (WBS) and Integrated Master Schedule (IMS), using Microsoft Project, for all activities specific to that release. This information will be submitted to the Government as an Integrated Program Management Report (IPMR) (CDRLs A008, A021) o The Contractor’s release deployment schedule shall encompass all efforts that must be executed to properly

Commented [HLBGUAA21]: Ne to look at again… acceptance

Commented [HLBGUAA22]: Should this be separate bullet; will this be covered by cybersecurity?

Commented [HLBGUAA23]: Goes with implementation of access controls develop, test, and deploy the updated CAV AF Materiel Solution; at a minimum it shall include durations and threshold dates for:

COTS Hardware/software product acquisition RICE object development Software development Test environment preparation Execution and documentation of CV&I, QT&E, and UET Materiel Solution release deployment in both training and production environments Post-implementation testing and validation Durations of Government actions as well as decision threshold date assumptions upon which the

Contractor’s estimated schedule is dependent Release Milestones Contract deliverable development, update and delivery o The Contractor shall schedule and hold design walkthroughs, code walk throughs, and test walk throughs meetings with the Government and select Users for each release.

o The Contractor shall execute each release deployment schedule once it has been coordinated and approved by the Government; the Contractor shall report execution risks and issues to the Government as soon as identified o The Contractor shall provide status reporting for the IMS of all release deployment schedule activities beginning at Government approval through completion of post-implementation validation (CDRL A008) o The Contractor shall maintain release files and maintain configuration control of all CAV AF release files deployed to all environments (currently Development, Test, Production and Training) o The Contractor shall notify the Government of all issues with CAV AF release files, including NAVSUP

BSC release files, documentation and/or installation instructions as soon as such issues are identified and provide the Government written documentation of any resulting quantified impact to the Contractor’s estimated release deployment schedule for the Government’s consideration and approval, if applicable o The Contractor shall delivery the Computer Software Product (CSP) at and participate in TRR I (CDRL

A019) o o The Contractor shall facilitate Requirements Review and walkthrough events to support clarification and communication of AF requirement(s) (CDRL A021) o o The Contractor shall support the performance of regression testing to ensure existing capabilities and functionality has not been diminished or damaged by changes or enhancements introduced by a software release (CDRLs A006, A007) o The Contractor shall ensure that the test environment is prepared and necessary documentation and files are in place to support all test events; to include load of appropriate production data, process and procedure documentation, and delivered software code o When testing reveals that CAV AF developed codefails to implement approved requirements or has diminished or damaged existing capability, the Contractor shall document the discrepancy and create the

Commented [HLBGUAA24]: This is out of place; need to find new home appropriate Government approved documentation to track the problem to resolution o The Contractor shall resolve any Problem Reports identified during testing; see APPENDIX B for

DR/PR/SPR Severity Ratings and Resolution Thresholds o If corrective Contractor action is necessary, and testing resumes, all tests including those previously completed related to the failed test and the corrective action shall be repeated and successfully completed by the Contractor prior to Government acceptance (CDRL A007) o The Contractor shall update the documented procedures utilized to successfully deploy the CAV AF Materiel

Solution to the test environment (includeing NAVSUP BSC items, CAV AF application, RICE objects, database upgrades and/or updates) and submit to the Government (CDRL A016) o The Contractor shall deploy the CAV AF Materiel Solution to the training environment in accordance with its release deployment schedule in order to validate its System Implementation Plan (SIP) prior to deployment to the production environment o The Contractor shall deploy the CAV AF Materiel Solution to the production environment in accordance with its release deployment schedule and the SIP and conduct subsequent post-implementation testing to validate successful deployment

3.1.14 15 Environment Management o The Contractor shall provide a GFP Report and an ODC renewal schedule, documenting each items part number, serial number, Contractor and Government Entity Code, purchase date, warranty details, maintenance agreement details, certificate information, license information, quantities, support status, cost, configuration and condition of GFP in the Contractor’s possession (CDRLs A018, A008) o The Contractor shall be responsible for procurement and timely delivery/installation of all items referenced in

Appendix A and C and any newly purchased licenses, hardware and/or software items

The Contractor shall ensure the current Internet Service Provider (ISP) Service Level Agreement (SLA) performance minimums as referenced in Appendix B are met for the CAV AF hosting environment

The Contractor shall ensure all hardware/software maintenance support and/or licenses as referenced in

Appendix A are renewed prior to expiration o If the Contractor identifies hardware/software acquisition, upgrades, or other recommendations, license or maintenance renewal requirements as well as related required contracted services that would qualify for acquisition via the ODC CLIN of this contract that are not referenced in Appendix C:

The Contractor shall provide the Government with a purchase request that includes at least three supporting, comparative cost estimate quotes for a solution(s) to the ODC requirement; in absence of three quotes the Contractor shall provide sole-source justification or rationale acceptable to the CAV AF Contracting Officer that justifies limited availability of sources

The Contractor shall await documented CAV AF Contracting Officer approval of its purchase request and notice of modification of the CLIN prior to acquiring recommended GFP

Once purchase has been installed and/or accepted by the government, the Contractor shall provide an

Commented [HLBGUAA25]: Include appendix title

Commented [HLBGUAA26]: Add title of appendix;

throughout the PWS

Commented [HLBGUAA27]: Need to relook…who is doing the recommending and it wouldn’t be GFP until we accept the ODCs; recommend changing it to “items” as this will include software, licenses, hardware, services….

updated GFP report and update the ODC schedule .

o The Contractor shall register and maintain all CAV AF GFP in accordance with (IAW) manufacturer instructions/guidelines o The Contractor shall ensure all hardware / software proposed for acquisition is referenced on the DISA

Universal Capabilities (UC) Approved Product Listing (APL) , has an accepted reciprocal approval or has documentation certifying the hardware / software proposed for acquisition has successfully completed Interoperability and IA testing. When necessary, the Contractor shall test and develop the appropriate documentation to have the item added to the APL or accepted under the reciprocal approval process.

o The Contractor shall comply with the May 11, 2017 Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.