DAF ICAM Enterprise III PWS for RFI.pdf

Performance Work Statement (PWS)

For

Program:

Department of the Air Force (DAF)

Identity, Credential, and Access Management (ICAM)

Enterprise III

1. Background:

The Department of the Air Force (DAF) is undergoing a critical cybersecurity transformation aligned with the Department of War's (DoW) 2019 Digital Modernization Strategy, which aims to revolutionize network-focused defense-in-depth approaches into a data-centric Zero Trust

Architecture (ZTA). This strategic shift recognizes individual data as a strategic asset and requires the DAF to evolve toward a comprehensive Identity, Credential, and Access Management (ICAM) foundation that serves as the cornerstone of modern cybersecurity operations.

The DAF landscape consists of multiple fragmented ICAM capabilities implemented on an ad hoc basis by individual application and system owners. This fractured identity environment includes organizational silos, disparate networks, and stove-piped systems that lack interoperability. These capabilities provide the foundational elements but do not deliver comprehensive credential management and access governance for the entire DAF user population.

To address these challenges and limitations, the DAF ICAM solution was developed to function as the single DoW approved ICAM solution for all DAF applications and systems operating on the

Department of War’s Non-classified Internet Protocol Routing Network (NIPRNet). DAF ICAM supports the full range of activities related to the creation of digital identities, maintenance of associated attributes, credential issuance, authentication, and access management decisions based on authenticated identities and associated attributes.

The DAF requires a vendor to perform three key functions for its existing DAF ICAM infrastructure and solution stack: Operations and Sustainment (O&S) to ensure day-to-day functionality and stability; system enhancements that include incremental improvements and new capabilities to address evolving threats, mission needs, and program requirements; and assisting over 3,000+ DAF application owners with the rapid enablement (aka onboarding) of their applications/systems that operate on NIPRNet to the DAF ICAM solution.

2. Objectives:

There are multiple distinct objectives of this contract. The first is to conduct Operations and

Sustainment (O&S) of the DAF ICAM environment which includes SailPoint IdentityIQ (IIQ) hosted in AWS GovCloud through Air Force Cloud One for Identity Governance and

Administration (IGA) and Okta’s government Software as a Service (SaaS) offering for Identity

Provider (IdP) services, Single Sign-On (SSO), Multi-Factor Authentication (MFA), and as the

Attribute Data Aggregator (ADA) via Okta Universal Directory (Okta UD). O&S activities include maintaining the day-to-day functionality and stability of the infrastructure and the long-term support needed to address cybersecurity, continued verification test management, technical support via tiered service desk support, and maintaining the DAF ICAM service/capability catalog.

The second is to perform System Enhancements to address evolving requirements, update security, deploy new capabilities to the solution stack, support and maintain DoW Federation identity and access management capabilities, integrate new data sources into the infrastructure, develop secure method for managing non-person entities (NPEs), and address Contested, Degraded, and

Operationally-Limited (CDO-L) environments (formerly known as Denied, Disconnected, Intermittent, or Limited (DDIL) environments).

The third, and most critical, is to enable 3,000+ DAF NIPRNet applications with the DAF ICAM solution within a three-year period. This objective requires conducting expert ICAM outreach and

“white glove” application enablement services through a repeatable, accelerated process. The process should efficiently and securely integrate applications into the DAF ICAM ecosystem, leveraging SailPoint IdentityIQ (IIQ) for Identity Governance and Administration (IGA), Okta for

Identity Provider (IdP) services for Single Sign-On (SSO) and Multi-Factor Authentication (MFA), and Okta Universal Directory (Okta UD) as the Attribute Data Aggregator (ADA). Various protocols such as Security Assertion Markup Language (SAML), Open Authorization (OAuth), OpenID Connect (OIDC), and other supported tools (e.g., SCIM for provisioning) will be utilized as necessary to ensure a smooth and compliant enablement experience for the 3,000+ applications.

3. Definitions:

The following definitions are provided for clarity and understanding of the effort:

• Application: A software program or set of programs designed to perform specific functions or tasks for end users. Applications operate within or on top of system platforms.

Applications are used for collecting, saving, processing, and presenting data by means of a computer that requires user or system authentication. For this contract, applications include DAF systems, workloads and enclaves, weapons systems, and control systems, including systems operated by contractors, external mission partners, or commercial cloud services on behalf of the DAF that are deployed on-premise, cloud-hosted, or as standalone infrastructure.

• Enablement: Logical network connections between the DAF ICAM technical stack and the target application such that all authentication and authorization requests are addressed by the DAF ICAM stack. Enablement of an application includes at a minimum the following capabilities: authentication of the users to the Okta IDP, entitlement management of user access defined and managed by SailPoint to include automated account provisioning. If an application requires alternative authentication, Segregation of Duties

(SOD), or audit reports, these shall be incorporated into the application enablement process.

• IdP Enablement: The strategic integration and configuration of centralized authentication services to align with ICAM framework requirements, enabling secure, standardized, and policy-driven identity verification across the enterprise ecosystem. IdP enablement requires target applications and systems to utilize secure, ZT compliant Authentication through the enterprise tooling for their target users in their production environment. IdP enabled applications should be able to satisfy all applicable Authentication based Zero

Trust capabilities and activities. IdP-enabled applications should enable users to authenticate using DoW PKI or approved alternate DoW MFA solutions as approved by the DoW MFA Working Group.

• IGA Enablement: The comprehensive activation and optimization of automated identity management capabilities to enforce ICAM policy frameworks, ensuring consistent application of access controls, compliance requirements, and risk management principles across all enterprise resources. IGA enablement requires target applications to utilize the enterprise capability for Authorization and entitlement management in their production environment. This includes but is not limited to providing automated SAAR capabilities, SOD enforcement where applicable, entitlement management and recertification campaigns. IGA enablement of Financially Auditable applications should allow applications to satisfy their Access control Audit compliance requirements as defined in the Corrective Action Plan.

• Successful Enablement: As stated in the basic definition for “Enablement”, successful enablement includes at a minimum both the capabilities of authentication of the users to the Okta IDP and the entitlement management of user access defined and managed by

SailPoint, to include automated account provisioning/deprovisioning. If an application requires alternative authentication, SOD, or audit reports, these shall also be incorporated into the application enablement process.

• System: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. This includes the complete infrastructure supporting the application environment.

• Solution Stack: The DAF ICAM Solution Stack leverages Okta Universal Directory as the Authoritative Data Aggregator (ADA), Okta Identity Provider for authentication services, and SailPoint IdentityIQ (IIQ) for identity governance, as well as a solution for

CDO-L operations. For this contract, the Solution Stack applies to the DAF ICAM solution for DAF NIPRNet applications.

• Enterprise Solution: A standardized information technology capability, service, or system that is centrally managed, organization-wide in scope, and designed to serve multiple components across a larger enterprise. DAF ICAM is the only DoW-approved ICAM solution for DAF NIPRNet applications.

• Development Environments: A computing environment specifically designed and configured to support the creation, modification, testing, and integration of software applications, systems, or components prior to deployment to production environments.

• Test Environments: A government-controlled computing environment specifically designed and configured to conduct systematic verification, validation, and evaluation of software applications, systems, or components to ensure they meet functional, performance, security, and operational requirements prior to production deployment.

• Production Environments: A government-controlled, live, operational computing environment where mission-critical applications, systems, and services are deployed to support actual DoW business operations, warfighter capabilities, and mission execution.

• Incident: An unplanned interruption to an IT service or reduction in the quality of an IT service.

• Vulnerability: A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited.

• Non-person entity (NPE): A digital identity for a non-human actor in cyberspace, such as a device, application, or service account. These are critical for automation, machine-to-machine communication, and accessing systems but can pose security risks if not properly managed.

4. Scope of Work:

4.1 Operations and Sustainment

The contractor shall provide specialized DAF ICAM Operations and Sustainment services, which include:

Secure Infrastructure Operations and Maintenance:

• Ensuring the day-to-day functionality, stability, and security of the DAF ICAM infrastructure, encompassing all hardware, software, and network components. This includes providing proactive monitoring, performance optimization, incident response, vulnerability management, security monitoring, and ensuring compliance with security policies and regulations such as NIST and Department of War (DoW) standards as well as necessary system upgrades and maintenance to sustain optimal operation and security of the infrastructure.

• Implementing rigorous verification processes throughout the system lifecycle to provide objective evidence that the DAF ICAM platform and its components fulfill specified requirements and characteristics, while conforming to required quality assurance standards.

• Providing ongoing support to DAF application owners following ICAM enablement. This includes expert guidance and best practices for leveraging the DAF ICAM platform within their applications and assisting with workflow implementation and modifications related to DAF ICAM integration. Proactive communication about platform updates, security advisories, and potential impacts will be provided along with clear escalation paths to Tier

2/3 support for platform-related issues.

Tiered Service Desk Support:

• Delivering comprehensive technical support through a tiered service desk model that seamlessly integrates with the DAF Enterprise IT as a Service (EITaaS) Tier 1 Service

Desk. Tier 2 and 3 advanced technical support is provided to users experiencing issues with

DAF ICAM services in coordination with DAF networking and cyber teams. Tier 4 support is coordinated with solution technology vendors such as Okta and SailPoint. The support knowledge base is actively managed and expanded to enable efficient self-service and issue resolution for users and application owners.

Service Catalog and Knowledge Management:

Maintaining and updating the DAF ICAM service/capability catalog to accurately reflect available DAF ICAM services (current and planned), including descriptions, service level agreements (SLAs), and request procedures.

4.2 System Enhancements

The contractor shall develop system enhancements to meet evolving requirements which include:

DAF ICAM Platform Evolution and Enhancement:

• Planning, developing, testing, and implementing enhancements to the DAF ICAM infrastructure, including new features and capabilities in Commercial Off-The-Shelf

(COTS) products, based on evolving business needs, security requirements, and advancements in technology.

• Rapidly prototyping, testing, and integrating new and emerging technologies into the DAF

ICAM environment, aligning with DoW and DAF mission needs.

• Evolving and enhancing federated identity and access management capabilities with other

DoW components, enabling seamless and secure access to resources across organizational boundaries.

• Integrating new data sources into the DAF ICAM infrastructure, ensuring proper data mapping, transformation, and synchronization with both internal and external services.

Identity Management for All Entities:

• Establishing and maintaining a robust and secure system for managing Non-Person Entities

(NPEs) within the DAF ICAM framework, ensuring proper authentication, authorization, and lifecycle management.

Access Management in Degraded Environments:

• Designing, implementing, and managing mechanisms to successfully maintain ICAM operations during transitions between connected and disconnected states in CDO-L environment including attribute transfer from SIPRNet or NIPRNet Enterprise solutions.

4.3 Application and Systems Enablement

The contractor shall provide DAF ICAM application enablement services, which includes:

• Specialized professional, or “white glove”, services to manage and execute the mass enablement of DAF applications/systems, conducting integration tasks, guiding users through the entire enablement process, assisting with User Acceptance Testing (UAT), and ensuring compliance with all applicable government regulations, policies, and documentation requirements. This effort involves complex coordination between application owners, security teams, end-users, operations and sustainment support of the platform/technical stack, and the enhancement activities to ensure applications are integrated securely and efficiently, with a seamless transition for the DAF user base.

• Developing and implementing a comprehensive communication and enablement strategy designed to engage application owners and other external stakeholders effectively. This strategy will include a thorough stakeholder analysis to identify and address the needs and interests of key stakeholders and the creation and dissemination of tailored content through multiple channels to ensure broad and effective communication. This will require the development of engaging materials, such as videos and presentations, to support outreach efforts and guide application owners through the enablement process. Furthermore, robust training resources and job aids for various user roles will be made accessible through a dedicated DAF ICAM website.

• Conducting extensive outreach activities to establish initial contact, educate, and develop working relationships with the application owners for accelerating the enablement of the

DAF ICAM solution for their applications. It is essential to the success of the program to engage the application owners, secure their buy-in, and motivate them into full participation for DAF ICAM enablement.

• Developing, implementing, and managing the processes to conduct and monitor enablement, address challenges, and review progress of the mass enablement of DAF systems/applications into SailPoint IIQ and Okta IdP solutions.

• Verification will be focused on the utilization of the DAF ICAM capabilities to enable applications and systems to meet the relevant milestones, capabilities, and activities in the

DoD Zero Trust Execution Roadmap and satisfy the DoD Zero Trust Policy. Verification will be considered effective upon successful demonstration at UAT. Validation will consist of a DAF ICAM-initiated audit cycle that matches network traffic to enabled apps to operations within the DAF ICAM technical stack logs demonstrating that DAF ICAM is being used for authorization.

• Strategizing, expanding, and applying continuous improvement processes to the enablement process and activities on the contract.

• Building guided, scalable, instructional playbooks for application enablement.

• Defining the various types of application enablement actions across low/med/high complexity paths:

• Low Complexity – One to two story points or equivalent level of effort by enablement team required to integrate. For example: a modern web application capable of supporting SAML or OIDC authentication with active support from a team that is already aware of their access control policies. Low complexity apps should largely be capable of self-service onboarding if provided the proper documentation and tooling.

• Med Complexity – Three to five story points or equivalent level of effort required by enablement team to clarify and finalize the integration and maybe 1-2 manual tasks.

For example: an application or system not capable of supporting SAML or OIDC but can upgrade, or an application that does not have the proper support to define their policies or perform the integration. Medium complexity application require direct assistance from the DAF ICAM program to assist them in onboarding activities.

• High Complexity – Greater than five story points or equivalent level of effort to advise on integration path and multiple tasks. For example: High Complexity applications are legacy applications that cannot upgrade or large enterprise systems with many dependencies. High Complexity applications require large amounts of direct engagement with the DAF ICAM program to include potential infrastructure or policy changes.

• Providing the application owners with guidance and ”white glove” assistance with the application registration process, credential issuance and non-PKI based credentials for authorization, enrollment workflows, enabling Role Based Access Control (RBAC) and the redesign of the application’s access control module to maximally utilize Attribute-

Based Access Control (ABAC), UAT, and any defect resolution activities resulting from

UAT.

• Developing Enablement Approaches - To efficiently and effectively enable the DAF ICAM solution, the contractor will develop enablement approaches considering application prioritization (subject to government approval). Multiple factors will inform this prioritization. These include complexity, technical status/upgrades, external prioritizations

(i.e., audit readiness), and resource availability for application owners. The use of a do-it-yourself (DIY) approach with an accompanying instructional playbook may be appropriate for smaller, less complex applications (for example, those apps which are already using

OIDC and SAML). However, customized or tailored enablement approaches by the contractor may be necessary based on each application’s unique needs, type of current

ICAM implementation, size, complexity, legacy code, adherence to legacy standards and technologies, and especially for large/complex applications.

5. Performance Metrics:

The Contractor's performance will be measured against the following Key Performance

Indicators (KPIs) for each contracted activity:

5.1 Operations and Sustainment

• System Availability:

o Metric: Maintain system availability of 99.9% over a 30-day moving window, excluding scheduled maintenance windows.

o Definition of Availability: System availability is defined as the ability of users to successfully access and utilize all core functionalities of DAF ICAM.

o Definition of Downtime: Downtime is defined as any period where one or more core functionalities are unavailable to users due to unplanned system outages or failures. Planned maintenance windows will be scheduled in advance with the government and are excluded from the availability calculation.

o Reporting: Availability will be reported monthly, showing uptime, downtime, and the calculation for the 30-day moving window.

• 2. Tier 2 Support - Service Level Objectives (SLOs):

o Prioritization: Tier 2 Incidents are prioritized based on Impact (effect on system availability) and Urgency (effect on user productivity).

• Critical Impact Incidents: Affecting system availability (e.g., complete outage, major performance degradation).

o Metrics:

• Mean Time to Acknowledge (MTTA): All Tier 2 incidents must be acknowledged within 15 minutes.

• Definition of Acknowledge: Confirmation from a Tier 2 support engineer that they have received the incident report and are actively investigating.

o Mean Time to Repair (MTTR):

• Critical Impact Incidents: Repair within 4 hours.

• Definition of Repair: Restoration of system functionality to an acceptable level of performance for affected users. This may include workarounds or temporary solutions.

o Escalation Time: 100% of Tier 2 tickets that cannot be repaired within the

MTTR timeframe should be escalated to Tier 3 within 15 minutes of determining that escalation is necessary.

• Definition of Determining Escalation is Necessary: Tier 2 engineer, after following documented troubleshooting steps, determines that the issue requires expertise or resources beyond their capabilities. This determination must be documented in the ticket notes.

5.2 System Enhancement

• Capability Milestones: (TBD) Delivery of specific enhancements tied to milestones or dates, i.e., NPE support, CDO-L capabilities.

• Achieve a 99% success rate for deployments, with no critical issues or rollback events.

5.3 Application and Systems Enablement

• Application Enablement Rate: The number of applications successfully enabled per month (effective after 90-day spin-up period). Monthly application enablement goals are

TBD.

• Average Time-to-Enable: The average time required to enable an application from registration to successful onboarding: Average ≤ 45 calendar days.

• UAT Pass Rate: The percentage of applications that pass UAT without generating a

Deficiency Report as defined in TO 00-35D-54. Target: 95% first pass rate.

• Documentation Timeliness: Measured by the time the document is received compared to instructions in the DD Form 1423 Contract Data Requirements List (CDRL) and the

CDRL Preface, as applicable. Target is 98% on time.

• Documentation Quality: Contract Data Requirement List deliverables quality will be measured by the completeness, accuracy, and usability of documentation format and content in accordance with the CDRL Preface. Target 95% first time delivery approval.

• Effectiveness of communication with application owners: Measured through government executed satisfaction surveys to be conducted 60 days after successful UAT.

Target satisfaction of > 4.2 out of 5.

6. Contractor Responsibilities:

The following sections detail the contractor’s responsibilities for each of the objective areas of the contract.

6.1 Operations and Sustainment

The contractor shall provide the following operations, sustaining engineering, and other services to ensure the continuous availability, security, and operational stability of the existing DAF ICAM solution, while managing its configuration, monitoring its health, and providing structured support to its users.

6.1.1 DAF ICAM Maintenance

6.1.1.1 The contractor shall maintain and enhance the Okta solution. This includes managing baseline configurations, enabling certificate-based authentication, approved alternative authentication methods for all users, maintaining the interface to Air Force ID (AFID) services, and supporting the master user record with its associated data cleansing and validation processes.

6.1.1.2 The Contractor shall maintain the master user record and conduct data cleansing and validation from authoritative sources.

6.1.1.3 The Contractor shall assess the current SailPoint infrastructure for availability and scalability and provide recommendations for enhancements, including

Infrastructure as Code (IaC) pipelines and auto-scaling containers for web services

6.1.1.4 The contractor shall maintain and enhance the SailPoint IIQ solution in Cloud

One. This includes sustaining standard joiner, mover, and leaver (J/M/L) processes, access approval workflows, Segregation of Duties (SoD) policies, and access certification processes.

6.1.1.5 The contractor shall use and maintain Configuration as Code practices where applicable to manage configurations and automate enhancements, utilizing the

DAF-supplied toolset and code repository.

6.1.1.6 The contractor shall maintain a separate risk and issues log for the existing Okta and SailPoint deployments, assess system performance against requirements, and develop risk mitigation strategies. The Contractor shall identify and present enhancement opportunities for prioritization by the Government Change

Control Board (CCB), providing analysis of their cost, schedule, and value.

6.1.1.7 The contractor shall maintain and update all system documentation, including architecture diagrams, configuration baselines, support procedures, and network diagrams. The Contractor shall identify, plan for, and conduct the appropriate remediations to address the gaps in existing documentation. The contractor shall create new architecture diagrams for applicable system enhancements. CDRL B001 Technical Report- Study/Services, Subtitle:

Architecture Diagrams

6.1.1.8 The contractor shall use Government-furnished tools, such as ServiceNow and its associated Information Technology Service Management (ITSM) capabilities, for all service management and reporting activities.

6.1.1.9 The contractor shall continuously monitor the performance and health of all application and infrastructure components, including metrics such as CPU, memory, disk, and service availability. The Contractor shall mitigate and remediate any alarms or alerts that exceed defined thresholds.

6.1.1.10 The Contractor shall monitor and evaluate cloud resources and configurations to ensure costs remain within acceptable parameters.

6.1.1.11 The contractor shall perform routine backups of all system data and instances (e.g., EC2, RDS) and manage snapshots. The Contractor shall implement and test disaster recovery plans to ensure operational continuity.

6.1.1.12 The contractor shall run routine scans and make them available for C5ISR or the designated CSSP for DAF ICAM.

6.1.2 Service Desk Support

6.1.2.1 Multi-Tiered Service Desk Operations and SLA Management. The contractor shall establish, manage, and operate a comprehensive multi-tiered service desk function (Tier 2 and Tier 3) to provide operational and technical support for the

DAF ICAM solution for NIPRNet operations. The contractor shall integrate with the DAF EITaaS Service Desk for Tier 1 coordination, ensuring appropriate contractor personnel are assigned to the correct resolver groups with necessary access. The contractor shall establish, document, and adhere to

Service Level Agreements (SLAs) for incident response and resolution, including metrics for Mean Time to Acknowledge (MTTA) and Mean Time to

Repair (MTTR) aligned with Government objectives, and exceed SLA targets for Tiered Service Desk Support.

6.1.2.2 Tiered Support Services and Workflows. The contractor shall provide Tier 2 technical support (8 hours/day, 5 days/week, with after-hours on-call for Major

Incidents) to resolve incidents escalated from Tier 1. The Tier 3 support shall be staffed by Subject Matter Experts (SMEs) to perform deep-dive root cause analysis for complex or recurring incidents. The contractor shall develop, document, and maintain comprehensive ticket resolution workflows for both

Tier 2 and Tier 3 support levels. For undocumented issues resolved at any tier, the contractor shall coordinate with the EITaaS Service Desk to create new knowledge articles to enable future resolution at appropriate lower tiers. SMEs shall develop and implement permanent fixes to resolve underlying problems identified through root cause analysis.

6.1.2.3 Knowledge Management and Continuous Improvement. The contractor shall maintain and enhance knowledge management capabilities across all support tiers, including: maintaining the Tier 1 knowledge base (guides, playbooks, and training packages) delivered under Applications and Systems Enablement;

collaborating with the EITaaS Service Desk to continuously improve Tier 0 self-service capabilities through user-facing knowledge articles, FAQs, and troubleshooting guides; and conducting regular training sessions for Tier 1 personnel on new service resolutions, common troubleshooting procedures, and knowledge base updates.

6.1.2.4 Proactive Monitoring and Analysis. The contractor shall perform continuous trend analysis of incident data to identify systemic issues, recurring problems, and service improvement areas, providing monthly reports detailing corrective actions, SLA performance, and recommendations to reduce ticket volume. The contractor shall proactively monitor system performance to identify and remediate potential issues before user impact, performing preventative maintenance and system upgrades per Government change control procedures.

6.1.2.5 The contractor shall provide Tier 1 technical support for DAF applications on

SIPRNet (8 hours/day, 5 days/week, with after-hours on-call for Priority 1 incidents) in coordination with DISA managed E-ICAM enablement activities, including development and maintenance of SIPRNet-specific ticket resolution workflows and knowledge articles.

6.2 System Enhancements

The contractor shall conduct analysis, design, and develop enhancement solutions to improve the capabilities of the DAF ICAM Solution Stack to align with ZT standards, expand capabilities, introduce new functionality, and establish a framework for continuous improvement.

6.2.1 The contractor shall develop, maintain, and prioritize a capability tool/list to plan, project, and track the completion of DAF ICAM solution stack enhancements. The tool should include descriptions, service level agreements (SLAs), and request procedures. An example is available as GFI. CDRL B002 Technical Report- Study/Services, Subtitle: DAF ICAM

Service/Capability Catalog

6.2.2 The contractor shall elicit and incorporate best practices from other DoW, Federal, and commercial ICAM implementations to accelerate progress and ensure architectural alignment with industry standards.

6.2.3 The contractor shall employ Configuration as Code and Infrastructure as Code (IaC) methodologies using DAF-supplied tools to maintain configurations and automate the deployment of new enhancements.

6.2.4 Create and maintain all relevant architecture, design, and configuration documentation in a DAF-specified repository.

6.2.5 The contractor shall design and implement the following specific Identity Provider (IdP) enhancements for the Okta product:

6.2.5.1 Manage and mature baseline configurations, global security controls, conditional access policies, and Attribute-Based Access Control (ABAC) to support dynamic access enforcement.

6.2.5.2 Ensure robust, platform-native Certificate-Based Authentication (CBA) and

CAC credential binding for the user population.

6.2.5.3 Integrate with DAF security tools (e.g., Security Information and Event

Management (SIEM), Security Orchestration, Automation and Response

(SOAR), User and Entity Behavior Analytics (UEBA)) by configuring log relaying and supporting the development of threat detection logic and response playbooks.

6.2.5.4 Add additional approved MFA solutions based on customer need and DoD approval

6.2.6 The contractor shall design and implement the following specific Identity Governance and

Administration (IGA) enhancements for the SailPoint product:

6.2.6.1 Implement and mature standard, robust Joiner/Mover/Leaver (JML) lifecycle processes aligned with ZT principles.

6.2.6.2 Develop and deploy reusable access approval workflows, role rules, Segregation of Duties (SoD) policies, and access certification processes for use across applications.

6.2.6.3 Establish a CI/CD pipeline using DAF-provided tools to automate testing and deployment from lower to higher environments.

6.2.6.4 Enable audit reporting and other desired reports

6.2.7 The contractor shall plan and execute the transition of legacy AFID services and customers to the Okta Authoritative Data Aggregator (ADA). This includes defining a Master User

Record (MUR), integrating with authoritative data sources, and managing a prioritized customer cutover.

6.2.8 The Contractor shall maintain the interface between ADA and AFID to pull DAF CAC holder identities, followed by a larger effort to subsume AFID into ADA

6.2.9 The contractor shall develop, deploy, and maintain a standardized interface layer (REST

APIs, LDAP) to enable consuming services to securely access identity data. The contractor shall maintain the established federation interfaces with the DoD federation hub, which can include configuration changes, adding attributes to the federation scope, or exchanging with other federated partners to ensure consistency.

6.2.10 The Contractor shall analyze and document CDO-L requirements and use cases relevant to

DAF requirements.

6.2.11 The contractor shall design and implement CDO-L solutions for NIPR and SIPRNet that align with the DoD CIO memo directing the services responsibility for CDO-L. The solution shall provide a resilient ICAM services stack to the contested and operationally limited environments, conforming to ZT standards. This includes implementing a proof-of-concept for attribute transfer from SIPRNet or NIPRNet Enterprise solutions to a CDO-

L environment.

6.2.12 The contractor shall assess existing DAF Privileged Access Management (PAM) solutions and PAM-supported application enclaves to determine technical integration requirements, required changes to existing access workflows, and required accreditation support and align the results with government-defined PAM requirements to design the IGA and ICAM solutions for compatibility with DAF current and future PAM solutions.

6.2.13 The Contractor shall integrate the designated PAM solution(s) to govern and monitor privileged accounts and activities. This may entail identifying the interfaces and protocols required for the interface and the attributes needed or other needed connection configurations.

6.2.14 Implement an enterprise service to govern an estimated five million NPEs. This includes performing NPE discovery, defining attribute schemas and a Master Device Record

(MDR), integrating with authoritative NPE data sources, and designing a governance process for system NPEs within SailPoint.

6.3 Application and Systems Enablement

The contractor shall provide the following application enablement services to systematically migrate the DAF’s entire portfolio of over 3,000 NIPRNet applications from disparate, legacy identity systems onto the centralized, modern DAF ICAM technical stack.

5.1.1 The contractor shall perform outreach activities utilizing government provided data sources to proactively identify and register all ICAM relevant applications in the DAF. Outreach activities include initial contact with the application owners as directed by the government using targeted communication tactics (email, phone, etc.), gathering information needed for the DAF ICAM enablement processes, and maintaining a technical working relationship with the application owner throughout the enablement process, developmental testing, UAT, and production environment testing, as applicable. The DAF ICAM Program

Management Office (PMO) will provide guidance, prioritization direction, and assistance throughout the outreach process.

5.1.2 The contractor shall provide technical support for all the activities of the enablement effort.

These activities include, but are not limited to:

• Technical assistance during application enablement

• Integration guidance and implementation support for the DAF ICAM solution

• Engineering support for technical integration challenges

• Responsive support for customer inquiries and technical questions throughout the contract period, including after successful UAT

5.1.3 The contractor shall identify the application’s current authentication and access management configuration, analyze the level of effort required for enablement of the DAF

ICAM solution, categorize the complexity of the applications (See Section 4., Scope of

Work), and apply this data in the development and implementation of the enablement processes of the DAF ICAM solutions for each application.

5.1.4 The contractor shall develop and implement a standardized application enablement process that provides comprehensive capabilities for integrating applications with the DAF ICAM enterprise solution. This process will include:

• Accelerated workflows for application enablement

• Providing clear documentation and guidance for application owners throughout the enablement process

• Standardized procedures for identity and access management implementation

• Quality assurance checkpoints to ensure successful integration

5.1.5 The contractor shall establish both outreach and enablement execution teams comprised of personnel with the diverse specialties and expertise in the areas required to support the varying project requirements. Team composition and size should be dynamically adjusted to meet their intended objectives based on:

• Objective evaluation of project phases and technical requirements

• Current workload demands and enablement complexity

• Skills and specialties needed for specific enablement activities

• Objective assessments of resource requirements and team effectiveness

5.1.6 The contractor shall demonstrate the ability to efficiently manage these dynamic team adjustments while maintaining continuity of operations and preserving institutional knowledge throughout the enablement process.

5.1.7 The contractor shall make an initial determination within 90 days of contract award of the general distribution of low, medium, and high complexity applications within the population and begin conducting enablement efforts based on the representative sample distribution of the population as a whole. This determination will be iteratively updated as applications are contacted and assessed until a statistically relative sample has been established.

5.1.8 The contractor shall develop (and/or update any government furnished) instructional playbooks that provide repeatable, enactable instructions for applications to progress from initial assessment to full DAF ICAM enablement, as defined by the PMO. These playbooks will detail the steps for completing enablement, covering a playbook for common core capabilities and additional playbooks for variations based on unique application use cases.

The playbooks shall be designed for a variety of audiences including but not limited to end users, administrators, developers, auditors, and cyber operators.

To the greatest extent possible, the contractor shall adhere to documentation supplied by

Okta and SailPoint in the conduct of DAF ICAM enablement. The playbooks will expand upon this documentation by outlining any additional activities required for complete enablement. When an application analysis reveals that the current documented integration with the stack requires deviation, the contractor shall develop specific playbooks to address those deviations. The playbooks will be logically divided into a high-level base playbook for common capabilities and then extension playbooks tailored to infrastructure commonly found on the network, such as Salesforce, Oracle, ServiceNow and other baselines/platforms. The contractor shall identify all necessary enablement activities and incorporate them into the playbooks.

The contractor shall establish and maintain a playbook repository for use as the central repository for all application enablement instructions that can be drawn from to document individual application configuration activities. As enablement activities progress, the contractor’s process should include a check of the playbook repository after an application analysis identifies a need for deviation to see if an existing playbook is available to address the situation. If no suitable playbook exists, the contractor shall develop a new playbook for the deviation and add it to the repository.

These playbooks will be used individually or combined to guide application owners in self-enablement and UAT. Complex applications may require multiple playbooks and "white glove" assistance to complete enablement and UAT. The contractor shall assess the playbooks on a quarterly basis to address updates as needed based on lessons learned and evolving standards. CDRL B003 Technical Report- Study/Services, Subtitle: Instructional

Playbooks

5.1.9 The contractor shall establish the logical network connections between DAF ICAM technical stack and the and the target application/system that will handle 100% of user authentication requests via Okta IdP in a production environment. The government expects the contractor to use existing connectors available from the Okta products of the solution stack. The contractor may establish support for alternative credentials for application users.

5.1.10 The contractor shall establish the logical network connections between the DAF ICAM technical stack and the target application/system so it will handle 100% of user access management via the SailPoint IGA in a production environment, to include automated account provisioning. The government expects the contractor to use existing connectors available from the SailPoint product of the solution stack. If needed, the contractor shall implement SOD or audit reports for the application.

5.1.11 The contractor shall provide direct assistance in the enablement of applications/systems by supporting application owners who are not self-enabling throughout all phases of the enablement processes to include UAT.

5.1.12 The contractor shall review and provide feedback on the current DAF ICAM foundational training to identify areas needing enhancement or correction. Foundational training and/or Tier 0 includes introductory materials, concepts, overviews, benefits, goals, policy, and guidance. Based on this review, the contractor will develop and submit proposed revisions to the training materials to the Government for approval.

5.1.13 The contractor shall develop and deliver training to promote the adoption and effective use of DAF ICAM. This training, covering both awareness and self-service activities

(Levels 0 and Tier 0, respectively), will specifically address the following:

• ICAM and Zero Trust Awareness (Level 0): Provide all DAF personnel with a foundational understanding of ICAM fundamentals and Zero Trust principles.

• Application Owner Self-Service Onboarding (Tier 0): Enable application owners of

"low-complexity" applications to independently integrate their applications with the

DAF ICAM solution.

• Application Owner Enablement Updates (Tier 0): Provide ongoing training and updates to all application owners who have already completed initial enablement, ensuring they remain proficient in utilizing the DAF ICAM solution's evolving features and capabilities.

The contractor will develop self-guided training courses for DAF personnel and application owners, using a blended learning approach (online modules, simulations, and documentation). This training will:

• Provide DAF personnel with a general understanding of DAF Identity, Credential, and Access Management (ICAM) concepts.

• Equip application owners of low-complexity applications to independently integrate their applications with DAF ICAM, utilizing provided tools and instructional playbooks.

• Enable all application owners to maintain their application's DAF ICAM integration.

The contractor may propose additional foundational and enablement training topics for government consideration. CDRL B004 Technical Report- Study/Services, Subtitle:

Enablement Training Packages

5.1.14 The contractor shall develop and deliver Type-1 Special Contract training packages in support of the DAF ICAM solution Tier 1, 2, and 3 accordingly. The contractor shall conduct instruction of these courses to AF personnel from the “train the trainer” perspective. The contractor shall reference the government furnished Draft DAF ICAM

Training Plan as a guide for how to present DAF ICAM information/training. The plan provides a Training Framework Overview in Section 3 and outlines role-specific content associated with the Tier 1 training under Section 4.21 and the Tier 2/3 training under

Sections 4.2.2 and 4.2.3.

Training modules shall be structured by functional role and technical focus, progressively building from foundational understanding to advanced implementation. Training should incorporate a blended learning approach where applicable: Instructor-led, Simulation

Exercises, and Documentation & Knowledge Base. CDRL B005 Technical Report-

Study/Services, Subtitle: Type 1 Special Contract Training Packages

5.1.15 The contractor shall update and/or develop and deliver up to 20 various 1 to 10-page guides for use by users, administrators, and developers to facilitate the acceleration of the enablement processes. These guides may include but are not limited to Non-CAC User

Guide, SAAR Overview User Guide, SailPoint Access Request User Guide, DAF ICAM

Okta Attributes Guide, Overview of Okta Authorization Servers, Overview of SAML and

Assertions, Overview of the Onboarding Process, and a DAF ICAM End-to-End Process

Document. Examples may be provided by the government. The government or contractor may identify the need for other specific guides to be developed with the government’s approval. CDRL B006 Technical Report- Study/Services, Subtitle: DAF

ICAM Guides

6.4 Cybersecurity

The contractor shall implement cybersecurity strategies to achieve and maintain a robust, compliant, and defensible security posture across the entire DAF ICAM technical stack while proactively managing risk in accordance with the Risk Management Framework (RMF) mandates.

6.4.1 The Contractor shall support cybersecurity activities to obtain ATO renewal and safeguard the DAF ICAM solution from cyber threats. This support shall include activities across

NIPR, NIPR and SIPR CDO-L, PAM, and NPE.

6.4.2 The contractor shall produce, process, and maintain all Assessment & Authorization

(A&A) package inputs in accordance with DoDI 8510.01 to obtain/sustain the system's

Authority to Test (ATT), Authority to Connect (ATC), and Authority to Operate (ATO).

This includes maintaining the eMASS records and RMF package documentation. CDRL

B007 DoD Information Assurance Certification and Accreditation Process (DIACAP) and

Risk Management Framework (RMF) Deliverable Data

6.4.3 The contractor shall prioritize correction of cybersecurity incidents identified in production, taking responsibility for remediation if vulnerabilities are introduced by the contractor.

6.4.4 If cybersecurity incidents are identified in production, the Contractor shall work with relevant cybersecurity teams and other Government personnel as appropriate to prioritize correction of these incidents. If the vulnerabilities identified are found to be introduced by the Contractor’s actions, the Contractor shall be responsible for remediation.

6.4.5 The Contractor shall confirm system application deliverables comply with DoD and DAF

Information Assurance (IA) policies to maintain the latest available security protections and mandates.

6.4.6 The Contractor shall engage security authorization stakeholders for approval of system-related changes prior to implementation to mitigate impacts to system accreditation.

6.4.7 The contractor shall address vendor-reported vulnerabilities and the existence of known vulnerabilities and malicious code.

6.4.8 The contractor shall support Security Control Assessments (SCA) as part of A&A reauthorization, including inquiries, process examination, and document review.

6.4.9 The contractor shall support implementation of the Information System Continuous

Monitoring (ISCM) strategy.

6.4.10 The contractor shall develop, maintain, and deliver a Supply Chain Risk Management

(SCRM) Plan in accordance with NIST SP 800-53 Rev. 5 and 800-161. The contractor shall select and tailor applicable SCRM controls and document them in the SSP and the SCRM

Plan. The contractor shall incorporate Software Bill of Materials (SBOM) tracking to identify, assess, and mitigate risks in the software supply chain. B008 Supply Chain Risk

Management (SCRM) Plan

6.4.11 The contractor shall actively support the DAF in achieving and maintaining Service

Organization Control (SOC) compliance for the DAF ICAM solution. This support includes, but is not limited to, providing all necessary documentation, system access, and personnel assistance required for external SOC audits. The contractor shall adhere to the following milestones:

6.4.11.1 SOC 1 Readiness Assessment: The contractor shall support the completion of a SOC 1 readiness assessment by August 15, 2026. This includes collaborating with the designated audit firm, providing requested documentation related to internal controls over financial reporting (ICFR), and addressing any identified gaps in control design or implementation.

6.4.11.2 SOC 1 Type I Opinion: The contractor shall support the completion of a

SOC 1 Type I audit and opinion on the design of controls by August 15, 2027.

This includes providing evidence of control design, participating in walkthroughs, and responding to auditor inquiries.

6.4.11.3 SOC 1 Type II Opinion: The contractor shall support the completion of a

SOC 1 Type II audit and opinion on the design and operating effectiveness of controls by August 15, 2028.