Data Management and Governance Support - Draft Performance Work Statement.pdf

Page 1 of 18 Pages

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Award

Contract Number: (completed by the KO at time of contract or TO award) Task Order Number: (completed by the KO at time of TO award or N/A) Contractor Name (completed by the KO at time of contract or TO award) Tracking Number: 632469116 Follow-on to Previous Contract and Task Order Number:

47QTCB21D0164 HC104721F2108

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator. See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Data Management and Governance Support.

3. Background. This requirement is derived from the Department of Defense (DoD) mission directive mandating the DISA Chief Data Officer (CDO) and the broader DISA community to utilize data as a strategic asset. The DISA Chief Data Officer’s primary role is to ensure that timely high-quality data is available to internal and external stakeholders to fulfill mission requirements. Office of the Chief Data Officer (OCDO) is responsible for setting the vision and goals for change, and providing the enabling architecture, standards, governance, and inform DISA-wide talent management plans that will empower DISA organizations and the systems they operate to leverage and act upon quality data at speed and scale. As such, they maintain and update the strategic framework for ensuring DISA data is secure, visible, accessible, understandable, linked, trustworthy, interoperable, and secure with and across every function, mission area, and domain of operations to deliver decision advantage. DISA OCDO works in collaboration with strategic partners to leverage data to support, enhance and execute the mission. They partner with appropriate analytic organizations to conduct unique use cases, peer review, programmatic development, and technological assessments to provide capabilities that inform the decision-making process and enable data-driven decisions.

4. Objectives. DISA has a need to maintain an OCDO to manage data as a strategic asset and to create, implement and maintain an overall data management strategy. These high-level objectives reflect the need for improving and establishing organizational data quality, standardization, integrity, availability, accessibility, usability, and sharing best practices at an enterprise level, to ultimately improve decision making throughout the agency.

This shall be done in a way that maintains a formal data governance steering committee and working groups, data quality and data management/governance policies, an enterprise-wide data asset inventory, business glossary, data maturity model and strategy, developing an authoritative data source registry, governance, and approval process, metadata and master data management, the DISA Data Catalog, and a self-service data analytics environment.

5. Scope. The purpose of this contract is to obtain contracted subject matter expert support to advise on and/or perform data preparation and architecture, development of agile algorithmic solutions, evaluate and/or execute data governance and data maturity models; create data policy framework and conduct a framework assessment and create data catalog structure; and evaluate and advise on enterprise data platforms, data metadata management, and data analytics.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 45% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

Page 2 of 18 Pages

6. Performance Requirements.

6.1 Task 1 – Project Management.

6.1.1 Subtask 1 – Overarching Project Management. The contractor shall provide a single point of contact who shall be authorized to interface with the Government Contracting Officer (KO), COR, Government management personnel, and customer agency representatives. The Project Manager is responsible for formulating and enforcing work standards, assigning contractor schedules, reviewing work discrepancies, supervising contractor personnel, and communicating policies, purposes, and goals of the organization to subordinates. The Project Manager is responsible for overall contract performance and shall provide the COR and OCDO Leadership with a Monthly Status Report.

The Project Manager shall attend a weekly informal sync with DISA OCDO leadership to discuss contractual and task status and issues. The Monthly Status Report shall also contain status of adherence to/progress against FAR 52.219-14 Limitation on Subcontracting.

The contractor shall attend a Government hosted kickoff meeting within 30 calendar days prior to the start of contract performance, but not later than (NLT) three business days before the start of contract performance. The kick-off meeting will be held for Government management introductions and preliminary COR on-boarding procedures.

The contractor shall host a Technical Interchange Meeting (TIM) to ensure a common understanding between the contractor and the Government PMs on the contract requirements. The contractor shall describe the technical approach, the organizational resources, and management controls that will be utilized to meet the performance objectives and schedule requirements through the contract period of performance (PoP).

6.1.2 Subtask 2 – Weekly Activity Report (WAR). The contractor shall attend weekly OCDO meetings (Wednesdays unless rescheduled). The contractor shall deliver a WAR specifying actions, updates, deliverables, risks and issues pertaining to tasks 6.2-6.7. The Contractor shall also use the WAR to request changes to the Plan of Actions and Milestones (POA&M), which must be approved by the Government. The Contractor shall also address contractual issues in the WAR.

6.1.3 Subtask 3 – Transition-In Plan (TIP) for Contract and Continuity of Services. A smooth and orderly transition between the Contractor and the Government is necessary to assure minimum disruption to vital Contractor services and Government activities. Due to changes in contract deliverables. All personnel must possess at least an Interim Secret clearance prior to beginning performance under this contract/task order.

The Contractor shall provide a draft transition-in plan as part of the proposal. The Contractor shall provide a final transition-in plan within 7 calendar days after contract award. The transition-in plan shall include at a minimum all preliminary certifications required to initiate performance, the process for transitioning predecessor employees, status of recruitment for new employees, and a timeline showing procurement of required equipment, resources, etc.

6.1.4 Subtask 4 – Transition-Out Plan (TOP) for Contract and Continuity of Services. Prior to Contract expiration and after a follow-on contract is awarded, the Contractor shall exercise its best effort and cooperation to affect an orderly and efficient transition to a succeeding Contractor or the Government. A draft Transition-Out Plan is due ninety (90) calendar days prior to contract end date, with final version due sixty (60) calendar days prior to contract end date. During the closeout process and within sixty (60) days of final day of performance, the Contractor shall turn over all required incumbent equipment inventory, deliverables, training certificates, suitability information and security records to the successor.

Deliverables:

PWS

Task#

Deliverable Title

Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.1 Monthly

Status Report

Contractor- Determined Format delivered

10th calendar day of each month; if the 10th day falls on a weekend or

Standard Distribution*

Monthly

Page 3 of 18 Pages in MS Word or editable PDF holiday, submit on the first business day following the 10th

6.1.1 Contract

Kick-Off

MS PowerPoint slides; DoD365 Microsoft Teams meeting

Within 30 calendar days prior to the start of contract performance but NLT three business days before the start of contract performance

Standard Distribution*

Once at the start of base year

6.1.1 TIM MS PowerPoint

slides; DoD365 Microsoft Teams meeting

NLT 15 business days after contract start date

Standard Distribution*

Once at the start of the base year

6.1.2 Weekly

Activity Report

MS PowerPoint slide

Every Wednesday (unless rescheduled)

Standard Distribution*

Weekly

6.1.3 Draft

Transition-In Plan

Contractor- Determined Format delivered in MS Word or editable PDF

With Proposal Standard Distribution*

Once

6.1.3 Final

Transition-In Plan

Contractor- Determined Format delivered in MS Word or editable PDF

7 calendar days after contract award

Standard Distribution*

Once

6.1.4 Transition-

Out Plan

Contractor- Determined Format delivered in MS Word or editable PDF

Draft due 90 calendar days prior to contract end

Standard Distribution*

Once

*Standard Distribution: Delivery via email to COR and Government PM.

6.2 Task 2 – Data Acquisition, Preparation, & Architecture. The contractor shall perform tasks necessary to acquire data and develop a scalable technical architecture necessary to enable consumption of prepared datasets by the analytical and/or systems development communities in both cloud and on-premises environments at multiple security classification levels up to Secret. For example, develop data export standards and perform Extract- Transform-Load activities to maximize dataset exploitability, populate the system with metadata aspects (catalog, glossary, attributes, business rules), perform data feed automation using industry standard tools data sets, perform data quality and curation activities, generate synthetic data sets for Artificial Intelligence (AI)/Machine Learning (ML) algorithm training, synthesize multiple data sets into common formats for efficient storage and rapid processing (e.g., Structured Query Language (SQL) to parquet), ensure data sets are machine readable, tagging data for transport data up and down across multiple security classification levels.

6.2.1 Subtask 1 – Data Acquisition. The contractor shall perform or facilitate services relating to well managed coordination between data originators and data system owners as necessary to acquire or connect to operational systems for data analysis purposes. This includes, but is not limited to, developing relationships with data originators and system owners to facilitate the exposure of DISA data across the enterprise; editing the documentation outlining procedures and agreements between data originators, system owners, CDO, and authorized consumers; producing technical justification for product acquisition including both software license procurement and cloud environment hosting costs; communicating data extraction/movement standards, and/or contributing to the technical extraction of data sources from source databases and Authoritative Data Sources. This requirement includes Data Transport (e.g., Snowballs, Courier services, Cloud exfiltration) at multiple security classification levels up to Secret.

Page 4 of 18 Pages

6.2.1 Subtask 2 - Data Preparation. The contractor shall perform Data Preparation tasks necessary to transform data from its raw form into a format ready for consumption by the analytical and/or systems development communities in both cloud and on-premises environments. Data preparation must also be done in support of the Chief Data Office’s statutory responsibilities to comply with the Federal OPEN Data Act. These tasks include but are not limited to data feed automation using industry standard tools, data tagging, metadata tagging, data export standards, data quality application and business rule creation, data munging and wrangling in support of machine learning tools and techniques and performing advanced Extract-Transform-Load activities to maximize dataset exploitability. The contractor shall comply with Department of Defense and Joint Force Headquarters data practices as well as inform DISA data preparation and modeling best practices across enterprise. This requirement applies to all network classifications up to Secret and connections.

6.2.3 Subtask 3 - Data Environment Architecture. The contractor shall advise, evaluate, and assist in the development of a scalable technical environment architecture necessary to enable consumption of identified datasets by the analytical and/or systems development communities. This includes identifying hardware (physical, virtual, hypervisor, containers, lambda or other serverless functions), software, tools and applications related to developing a data service enterprise technical architecture. This architecture shall not result in reduced performance of operational / transactional systems because of increased data consumption workloads. Additionally, the architecture will leverage artifacts produced by data originators, system owners, data preparation teams, and data modeling and documentation teams to maximize effectiveness of exposed datasets. The architectural solutions proposed must comply with DISA Best Practices (DevSecOps, Agile development, Continuous Integration, Continuous Delivery (CI/CD) pipeline lifecycle, Continuous Authority to Operate (ATO) Risk Management Framework certification, etc.). This requirement applies to all network classifications up to Secret and connections.

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.2.1, 6.2.2, 6.2.3

Data environment standards

Contractor Determined Format

As agreed upon in the approved

POA&M

Standard Distribution*

As required, 50 per year with an expected increase of approximate 10%

6.2.3 POA&M for

DISA data environment architecture

Contractor Determined Format delivered in MS Word or editable

PDF

Within 45 calendar days after contract award

Standard Distribution*

Once

*Standard Distribution: Delivery via email to COR and Government PM.

6.3 Task 3 - Analytics Partnerships. The contractor shall evaluate new data science/analytics products and vendor frameworks for relevance and usability/insertion into the DISA data environment. The contractor shall support the definition and execution of data-centric use-cases including staffing with data science experts engaged and knowledgeable in functional communities and capable of solving complex mission problems using appropriate data analysis techniques to include compilation, aggregation, linear programming, complex statistical analysis, visualization, machine learning, artificial intelligence, and other advance analytical processes and tools.

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.3 Meeting

minutes

DI-ADMN-81505 Five (5) business days after meeting

Standard Distribution*

12 per year with an expected increase of approximately

Page 5 of 18 Pages

10% per contract year

6.3 Analytic

Product reports

Contractor- Determined Format delivered in MS Word or editable

PDF

Within 30 days of product evaluation

Standard Distribution*

10 per year with an expected increase of approximately 10% per contract year

*Standard Distribution: Delivery via email to COR and Government PM.

6.4 Task 4 – Data Service Operations. The contractor shall influence and/or establish DISA best practices in data environment development, capability exposure, and system sustainment measures. All solutions developed shall result in a capability force multiplier to the DISA. The contractor shall develop web services exposing, communicating, and exploiting data capabilities to the DISA systems development and analytical communities enabling data integration and analysis across the enterprise to enable data driven decisions at all levels. The contractor shall develop, collect, and report metrics on the state of DISA enterprise datasets as they are managed across the land, maritime, air, space, and cyberspace domains, collected or federated to the enterprise, and reported to the Department of Defense in compliance with the OPEN Data Act. The contractor shall support operational issue resolution with the capabilities deployed in support of reference architecture and in the execution of Use Cases. The contractor shall establish and/or influence a Data Operations Center for centralized issue management, reporting, and resolution. The contractor shall operate an Issue Management system for data-related activities across the DISA enterprise and generate monthly metrics against the data-related activities across the enterprise. This requirement applies to all network classifications up to Secret and connections.

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.4 POA&M for

DISA data operations best practices

Contractor- Determined Format delivered in MS Word or editable PDF

Within 60 calendar days after contract award

Standard Distribution*

Once

6.4 Monthly

Metrics

Contractor- Determined, Government- Approved Format

1st business day of the month

Standard Distribution*

Monthly

*Standard Distribution: Delivery via email to COR and Government PM.

6.5 Task 5 – Data Governance. The contractor shall provide expertise to support the Government’s development of data maturity models that account for the entire lifecycle, conduct maturity assessments, develop data models that support data management, apply design concepts to create reliable data storage environments, apply metadata management principles and develop data quality techniques that ensure data is fit for its intended purposes. The contractor shall provide expertise in the areas of data stewardship, ownership, and data management policy that enable decision makers at all levels to make better operational and strategic decisions. The contractor shall research and collaborate on policy documents essential to strategic concept adoption and operational and tactical execution success for the DISA Enterprise. Documentation shall include, but is not limited to, Information System Security Manager (ISSM) Entity Relationship Diagrams, enterprise data dictionary, meta-data repositories, and data environment standard operating procedures. Support senior leader governance forums and facilitate large, recurring, multi-organization, multi-level collaborations to iteratively improve the understandability, provenance, registration, tagging, publication, protection, consumption, exploitation, and weaponization of DISA and all-source data needed to enable DISA digital functions and missions.

The contractor shall provide secretariat support for established Governance for a including managing membership rosters, regular communications across the governance structures (DISA Data Governance Council, and various

Page 6 of 18 Pages

Working Groups), addressing appropriate General Officer and Senior Executive Service protocol actions, coordinating, collecting, generating, and distributing read-ahead materials, and publication of minutes, lessons learned, and tracking action items following events. Approximately 5-10 working groups per year, as well as 1 DISA Data Governance Council, shall be supported.

This requirement applies to all network classifications up to Secret and connections.

The contractor shall provide a POA&M that will increase the DISA data governance maturity to include establish and enhance the appropriate data governance structures and processes required to translate mission strategy through the medium of data architecture to achieve mission outcomes in an agile and responsive manner. The contractor shall establish and regularly update the policy and strategy foundations required to promote data sharing, enable data-driven decision making, develop a data-centric workforce, and secure data-at-rest and data-in-flight. The contractor shall measure and drive accountability for technical and architectural debt incurred within the DISA organization.

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.5 Meeting

Minutes, Slides, and Action Items

Contractor- Determined, Government- Approved Format

Five (5) business days after meeting

Standard Distribution*

Approximately 50 per year with an expected increase of approximately 10% per contract year

6.5 POA&M for

DISA data governance maturity

Contractor- Determined Format delivered in MS Word or editable

PDF

Within 120 calendar days of contract award;

Updated yearly.

Standard Distribution*

Once; Updated yearly.

6.5 Analysis

DISA

governance maturity

Contractor- Determined Format delivered in MS Word or editable

PDF

As agreed upon in the approved

POA&M

Standard Distribution*

Approximately 12 per year with an expected increase of approximate 10% per contract year

*Standard Distribution: Delivery via email to COR and Government PM.

6.6 Task 6 – Data Analytics. The contractor shall conduct data analytics using state-of-the-art mathematical and machine learning/artificial intelligence techniques to support exploitation and understanding of data both within specific mission domains and across the DISA enterprise to improve effectiveness in operations and support data-driven decisions. The contractor shall provide support for complex analysis of multiple data sets across a diverse range of mission functional areas. The contractor shall develop dynamic visualizations exploiting available, curated data sets using a variety of visualization tools or custom-developed scripts to meet mission needs and provide continually current mission dashboards for commanders at all levels across the DISA enterprise. The contractor shall propose options to the Government to improve its capabilities to achieve various levels of technical sophistication ranging from business intelligence to state-of-the-art applied mathematical and machine learning/artificial intelligence techniques. This requirement applies to all network classifications up to Secret and connections. The contractor shall provide data analytic reports for status reviews, customer education, data maturity objective and other customer report requests. An example of data analytic reports is a report from various data sources consolidated into advanced data visualization agents and provided in easy-to-read formats.

Deliverables::

Page 7 of 18 Pages

T

PWS

Task#

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.6 Data analytic

reports

Contractor- Determined Format delivered in MS Word or editable PDF

5 business days after formal request

Standard Distribution*

12 per year with an expected increase of approximately 10% per contract year

6.6 Dynamic

Visualizations

Contractor- Determined, Government Approved Format

Within 10 business days of request.

Standard Distribution*

Approximately 25 per year with an expected increase of 10% per contract year

*Standard Distribution: Delivery via email to COR and Government PM.

ask#

6.7 Task 7 – Data Environment Enhancement Operation and Sustainment (OPTIONAL TASK). The contractor shall perform or facilitate services relating to ongoing managed services and operationalizing the cloud hosted data environment and analytical support in an architecture based on multi-tenancy, cloud-analytics-as-a-service delivery model leveraging cloud-native, serverless technologies in a zoned lakehouse architecture within accredited IL5 and IL6 environment, all designed to securely design, build, deploy, operate, and sustain enterprise-quality, commercially used data science tools and services in accordance with the DoD Data, Analytics, and AI Adoption Strategy and the DISA Data Strategy. The contractor shall perform or facilitate services relating to technical infrastructure design and maintenance enabling large scale analysis, exposure and exploitation of DISA data to analytic and systems development communities. The contractor shall develop DISA best practices and guide the community to realize the benefits of scalable infrastructure without impacting business operations. The contractor shall develop Data Science Reference Architecture capability requirements documents, project management plans, and cost estimates for implementation of new products and services filling gaps in or enhancing the usability of the data in the enterprise environments. This requirement applies to all network classifications up to Secret and connections.

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

6.7 Internal

Business Governance Implementation Plan

Contractor- Determined Format delivered in MS Word or editable

PDF

Within 180 calendar days after task order start date.

Standard Distribution*

Once

6.7 Business

Intelligence Framework Requirements Document Format

Contractor- Determined Format delivered in MS Word or editable

PDF

Within 180 calendar days after task order start date.

Standard Distribution*

Once

*Standard Distribution: Delivery via email to COR and Government PM.

6.7.1 Subtask 1. Solution/Application Support. The contractor shall provide solution specific applications and services support. This support shall be available to DISA Data Lab end users via emails, or service tickets opened through the GSD service desk. These resources are the Tier 2 support and shall resolve as many issues as possible.

In cases where the issue requires involvement of other Tier 3 support, the ticket shall be escalated to Tier 3 and the issue must be worked to a resolution using expert knowledge. This service shall be available 9x5 weekdays excluding Government Holidays.

Page 8 of 18 Pages

A Monthly Trouble Ticket Report from the trouble ticketing system reflecting all recorded requests is required.

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

6.7.1 Monthly Trouble

Ticket Report

Contractor- Determined Format delivered in MS Word or editable

PDF

Monthly Standard

*Standard Distribution: Delivery via email to COR and Government PM.

6.7.2 Subtask 2. Solution/Platform Managed Services. The contractor’s data lab solution/platform shall be managed 24x7x365. Administrators shall monitor the systems via automated tools and respond to issues or incidents. The system must be scanned and monitored on a regular basis and the required patches applied in a timely fashion to be compliant.

The various activities performed under these Managed services shall include:

• Configuration Management

• Version Management

• Administration User Management

• 24x7 Monitoring

• Back Up/Recovery

• Compliance Management

• Infrastructure Node Management

A monthly Platform Incident Root Cause Analysis Report detailing the root cause analysis on incidents causing a break in service is required.

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

6.7.2 Platform Incident

Root Cause Analysis Report

Contractor- Determined Format delivered in MS Word or editable

PDF

Monthly Standard

6.7.3 Subtask 3. Assessment & Authorization (A&A) – Application Package Preparation. The A&A task shall provide support information system security officer for DISA’s ATO team. The contractor shall provide necessary documentation for the installed system as core input into the ATO package that is then driven by DISA for approval as part of the necessary documentation. The contractor shall develop and/or update the system(s) documents, artifacts, and compelling evidence to ensure OD system meets DoD requirements, as defined in DoDI 8510.01 to achieve, and maintain an ATO, Interim Authorization to Test, or Denial of Authorization to Operate. These documents will include artifacts that may be inherited from associated accreditations.

Page 9 of 18 Pages

Task#

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

6.7.3 A&A RMF

Artifacts for ATO Package

Government Provided Format

Initial Generation – 20 business days after formal request

Modifications – 10 business days after formal request

Standard

Average once every three calendar years for ATO

7. Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Methods of Calculation

6.1 Task 1 – Project

Management.

The contractor shall submit deliverables on time. The deliverables shall be submitted with no defects in completeness.

Any requests for deliverable date changes shall be submitted prior to the deliverable date in writing for approval to the Government

COR.

100% of all deliverables provided by the date specified in the delivery table.

Deliverables are submitted with zero defects, omissions, and mistakes.

Minimum Acceptable:

>/= 95% of all deliverables provided by the date specified in the delivery table.

Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within 1 week and accepted by the KO/COR.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

6.2 Task 2 – Data

Acquisition, Preparation, and Architecture

The contractor shall complete assigned tasks and deliverables monthly.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of all deliverables provided as specified in the delivery table.

>/=95% of the assigned tasks are met by the assigned due date and meet all the minimum requirements.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

6.3 Analytics Partnerships

The contractor shall complete assigned tasks and deliverables monthly.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of all deliverables provided as specified in the delivery table.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

Page 10 of 18 Pages

>/=95% of the assigned tasks are met by the assigned due date and meet all the minimum requirements.

6.4 Task 4 – Data Service

Operations

The contractor shall provide monthly metrics from the Issue Management system for data-related activities across the DISA enterprise.

100% of required monthly metrics reporting provided as specified in the delivery table or as assigned.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of required monthly metrics reporting.

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

6.5 Task 5 – Data

Governance

1. The Contractor shall schedule, coordinate, execute, and document Governance working groups and collaboration efforts.

2. The Contractor shall provide expertise and research data on data stewardship, ownership, and data management policy.

100% of required Governance working groups and collaboration efforts are scheduled, executed, and documented monthly.

100% of required expertise and research is technically accurate.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of required Governance working groups and collaboration efforts are scheduled, executed, and documented monthly.

>/= 95% of required expertise and research is technically accurate.

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Calculation: Completed monthly working groups, collaboration efforts, and expertise/research divided by the total monthly requested working groups, collaboration efforts, and expertise/research.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with

6.6 Task 6 – Data Analytics

1. The contractor shall develop dynamic visualizations exploiting available, curated data sets using a variety of visualization tools or custom-developed scripts.

Scripts are bug/error-free, and visualizations accurately and clearly depict the requested data.

100% of requested visualizations are developed within 10 business days of request.

100% of requested data analytics reports are developed and delivered within 5 business days of request.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

Calculation: Completed monthly visualizations and reports divided by the total of monthly requested visualizations and reports.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number

Page 11 of 18 Pages

2. The contractor shall provide data analytics reports for status reviews, customer education, data maturity objective, and other customer report requests.

>/= 95% of requested visualizations are developed within 10 business days of request.

>/= 95% of requested data analytics reports are developed and delivered within 5 business days of request.

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned.

of major tasks assigned IAW with the PWS.

6.7 Task 7 – Data

Environment Development, Operation, and Sustainment

The contractor shall complete assigned tasks and deliverables monthly.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with

8. Incentives. Positive and negative performance will be documented in the Contractor Performance Assessment Reporting System (CPARS).

9. Place of Performance.

Mission Location: DISA Headquarters located at Ft. Meade, MD.

Place of Performance: This work shall be performed off-site at the Contractor’s Facility or at an alternative worksite.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Access to classified information and classified systems may be required when designing, analyzing, and/or preparing data. Classified work shall be performed at a secure Government site, to include DISA Headquarters, 6910 Cooper Ave. Ft Meade and other DISA sites that support SIPR access. Facility access will be coordinated with Government personnel. Work in support of all other Task Areas shall be performed at the contractor’s facility or alternative work site.

Local travel to and around the mission location, DISA HQ Ft. Meade, and the contractor’s facility may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

10. Period of Performance. The period of performance is for one (1) base year of 12 months and four (4) 12-month option years after contract award.

Period of performance: One (1) base year plus four (4) 12-month option years.

Base period is from September 30, 2024 to September 29, 2025 OY1 is from September 30, 2025 to September 29, 2026 OY2 is from September 30, 2026 to September 29, 2027

Page 12 of 18 Pages

OY3 is from September 30, 2027 to September 29, 2028 OY4 is from September 30, 2028 to September 29, 2029

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point Of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore, the company must have an interim or final Secret Facility Clearance from the Defense Counterintelligence and Security Agency Facility Clearance Branch.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be U.S.

citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS Task / Subtask

Clearance Level

Level of Classified Access Justification for Access to Classified

6.2, 6.4-6.7 Interim Secret

SIPRNet Support contractors will have access to information and/or systems up to the Secret Level (e.g., SIPRNet)

6.1, 6.3 Interim Secret

N/A Support contractors will have access to information (not systems) up to the Secret Level

11.3 Investigation Requirements.

11.3.1 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.3.2 The contractor is required to have personnel cleared with an interim or final Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel is replaced during performance of the contract, replacement personnel should also have interim or final clearance Secret (as specified in the table located in section 11.2).

Page 13 of 18 Pages

11.4 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the DISS to Security Management Office (SMO) DKABAA10. DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in PWS Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the VAL/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. Contractor VAL signed by the Contractor Facility Security Officer (FSO)

If DISS is not available, the VAL must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit

• Certification of personnel security clearance and any special access authorizations required for the visit

(type of investigation & date and adjudication date & agency)

• Name of COR/Alt COR

• Dates or period the VAL is to be valid

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.3 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4.

The VTN must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee

• Name of COR/Alt COR

• Termination Date

• Reason for Termination

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-1235 or via mail at:

Page 14 of 18 Pages

Defense Information Systems Agency Defense Information Systems Agency ATTN: MP61, Industrial Security ATTN: MP62, Personnel Security Command Building Command Building 6910 Cooper Ave. 6910 Cooper Ave.

Fort Meade, MD 20755-7088 Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: EII Security Team Phone Number: 223-220-4234 E-mail: disa.letterkenny.eiic.list.security-mgmt-team@mail.mil

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel.

Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke contractor personnel access to DISA facilities and networks, who violates one or more of Security Personnel Adjudicative guidelines, harassment or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility.

Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain Controlled Unclassified Information (CUI) at the contractor facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the contractor facility. Contractor personnel will have access to, generate, and handle classified material up to SECRET level only at the Government location(s) (Ref:

Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 3, DoD Information Security

Page 15 of 18 Pages

Program: Protection of Classified Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government- Furnished Information (GFI).

GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP DFARS clauses and additional DITCO Instructions incorporated in award.

Contractors shall accept and/or report provided GFP via the Shipping and Receiving document in the GFP module upon acceptance and/or IAW Additional DITCO Instruction H9. Serially managed items are provided to the contractor by DoD and require all events identified in DFARS 252.211-7007 (and/or any subsequent DFARS or Agency GFP reporting requirements) to be reported by the contractor.

Contractors in possession of GFP shall provide the COR or PA an annual report of all GFP in it’s possession to include the item description, make, model, serial number, IUID, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period (base and options) IAW with Additional DITCO Instruction H9.

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

12 GFP Inventory MS Excel spreadsheet

30 days prior to the end of the POP.

Standard

Annually

H9 Property Management Plan

Provided template

10 days after award. COR and PA At award

H9 Final GFP Disposition Notification

Contractor provided format

On or prior to the last day of the end of the

POP.

COR and PA At end of contract/ order

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

13. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. Continued Data Governance support services…