Data Management and Governance Support - Draft Performance Work Statement.pdf

Page 1 of 18 Pages

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Award

Contract Number: (completed by the KO at time of contract or TO award) Task Order Number: (completed by the KO at time of TO award or N/A) Contractor Name (completed by the KO at time of contract or TO award) Tracking Number: 632469116 Follow-on to Previous Contract and Task Order Number:

47QTCB21D0164 HC104721F2108

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator (PA). See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Data Management and Governance Support.

3. Background. This requirement is derived from the Department of Defense (DoD) mission directive mandating the DISA Chief Data Officer (CDO) and the broader DISA community to utilize data as a strategic asset. The DISA Chief Data Officer’s primary role is to ensure that timely high-quality data is available to internal and external stakeholders to fulfill mission requirements. Office of the Chief Data Officer (OCDO) is responsible for setting the vision and goals for change, and providing the enabling architecture, standards, governance, and inform DISA-wide talent management plans that will empower DISA organizations and the systems they operate to leverage and act upon quality data at speed and scale. As such, they maintain and update the strategic framework for ensuring DISA data is secure, visible, accessible, understandable, linked, trustworthy, interoperable, and secure with and across every function, mission area, and domain of operations to deliver decision advantage. DISA OCDO works in collaboration with strategic partners to leverage data to support, enhance and execute the mission. They partner with appropriate analytic organizations to conduct unique use cases, peer review, programmatic development, and technological assessments to provide capabilities that inform the decision-making process and enable data-driven decisions.

4. Objectives. DISA has a need to maintain an OCDO to manage data as a strategic asset and to create, implement and maintain an overall data management strategy. These high-level objectives reflect the need for improving and establishing organizational data quality, standardization, integrity, availability, accessibility, usability, and sharing best practices at an enterprise level, to ultimately improve decision making throughout the agency.

This shall be done in a way that maintains a formal data governance steering committee and working groups, data quality and data management/governance policies, an enterprise-wide data asset inventory, business glossary, data maturity model and strategy, developing an authoritative data source registry, governance, and approval process, metadata and master data management, the DISA Data Catalog, and a self-service data analytics environment.

5. Scope. The purpose of this contract is to obtain contracted subject matter expert support to advise on and/or perform data preparation and architecture, development of agile algorithmic solutions, evaluate and/or execute data governance and data maturity models; create data policy framework and conduct a framework assessment and create data catalog structure; and evaluate and advise on enterprise data platforms, data metadata management, and data analytics.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 45% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

DRAFT

Page 3 of 18 Pages in MS Word or editable PDF holiday, submit on the first business day following the 10th

6.1.1 Contract

Kick-Off

MS PowerPoint slides; DoD365 Microsoft Teams meeting

Within 30 calendar days prior to the start of contract performance but NLT three business days before the start of contract performance

Standard Distribution*

Once at the start of base year

6.1.1 TIM MS PowerPoint

slides; DoD365 Microsoft Teams meeting

NLT 15 business days after contract start date

Standard Distribution*

Once at the start of the base year

6.1.2 Weekly

Activity Report

MS PowerPoint slide

Every Wednesday (unless rescheduled)

Standard Distribution*

Weekly

6.1.3 Draft

Transition-In Plan

Contractor- Determined Format delivered in MS Word or editable PDF

With Proposal Standard Distribution*

Once

6.1.3 Final

Transition-In Plan

Contractor- Determined Format delivered in MS Word or editable PDF

7 calendar days after contract award

Standard Distribution*

Once

6.1.4 Transition-

Out Plan

Contractor- Determined Format delivered in MS Word or editable PDF

Draft due 90 calendar days prior to contract end

Standard Distribution*

Once

*Standard Distribution: Delivery via email to COR and Government PM.

6.2 Task 2 – Data Acquisition, Preparation, & Architecture. The contractor shall perform tasks necessary to acquire data and develop a scalable technical architecture necessary to enable consumption of prepared datasets by the analytical and/or systems development communities in both cloud and on-premises environments at multiple security classification levels up to Secret. For example, develop data export standards and perform Extract- Transform-Load activities to maximize dataset exploitability, populate the system with metadata aspects (catalog, glossary, attributes, business rules), perform data feed automation using industry standard tools data sets, perform data quality and curation activities, generate synthetic data sets for Artificial Intelligence (AI)/Machine Learning (ML) algorithm training, synthesize multiple data sets into common formats for efficient storage and rapid processing (e.g., Structured Query Language (SQL) to parquet), ensure data sets are machine readable, tagging data for transport data up and down across multiple security classification levels.

6.2.1 Subtask 1 – Data Acquisition. The contractor shall perform or facilitate services relating to well managed coordination between data originators and data system owners as necessary to acquire or connect to operational systems for data analysis purposes. This includes, but is not limited to, developing relationships with data originators and system owners to facilitate the exposure of DISA data across the enterprise; editing the documentation outlining procedures and agreements between data originators, system owners, CDO, and authorized consumers; producing technical justification for product acquisition including both software license procurement and cloud environment hosting costs; communicating data extraction/movement standards, and/or contributing to the technical extraction of data sources from source databases and Authoritative Data Sources. This requirement includes Data Transport (e.g., Snowballs, Courier services, Cloud exfiltration) at multiple security classification levels up to Secret.

Page 9 of 18 Pages

Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within 1 week and accepted by the KO/COR.

6.2 Task 2 – Data

Acquisition, Preparation, and Architecture

The contractor shall complete assigned tasks and deliverables monthly. The tasks and deliverables shall be complete and submitted free of defects.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of all deliverables provided as specified in the delivery table.

Deliverables are submitted with 5% or less defects in completeness.

>/=95% of the assigned tasks are met by the assigned due date and meet all the minimum requirements.

Required revisions are resolved within one week and accepted by the KO/COR.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

6.3 Task 3 – Data Service

Operations

The contractor shall provide monthly metrics from the Issue Management system for data-related activities across the DISA enterprise. The metrics shall be complete, accurate, and free of defects.

100% of required monthly metrics reporting provided as specified in the delivery table or as assigned.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of required monthly metrics reporting. Monthly metrics are submitted with 5% or less defects in completeness and accuracy.

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Required revisions are resolved within one week and accepted by the KO/COR.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

6.4 Task 4 – Data

Governance

1. The Contractor shall schedule, coordinate, execute, and document Governance working groups and collaboration efforts.

2. The Contractor shall provide expertise and research data on data

100% of required Governance working groups and collaboration efforts are scheduled, executed, and documented monthly.

100% of required expertise and research is technically accurate.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Calculation: Completed monthly working groups, collaboration efforts, and expertise/research divided by the total monthly requested working groups, collaboration efforts, and expertise/research.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Page 10 of 18 Pages stewardship, ownership, and data management policy.

Minimum Acceptable:

>/= 95% of required Governance working groups and collaboration efforts are scheduled, executed, and documented monthly.

>/= 95% of required expertise and research is technically accurate.

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned. Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the KO/COR.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

6.5 Task 5 – Data Analytics

1. The contractor shall develop dynamic visualizations exploiting available, curated data sets using a variety of visualization tools or custom-developed scripts.

Scripts are bug/error-free, and visualizations accurately and clearly depict the requested data.

2. The contractor shall provide data analytics reports for status reviews, customer education, data maturity objective, and other customer report requests.

100% of requested visualizations are developed within 10 business days of request.

100% of requested data analytics reports are developed and delivered within 5 business days of request.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of requested visualizations are developed within 10 business days of request.

>/= 95% of requested data analytics reports are developed and delivered within 5 business days of request.

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned. Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the KO/COR.

Calculation: Completed monthly visualizations and reports divided by the total of monthly requested visualizations and reports.

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

6.6 Task 6 – Data

Environment Development, Operation, and Sustainment

The contractor shall complete assigned tasks and deliverables monthly. The tasks and deliverables shall be complete and submitted free of defects.

100% of all deliverables and tasks provided as specified in the delivery table or as assigned.

Minimum Acceptable:

>/= 95% of all deliverables and tasks provided as specified in the delivery table or as assigned. Deliverables are

Calculation: The total number of deliverables provided IAW the PWS listed date divided by the total number of deliverables due.

Calculation: The total number of major tasks completed IAW the PWS divided by the total number of major tasks assigned IAW with the PWS.

Page 11 of 18 Pages submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the KO/COR.

8. Incentives. Positive and negative performance will be documented in the Contractor Performance Assessment Reporting System (CPARS).

9. Place of Performance.

Mission Location: DISA Headquarters located at Ft. Meade, Maryland.

Place of Performance: This work shall be performed off-site at the Contractor’s Facility or at an alternative worksite.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Access to classified information and classified systems may be required when designing, analyzing, and/or preparing data. Classified work shall be performed at a secure Government site, to include DISA Headquarters, 6910 Cooper Ave. Ft Meade and other DISA sites that support SIPR access. Facility access will be coordinated with Government personnel. Work in support of all other Task Areas shall be performed at the contractor’s facility or alternative work site.

Local travel to and around the mission location, DISA HQ Ft. Meade, and the contractor’s facility may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

10. Period of Performance. The period of performance for this contract/task order is a one-year base period and four one-year option periods. The anticipated start of the base period is August 30, 2024.

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site POC providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

Page 14 of 18 Pages

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel.

Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/task order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/task order.

11.6.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke contractor personnel access to DISA facilities and networks, who violates one or more of Security Personnel Adjudicative guidelines, harassment or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility.

Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain CUI at the contractor facility.

Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the contractor facility. Contractor personnel will have access to, generate, and handle classified material up to SECRET level only at the Government location(s) (Ref: Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 3, DoD Information Security Program: Protection of Classified Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of the contract/task order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP).

GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award, and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP DFARS clauses and additional DITCO Instructions incorporated in award.

Page 16 of 18 Pages of the previous month)

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

d. Packaging, Packing and Shipping Instructions. Packaging and marking of all deliverables shall be in accordance with best commercial practice necessary to ensure safe and timely delivery in accordance with applicable security requirements.

e. Inspection and Acceptance Criteria. The government will have 10 business days to evaluate deliverables at a minimum and may request longer evaluation times dependent on the complexity and staffing requirements.

Contract deliverable items rejected shall be corrected in accordance with the specific Government provided comments. All deliverables shall be submitted directly to the COR and the PM or his/her designated representative.

The PM and the COR will monitor the contractor efforts to ensure technical suitability. If the deliverable does not meet the specified criteria, it will be returned. After notification that the deliverable did not meet the acceptance criteria, the contractor shall re-submit the deliverable within 14 calendar days. Upon re-submission by the contractor, the Government will apply the same acceptance criteria. The contractor shall permit the contracting officer or designated representative access at any reasonable time to all records, data, and facilities used in the performance of services.

f. Property Accountability. N/A

g. Transitioning.

1. Transition-In (Phase In). All key personnel/key positions must be onboard at start of the period of performance. Fifty percent of the total staff must be complete within 14 calendar days of the start of the period of performance and 100 percent within 30 calendar days.

2. Transition-Out (Phase Out). The contractor shall collaborate with the mission partner and COR at least 120 days or sooner, prior to the end of the contract, to develop a transition-out plan IAW FAR 52.237-3.

h. Supply Chain Risk Management (SCRM). N/A

i. Training. Contractor employees may be required to take periodic mandatory training courses provided through the agency, such as records management training and other training required by statute, regulation, DoD, or DISA policy. No other training of contractor personnel shall be provided by the Government unless authorized by the Contracting Officer.

14. Section 508 Accessibility Standards.

E201.1 Scope ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.

E205.1 General Electronic content shall comply with E205.

E205.2 Public Facing Electronic content that is public facing shall conform to the accessibility requirements specified in E205.4.

E205.3 Agency Official Communication Electronic content that is not public facing shall conform to the accessibility requirements specified in E205.4 when such content constitutes official business and is communicated by an agency through one or more of the following:

A. An emergency notification;

B. An initial or final decision adjudicating an administrative claim or proceeding;

C. An internal or external program or policy announcement;

D. A notice of benefits, program eligibility, employment opportunity, or personnel action;

Page 17 of 18 Pages

E. A formal acknowledgement of receipt;

F. A survey questionnaire;

G. A template or form;

H. Educational or training materials; or I. Intranet content designed as a Web page.

E205.4 Accessibility Standard (WCAG 2.0) - Electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (Incorporated by reference, see 702.10.1).

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E207.1 General Where components of ICT are software and transmit information or have a user interface, such components shall conform to E207 and the requirements in Chapter 5

Exception from E207.1 General: Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to the requirements in Chapter 5.

E207.2 WCAG Conformance User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

Exceptions from E207.2 WCAG Conformance:

Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to E207.2.

Non-web software shall not be required to conform to the following four Success Criteria in WCAG 2.0: 2.4.1 Bypass Blocks; 2.4.5 Multiple Ways; 3.2.3 Consistent Navigation; and 3.2.4 Consistent Identification.

Non-Web software shall not be required to conform to Conformance Requirement 3 Complete Processes in WCAG 2.0.

E207.3 Complete Process for Non-Web Software Where non-Web software requires multiple steps to accomplish an activity, all software related to the activity to be accomplished shall conform to WCAG 2.0 as specified in E207.2.

E208.1 General Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E301 General

E301.1 Scope. The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

E302 Functional Performance Criteria

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of

Page 18 of 18 Pages operation that does not require user hearing.

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

502.4 Platform Accessibility Features. Platforms and platform software shall conform to the requirements in ANSI/HFES 200.2, Human Factors Engineering of Software User Interfaces — Part 2: Accessibility (2008) (incorporated by reference, see 702.4.1) listed below:

A. Section 9.3.3 Enable sequential entry of multiple (chorded) keystrokes;

B. Section 9.3.4 Provide adjustment of delay before key acceptance;

C. Section 9.3.5 Provide adjustment of same-key double-strike acceptance;

D. Section 10.6.7 Allow users to choose visual alternative for audio output;

E. Section 10.6.8 Synchronize audio equivalents for visual events;

F. Section 10.6.9 Provide speech output services; and G. Section 10.7.1 Display any captions provided.

503.1 General Applications shall conform to 503.

503.2 User Preferences Applications shall permit user preferences from platform settings for color, contrast, font type, font size, and focus cursor.

Exception from E503.2 User Preferences: Applications that are designed to be isolated from their underlying platform software, including Web applications, shall not be required to conform to 503.2.

503.3 Alternative User Interfaces. Where an application provides an alternative user interface that functions as assistive technology, the application shall use platform and other industry standard accessibility services.

503.4 User Controls for Captions and Audio Description Where ICT displays video with synchronized audio, ICT shall provide user controls for closed captions and audio descriptions conforming to 503.4.

503.4.1 Caption Controls Where user controls are provided for volume adjustment, ICT shall provide user controls for the selection of captions at the same menu level as the user controls for volume or program selection.

503.4.2 Audio Description Controls. Where user controls are provided for program selection, ICT shall provide user controls for the selection of audio descriptions at the same menu level as the user controls for volume or program selection.

602.1 General. Documentation that supports the use of ICT shall conform to 602.

603.1 General. ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.