Data Migration SOW.pdf

Air Force Life Cycle Management Center (AFLCMC)

Technical and Administrative Support for 3DEXPERIENCE (3DX)

Statement of Work (SOW)

For:

Reference:

Date: 25 June 2025

Prepared by:

Hanscom Air Force Base, Massachusetts 01731-2119

DISTRIBUTION STATEMENT D: Distribution authorized to the Department of Defense and U.S.

DoD contractors only (Software Documentation) (25 June 2025). Other requests for this document must be referred to the Program Office, Hanscom AFB, MA 01731.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

CHANGE / REVISION RECORD

1 Program Overview

The United States Air Force (“Government” or “Customer”) is executing a digital engineering approach to program execution, guided by the “e-Program” Digital Engineering criteria set forth in the Digital Building Code published by SAF/AQ on 3 May 2021. This approach is consistent with the five goals identified in the 2018 DoD Digital Engineering Strategy, with an emphasis on establishing and maintaining an enduring authoritative source of truth through digital threads for the Government Program Management Office over its life cycle. The Government is establishing integrated digital environments at the IL-5, IL-6, and IL-6+ levels.

2 Scope

The Government will require the Contractor to provide technical and administrative support for the 3DEXPERIENCE (3DX) platform. The 3DXPERIENCE platform is a business and innovation platform that provides organizations with a holistic, real-time view of their business activity and ecosystem. It connects people, data and solutions in a single collaborative environment empowering business to innovate, produce and exceed mission requirements in entirely new ways. The application serves to aid in building digital threads from program initiation, through operations and sustainment.

Previous efforts configured the application code to serve as a collaborations and approval platform in support of the Government's migration to a digital-based acquisition program while maintaining out of the box (OOTB) overall functionality. The application integrates other supporting applications, including 3DX/Enovia for support of Product Lifecycle Management (PLM) Business activities, Cameo and Teamwork Cloud (TWC) for model-based systems engineering (MBSE) activities, and CATIA for computer aided design (CAD) functionality into a single environment.

This effort looks to attain support in two phases. Phase I includes completing a data migration effort while maintaining application configuration code and OOTB functionality and supporting the 3DX Authority to Operate (ATO). Phase II would include application configuration work, follow-on end user support, and Hanscom local system remote administration support, in addition to supporting the

3DX ATO.

3 Service Requirements

3.1 General Tasks

The Contractor shall perform the below tasks for the entirety of the contract, both Phase I and Phase II, if exercised.

Revision Date Page/Paragraph Description of Change Made By

3.1.1 The Contractor shall provide personnel who are eligible to maintain a DoD Common Access Card (CAC) and up to Top Secret/Sensitive Compartmented Information (SCI) clearance, as required by the Government.

3.1.2 The Contractor shall provide the Government and adjacent contractors technical and system architecture design support up to TS/SCI.

3.1.3 The Contractor shall provide the Government and adjacent Primes technical and system software deployment support up to TS/SCI.

3.1.4 Contractor shall provide the Government and adjacent Primes technical support across all domains through the establishment of a helpdesk and online support portal (e.g. prioritized support tickets) including local team modeling.

3.2 Program Management

The Contractor shall perform program management activities including the delivery of an Integrated Production Schedule (IPS) Report in addition to delivering a Contractor Invoice and Payment Report.

CDRL A001 – Integrated Production Schedule (IPS) Report CDRL A002 – Contractor Invoice and Payment Report

3.3 Software Updates

3.3.1 The Contractor shall obtain and maintain access to Government repositories for upload of the deliverables as directed by the Government.

3.3.2 The Contractor shall update provided app config code for installation and compatibility and deliver for each future version (2024x, 2025x, etc.) of 3DX as requested.

3.3.2.1 The Contractor shall conduct assessments for software upgrade to maintain current application configuration on future versions.

3.3.2.2 The Contractor shall implement software upgrade while maintaining current application configuration on future versions.

3.3.2.3 The Contractor shall maintain any auto-scripts needed to deploy files across all domains.

3.3.2.4 The Contractor shall maintain OOTB functionality as required when updating and maintaining app config code

3.3.3 The Contractor shall provide the Government and adjacent Primes security assessment documentation and support during the Authority to Use (ATU), Authority to Operate (ATO), Certificate to Field (CTF) process for 3DX, as well as implement latest security measures to ensure ATU, ATO, and CTF.

CDRL A003 – Assessment CDRL A004 – App Config Updated Software CDRL A005 – Auto-script CDRL A006 – DoD RMF Package Deliverables

4 Product Requirements

4.1 Phase I

The Contractor shall develop a data migration solution for 3DX to include all data types supported by 3DX with their associated traceability data to maintain a digital thread when moving data between instances of 3DX.

4.1.1 These data types shall include Dassault Systemes (DS) proprietary data types as well as data types outside the DS ecosystem, including all objects ingestible and all objects created by 3DX, including but not limited to PDFs, Word, engineering objects such as CATIA, 3DXML, and Enovia business objects with the ability to add new objects.

4.1.2 The Contractor shall deliver all files needed to support data migration across IL-5, IL-6, and IL-6+.

4.1.3 The Contractor shall deliver all files needed to meet DISA Security Technical Implementation Guides (STIGs).

4.1.4 The Contractor shall deliver a data migration software user’s manual, and any supplements developed.

4.1.5 The Contractor shall provide support in the following:

4.1.5.1 Assist in the creation of sample data for the types of data to be moved and test instruction demos. Must be compatible with Government IDE on premises 3DX.

4.1.5.2 Perform schema analysis for the types of data to be imported (see 4.1.1).

4.1.5.3 Establish rules for editing and receiving revised data.

4.1.5.4 Establish rules for additional connections on the target server.

4.1.5.5 Establish rules for disconnecting, replacing, and deleting data while maintaining both existing and new digital threads.

4.1.5.6 Configure orchestration engine to handle identified data types and scenarios.

4.1.5.7 Batch importing CATIA data.

4.1.5.8 Provide ad hoc support to the Program Management office and Government stakeholders working effort.

4.1.5.9 Support software acceptance testing of G-IDE functions.

4.1.5.10 Verification and validation (V&V) of the digital threads.

CDRL A007 – Data Migration Software User Manual (SUM) CDRL A008 – Data Migration Computer Software Product End Item (CSPEI)

4.2 Phase II

4.2.1 The contractor shall continue data migration upkeep while performing configuration and technical support of the 3DEXPERIENCE platform.

CDRL B008 – Data Migration Computer Software Product End Item (CSPEI)

4.2.2 The Contractor shall define and document configuration requirements in the context of configuring the customer’s 3DEXPERIENCE platform, including interfaces to/from 3DEXPERIENCE platform to/from other DoD systems, and data exchange to/from other secure environments. The Contractor shall create and deliver the Configuration Requirements Document (CRD).

4.2.3 The Contractor shall configure 3DEXPERIENCE platform according to the configuration requirements document. The Contractor shall create and deliver build packages quarterly to the Government for deployment to Government-designated networks that support unclassified (IL-5), Secret (IL-6), and Top Secret (TS) data.

4.2.4 The Contractor shall deliver the quarterly build packages to resolve any security or software configuration issues.

4.2.5 The Computer Software Product shall include scripting for application configurations.

Computer Software Products for each software configuration, patches, and major updates shall build upon previous computer software products where applicable.

4.2.6 The Contractor shall execute V&V activities and deliver a V&V Software Test Report (STR) for the quarterly build packages. The Contractor shall include click steps that are a part of the V&V activities in the STR.

4.2.7 The Contractor shall host a weekly virtual technical meeting. The technical meetings shall provide status updates on technical progress, answer technical questions, and provide technical expertise as needed on the 3DEXPERIENCE Platform.

4.2.8 The Contractor shall develop and deliver a user acceptance testing (UAT) Software Test Plan (STP) for each application configuration. The Contractor shall the conduct UAT events with appropriate Government personnel participation. The Contractor shall resolve UAT failures. The Contractor shall include click steps that are a part of the V&V activities on the STP.

4.2.9 The Contractor and the Government shall use a framework (JIRA/Confluence) to ensure open collaboration between different program / project stakeholders to track the progress of the deliverables, address any issues that may come up, capture and address UAT results, and any other items that require attention.

4.2.10 The Contractor shall deliver SUMs associated with each build package. The manuals must be a searchable text with step-by-step instructions to execute each application configuration use case that is accompanied by a real-time video of a demo of the application configuration use case.

CDRL B003 - Software/Hardware Requirements Specification (SHRS) - Configuration Requirements Document (SHRS-CRD)

CDRL B004 – Software User Manual (SUM)

CDRL B005 – Computer Software Product

CDRL B006 – Software Test Plan (STP)

CDRL B007 - Software Test Report (STR)

4.2.11 The Contractor shall provide one (1) full-time equivalent (FTE) support personnel to the Government, either virtually or in person, as requested by the Government. The FTE shall provide software development, troubleshooting expertise, training, and execute other miscellaneous tasks, as requested by the Government to all users, including the Business Administrators (BA). The Contractor shall provide support and include knowledge transfer sessions to users on specific topics related to the configuration and customization of the

3DEXPERIENCE platform environment in the G-IDE. The contract shall provide support and assistance in the management and operations of program related systems, which includes but is not limited to the following:

4.2.11.1 Provides system administration of Network, Web, and/or communication systems, including Local Area Network (LAN) and Wide Area Network (WAN) systems, Government owned cloud technologies, and commercial software across multiple security domains (NIPR, SIPR, JWICS).

4.2.11.2 Maintaining elevated privileges within the domains (NIPR, SIPR, JWICS). Elevate privileges perform security-relevant functions that ordinary users are not authorized to perform. Has access to system control, monitoring/security, administration, criminal investigation, or compliance functions to an IS/PIT. Required to have Level II IAT Certifications per DoD 8140.

4.2.11.3 Will conduct day to day system and software administration support activities.

4.2.11.4 Monitor and assist as needed the Cross Domain Solution (CDS) from NIPR to SIPR and from SIPR to JWICS

4.2.11.5 Required to be able to obtain up to a TS/SCI clearance

4.2.11.6 Responsible for 3DX functional specific end user and BA assistance and troubleshooting.

4.2.11.7 Issuing MQL commands for license summaries, research, object history, security concerns, system reporting capabilities, list of inactive users, user properties, etc.

5 Applicable Documents

Number Title Date N/A PMO Baseline Operations

Security (OPSEC) 10 Feb 2022

N/A National Industrial Security Program Operating Manual

(NISPOM)

12 May 2022

DoDI 8510.01 DoD Risk Management Framework for DoD Systems

19 Jul 2022

N/A DoD Cloud Computing Security Requirements Guide V1R4

14 Jan 2022

6 Cybersecurity

6.1 The Contractor shall adhere to DoDI 8510.01, which is the implementing policy for the DoD

Risk Management Framework.

6.2 The Contractor shall meet DoDM 8140.03, which is Cyberspace Workforce Qualification and

Management Program

6.3 The Contractor shall adhere to the Cloud Computing Security Requirements Guide (SRG) V1R4 and applicable STIGs.

7 Security The Contractor shall implement and maintain a security program to comply with the security requirements specified in the most recent contract DD Form 254, Contract Security Classification Specification. The Contractor shall apply and follow security requirements, as appropriate, to its suppliers, 32 CFR Part 117. The Contracts shall be responsible to ensure that personnel with access to program information, documents or materials adhere to current DoD OPSEC, and Cybersecurity requirements.

7.1 Classified Information

Classified information or data will not be disclosed to the Contractor until the Contractor has confirmed to the Government that Foreign Ownership, Control or Influence (FOCI)-mitigation and facilities security clearance are completed.

Subject to the aforementioned condition, classified information will only be disclosed to the Contractor on the Government’s premises and within the Government’s IT infrastructure. Should it be necessary for the Government to disclose classified information or data remotely to the Contractor, or to transfer classified information or data to the Contractor, the Government will obtain the approval of the Contractor prior to remotely disclosing or transferring the classified information or data.

7.2 Sensitive Unclassified Information

Sensitive Unclassified Information shall be understood as referring to: Controlled Unclassified Information (CUI), information subject to the International Traffic in Arms Regulations (ITAR), Export Administration Regulations (EAR), or subject to DoD Distribution Statement B through F, or Sensitive But Unclassified (SBU) markings.

On Government premises: If Sensitive Unclassified Information is disclosed or provided to the Contractor while located at the Government’s facilities, the Contractor’s employees shall not remove or make duplicates of the Sensitive Unclassified Information from the Government’s facilities without explicit Government direction and will follow the Government’s processes and procedures for accessing the Sensitive Unclassified Information.

Remote access: If Sensitive Unclassified Information is disclosed to the Contractor through remote access to customer environments, or through oral or visual disclosure, the Contractor’s employees shall not remove the Sensitive Unclassified Information from the Government’s environments or retain the data or any copy thereof in any form without explicit Government direction. The Contractor’s employees shall follow the Government’s processes and procedures for accessing the Sensitive Unclassified Information. Sensitive Unclassified Information shall be clearly marked with appropriate export control category or dissemination marking by the Government in the Government’s environments and any oral or visual media.

Transfer: If Sensitive Unclassified Information is to be transferred to Contractor environments by any means or transferred to the Contractor within the Contractor’s facilities or at any location other than the Government’s facility, it shall only be disclosed:

• Between the Government and the Contractor via DoD Secure Access File Exchange (SAFE) or other approved secured file transfer mechanisms.

Sensitive Unclassified Information will not be disclosed to Contractor through email.

Sensitive Unclassified Information shall bear conspicuous export control category or dissemination marking. Sensitive Unclassified Information that is improperly marked or not marked with appropriate export control category or dissemination markings will be promptly destroyed by appropriate means based on the classification category and will not be distributed to any other Contractor employees, unless the Government provides a written statement confirming that such information is not Sensitive Unclassified Information.

7.3 OPSEC

The Contractor shall apply OPSEC to reduce program vulnerability from adversary collection and exploitation of critical information. OPSEC shall be applied throughout the contract period of performance. The Contractor shall apply OPSEC in all aspects of their management of the Program IAW the DD Form 254 and the program’s Critical Information List (CIL).

The Contractor shall flow down all OPSEC requirements to subcontractors that handle Critical Information (CI). CI is defined as specific facts about friendly intentions, capabilities, or activities needed by adversaries to plan and act effectively against friendly mission accomplishment

7.4 Security Training required for Contractor

As part of its overall training requirements, the Contractor shall ensure its personnel complete security training for:

• Operations Security (OPSEC) Cybersecurity (CS)

• Controlled Unclassified Information (CUI)

• NATO Awareness Training

• Training and Derivative Classifier Training

The above trainings must be completed within thirty days of contract award.

OPSEC, and CS Training outline specific actions to protect classified and Sensitive Unclassified Information, activities, and operations for the duration of the contract in relation to 32 CFR Part

117 (NISPOM).

7.5 Security Incidents, Violations and Reporting

The Contractor shall immediately notify the Government Contracting Activity and the Government Security Manager and Government Information Systems Security Manager (ISSM) within (24) hours of discovery of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessments of the potential impact pending formal inquiry/investigation.

Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, applies to both SAP, classified, and unclassified contracts. The Contractor shall comply with

C252.204-7009, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

7.6 Loss or Compromise

The Contractor shall notify the Program Office of any loss, compromise, or suspected compromise of unclassified Critical Program Information (CPI), Critical Components (CC), or Controlled Unclassified Information (CUI). Unclassified CPI, CC, or CUI involved in each incident shall be specifically identified in an inquiry report to the Program Office. An initial notification of an incident by the Contractor to the Program Office shall be accomplished within 72 hours by the most expeditious means, followed by a detailed electronic message. A final and complete report of the incident shall be provided to the Program Office within seven (7) days of the incident’s occurrence or its initial detection by the Contractor

7.7 Personnel Security

Access to classified data/information up to and including TOP SECRET/SCI will be required in the performance of this work. Contractor personnel shall hold the necessary Government approved security clearances, have a legitimate need to know, and have been granted access by appropriate Government authority prior to being given access to classified data/information.

Personnel Security Program: IAW DoD Manual 5200.02, Personnel Security Program, DoD military, civilian, consultants, and Contractor personnel using unclassified automated information systems, including e-mail, shall have at a minimum, a completed favorable Tier 1 investigation.

The Contractor shall complete the application and apply for a Tier 1 investigation for any employee not currently having a Tier 1 investigation. The Government agency will obtain Tier 1 investigation for all Contractors prior to them being assigned work on the program.

If the employee does not have a security clearance and requires a favorable investigation, the Contractor shall submit a Memorandum for Record (MFR) requesting a Tier 1 investigation. This request must be approved and signed by the Program Manager (PM) or Contracting Officer Representative (COR). The memo will contain Personally Identifiable Information (PII) that is required to initiate a Tier 1 investigation. The PM or COR will submit this request to the System Manager (SM). Note: if a Tier 1 investigation is required, the company, PM and COR should reasonably expect it will take up to two weeks for the subject to be authorized a CAC. The investigation must be submitted, and fingerprint results must be reviewed IAW DoDI 5200.46, DoD Investigative Guidance before a CAC can be authorized.

Once favorable background check has been completed on Contractor, the Government Trusted Agent (TA) can submit for individuals’ CAC. Forms will not be accepted until a favorable background check is verified.

8 Location of Work The Contractor shall ensure that work performed, in multiple security domains (SIPR and JWICS), follow the guidelines and requirements for those individual domains. The contractor shall have certified workspace within commuting distances of personnel working this contract.

9 Travel

The Contractor shall follow the DoD Joint Travel Regulations (JTR) in accomplishing this activity.

Before undertaking travel to any location in performance of this Contract, the Contractor shall have this travel approved by, and coordinated with, the contracting officer, program manager, or other designated Government official, two (2) days in advance of travel. The Government will provide approval within 24 hours of receipt. If no response is provided within 24 hours of notification, the travel shall be deemed approved. Notification shall include, at a minimum, the number of persons in the party, traveler name, destination, duration of stay, Visitor Access Request (VAR), and purpose.

10 Data Rights

Reference DFARS clause 252.227-7013(b)(1)(ii) Rights in Technical Data – Noncommercial Items:

The Government shall have unlimited rights to "Studies, analyses, test data, or similar data produced for this contract, when the study, analysis, test or similar work was specified as an element of performance". The Contractor shall not provide any non-conforming or restrictive markings on documents produced as part of this effort.

11.2.2 Reference DFARS clause 252.227-7015(b)(1) Technical Data – Commercial Items:

“(i) The Government shall have the unrestricted right to use, modify, reproduce, release, perform, display, or disclose technical data, and to permit others to do so, that — Have been provided to the Government or to others without restrictions on use, modification, reproduction, release, or further disclosure other than a release or disclosure resulting from the sale, transfer, or other assignment of interest in the technical data to another party or the sale or transfer of some or all of a business entity or its assets to another party;

(ii)Are form, fit, and function data;

(iii) Are a correction or change to technical data furnished to the Contractor by the Government;

(iv) Are necessary for operation, maintenance, installation, or training (other than detailed manufacturing or process data); or

(v) Have been provided to the Government under a prior contract or licensing agreement through which the Government has acquired the rights to use, modify, reproduce, release, perform, display, or disclose the data without restrictions.”

11 Deliverables The Contractor shall deliver in accordance with Exhibit A (Contract Data Requirements Lists) of the contract.

Acronym List

AFLCMC – Air Force Life Cycle Management Center

3DX – 3DEXPERIENCE

SOW – Statement of Work

SAF/AQ – Assistant Secretary of the Air Force (Acquisition, Technology, and Logistics)

DoD – Department of Defense

TS – Top Secret

OOTB – Out of the Box

PLM – Product Lifecycle Management

TWC – Teamwork Cloud

MBSE – Model-Based Systems Engineering

CAD – Computer Aided Design

ATO – Authority to Operate

CAC – Common Access Card

SCI – Sensitive Compartmented Information

IPS – Integrated Production Schedule

ATU – Authority to Use

CTF – Certificate to Field

DS – Dassault Systemes

DISA – Defense Information Systems Agency

STIG – Security Technical Implementation Guides

G- IDE – Government Integrated Digital Environment

V&V – Verification and Validation

STR – Software Test Report

SUM – Software User Manual

CSPEI – Computer Software Product End Item

SHRS CRD – Software/Hardware Requirements Specification Configuration Requirements Document

UAT – User Acceptance Testing

STP – Software Test Plan

FTE – Full-time Equivalent

BA – Business Administrators

LAN – Local Area Network

WAN – Wide Area Network

NIPR- Non-secure Internet Protocol Router

SIPR – Secure Internet Protocol Router

JWICS – Joint Worldwide Intelligence Communication System

CDS – Cross Domain Solution

MQL – Model Query Language

OPSEC – Operations Security

NISPOM – National Industrial Security Program Operating Manual

PMO – Project Management Office

SRG – Security Requirements Guide

CFR – Code of Federal Regulations

FOCI – Foreign Ownership, Control or Influence

IT – Information Technology

CUI – Controlled Unclassified Information

EAR – Export Administration Regulations

SBU – Sensitive but Classified

SAFE – Secure Access File Exchange

IAW – In Accordance With

CIL – Critical Information List

CI – Critical Information

CS – Cybersecurity

ISSM – Information Systems Security Manager

CPI – Critical Program Information

CC – Critical Components

MFR – Memorandum for Record

PM – Program Manger

COR – Contacting Officer Representative

PII – Personally Identifiable Information

SM – System Manager

TA – Trusted Agent

JTA – Joint Travel Regulations

VAR – Visitor Access Request