DCAS Performance Work Statement_Draft 9 Aug 2024.pdf

PERFORMANCE WORK STATEMENT

DEFENSE FINANCE AND ACCOUNTING SERVICE (DFAS)

DEFENSE CASH ACCOUNTABILITY SYSTEM (DCAS)

Part 1 General

1.0 General:

1.1 Introduction:

The purpose of this task order is to provide Automated Information System (AIS) analysis and programming support for the Defense Cash Accountability System (DCAS) for the Defense Finance and Accounting Service (DFAS) in Cleveland, Ohio. The contractor shall provide all personnel and items necessary to perform the work identified within the Performance Work Statement (PWS), excepting specified Government Furnished Property and services.

1.2 Background:

The Defense Cash Accountability System provides the Department of Defense a single department-wide cash accountability system that consolidates, standardizes, simplifies, and improves automated support for all DFAS Centers. The DCAS web application provides 24x7 access to thousands of end users.

Mission – Attain operational excellence in services Location – Cleveland

DFAS Strategy – Deliver financial excellence and quality pay services for its customers

Customers – The DCAS Customer base comprises federal employees that provide financial and accounting services for the Department of Defense's agencies, and who submit their cash accounting transactions through DCAS for treasury reporting and/or cross disbursements to other agencies.

This procurement obtains Automated Information System (AIS) analysis and programming support for the Defense Cash Accountability System (DCAS).

At their current velocity, DCAS's Agile software development teams collectively implement into the production application between two and three maintenance SCRs each month. This excludes technical SCRs, approximately two of which are implemented for each maintenance SCR.

The DCAS I&T team fields approximately 1,200 Production Support requests per year.

1.3 Objectives:

This PWS defines the tasks and skilled technical services needed to support the DCAS Product Team's sustainment of the DCAS, including any enhancements required by the DoD. This contract will provide the DFAS Information & Technology (I&T) organization with labor support to respond quickly to changing environments and support the DCAS projects assigned by DoD.

The services to be acquired fall within the following general areas of system development and maintenance:

Requirements analysis

System analysis and design Documentation

Source code development

Software quality testing

Application release implementation

Information system performance monitoring Production problem research and resolution

Issue/incident resolution via direct interaction with end-users

Adherence to management's internal controls

Training and provision of technical support to application end users and software developers

Agile Methodology: The contractor shall work in a team-based Agile environment. The Product Owner will specify high-level requirements/capabilities to the Agile team. As in typical Scrum-based Agile processes, the Agency Product Owner will work together with the team to develop and estimate user stories and establish acceptance criteria. These acceptance criteria shall specify expected functionality for a user story, as well as any non-functional requirements that must be met in the development of the story. The Agency Product Owner, supported by subject matter experts and business analysts, will determine whether or not acceptance criteria have been satisfied.

1.4 Scope

The contractor shall provide all necessary personnel, management, administrative, and technical services to meet the requirements and/or tasks outlined in this PWS. The software and non-software support services to be acquired supplement the existing government led DCAS I&T staff in the areas of software development, software testing, application release implementation, and technical production support. The Government has determined the Specific Tasks listed below must be completed for this requirement to succeed. To support the scope of DCAS, the contractor shall complete the nine (9) tasks outlined in section 4 of this PWS, which is as follows:

Task 1: Contract Program Management Task 2: Requirements Management & Analysis Task 3: Technical Design Activities Task 4: Configuration Management Task 5: Source Code Development and Maintenance Task 6: Testing Support Task 7: Implementation Task 8: Technical Production Support Task 9: Agile Software Development Meetings

The scope is limited by the specific tasks listed in Section 4 and by Technical Exhibit #1.

5.0 Period of Performance

The period of performance shall be for one (1) year with four (4) option years as follows:

Base Year: April 1, 2025 through March 31, 2026 Option Year 1: April 1, 2026 through March 31, 2027 Option Year 2: April 1, 2027 through March 31, 2028 Option Year 3: April 1, 2028 through March 31, 2029 Option Year 4: April 1, 2029 through March 31, 2030

6.0 Place of Performance

The work to be performed under this T.O. can be performed at the DFAS Cleveland Government location or virtually at other locations agreed to by DFAS and the contractor. Travel may be required within the Contiguous United States (CONUS) locations to support DCAS.

DFAS Cleveland AJ Celebrezze Federal Building 1240 East Ninth Street Cleveland, OH 44199

When performing at DFAS sites, the contractor shall require their employees to follow the regulations as if their contractor employees were DFAS employees, unless relieved of that responsibility by the Contracting Officer.

DFAS 2000.1-I

DFAS 5200.1-I

DFAS 5200.8-I and

DFAS 5200.10-I

11.0 Additional Information

11.1 Interaction with Contractor Personnel

The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel, when applicable) shall provide the COR, within 30 days after the T.O award/exercise of an option, a written report identifying:

1. Contractor employees required to take the training

2. Contractor employees who completed the training

3. Contractor employees who are delinquent

Contractor personnel shall direct their questions or concerns to their contractor management chain and/or company representative.

11.2 Recognized Holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Christmas Day Independence Day

Holidays that occur on a Saturday will be observed on the previous business day. Holidays that occur on Sunday will be observed on the next business day.

11.3 Hours of Operation

The contractor shall conduct business between the hours of 0600-1800, Monday thru Friday, Eastern Time, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for any of the above reasons. The stability and continuity of the workforce are essential.

11.3.1 On-Call/After Hours Support

At the request of the DCAS System Manager, Contracting Officer Representative (COR), or Alternate COR, the Contractor shall provide on-call and after-hours operation support for projects under this T.O.

On-call refers to the following activities outside of normal business hours: (a) the availability of the contractor employee to receive telephone calls after they have completed a normal workday, (b) extended hours at the Government or contractor site due to production issues (e.g., to resolve an application outage), or (c) telephone consultation outside of normal working hours. If the problem cannot be resolved from their home, the contractor employee shall be required to return to the Government or contractor site to resolve the problem. The contractor employee shall keep an after-hours log of the phone call(s) and time spent connected to DFAS-CL systems while researching the problem.

11.4 Post Award Conference/Periodic Progress Meeting

The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

11.6 Contracting Officer Representative

The COR is the primary point of contact for the contractor. The COR shall interface with DFAS Information and Technology (IT) Point of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656

Follow the link titled “Site Specific Force Protection/Security Services” in the Additional Points of Contact section near the top right side of the Web page.

The COR is responsible for monitoring all technical aspects of the award and assisting in contract administration. COR duties include:

Ensure contractor performs the technical requirements of the award.

Perform inspections necessary in connection with contract performance.

Maintain written and oral communications with the contractor concerning technical aspects of the award.

Monitor contractor’s performance and notifies both the CO and contractor of any deficiencies.

Coordinate availability of Government furnished property and site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

11.7 Type of Contract

The contract type is anticipated to be a mix of Firm-Fixed Price (FFP), Labor Hour (LH) and Time & Material (for travel only).

11.8 Identification of Contractor Employees

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contract personnel will be issued Government Common Access Cards (CACs) identifying them as a contractor after favorable security adjudication. Contractor employees must wear CAC’s while in the facility.

11.9.1 Contractor Travel

Performance under this T.O. may require travel by contractor personnel to CONUS locations. The contractors shall be required, as requested by the Government, to travel for meetings, system discussions, presentations, presentation of deliveries, and task exit interviews. If travel is required, then the contractor is responsible for making all needed arrangements for their personnel.

11.9.2 Travel Policy

The Government will reimburse the contractor for allowable travel cost incurred by the contractor in performance of the contract in accordance with FAR 31.205-46. Overhead, profit and Other Direct Costs are not an allowable travel cost for this requirement. The contractor will only be reimbursed for allowable direct labor costs.

Travel must be approved by the COR prior to any travel being made. When travel is required, the contractor is responsible for making all needed arrangements for their personnel. Actual travel costs will be reimbursed IAW FAR 31.205-46.

The contractor shall provide a trip report five (5) days after each trip associated with a travel approval.

The contractor shall maintain a summary of all approved travel, to include at a minimum, the name of the traveler, location of travel, duration of trip, total cost of trip. The contractor shall confirm travel requests in writing and shall provide the COR with names of travelers, expected duration of travel, travel locations, cost estimates and labor effort associated with the travel prior to travel period. No travel is expected outside the continental United States (OCONUS).

Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence, or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, to include parking expenses. A CLIN will be used for contractor travel reimbursement.

11.10 Relocation

Relocation costs and travel costs incident to relocation are not allowable and will not be reimbursed hereunder.

11.11 Data Rights

The DCAS requirement will utilize current data and software that is owned by the government. Although the Contractor will be given access to, and the ability to use, the existing DCAS code, documentation, and data, DFAS will retain its intellectual property rights to the data and code.

DFAS intends that all data, software, and documentation delivered by the contractor in performance of this TO will be owned by DFAS. This data, software, and documentation includes, but is not limited to, data, documents, graphics, code, plans, reports, schedules, schemas, metadata, architecture designs, and the like; additionally, all new open source software created by the contractor and forks or branches of current open source software where the contractor has made a modification; and all new tooling, scripting configuration management, infrastructure as code, or any other final changes or edits to successfully deploy or operate the software.

The government requires “Unlimited Data Rights” to all data produced by the contractor in the performance of this TO. DFARS Provisions and Clauses 252.227-7013, 252.227-7016, 252.227-7017, 252-227-7030, and 252-227-7037 are applicable to performance to orders placed under the Blanket Purchase Agreement.

The Recipient agrees to destroy the Source and Resulting Code, all copies of the Source and Resulting Code, and any derivative work of the Source and Resulting Code, in its possession, no later than 30 days after the expiration, termination, or cancelation of the Task Order including any exercised options or upon written request from the government, whichever comes first. Additionally, all persons to whom the Recipient shared the Source and Resulting Code with shall also destroy the Source and Resulting Code and notify the Recipient that the Source and Resulting Code have been destroyed. The Recipient shall then notify the Contracting Officer of the destroyed Source and Resulting Code by its shared parties.

11.12 Organizational Conflict of Interest

Contractor personnel performing work under this task order may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart

9.5. The contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

11.13 Section 508 Compliance

This requirement is applicable to Section 508 Compliance Electronic and Information Technology (EIT) Requirements:

36 CFR part 1194.31 (Subpart C) Functional Performance Criteria

36 CFR part 1194.41 (Subpart D) Information, Documentation, and Support

Unless the Government invokes an exemption, all EIT products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information

Technology Accessibility Standards at 36 CFR 1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed and state the degree of compliance with the applicable standards. Additionally, the contractor shall clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., contractors or other exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at time of award.

The contractor shall ensure that all EIT products and services proposed that are less than fully compliant, are offered pursuant to extensive market research, which ensures that they are the most compliant products available to satisfy the solicitation’s requirements.

If any such EIT product or service proposed is not fully compliant with all of the standards, the contractor shall specify each specific standard that is not met; provide a detailed description as to how the EIT product or service does not comply with the identified standard(s); and shall also indicate the degree of compliance.

11.14 Quality Control

The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which they assure themselves that the work complies with the requirement of the Task Order (TO). The program should take into consideration the Task (See Part 4) and Performance Requirements Summary (PRS) (Part 7, Exhibit 1) of the PWS.

11.15 Quality Assurance Plan

The Government shall evaluate the contractor’s performance under this TO in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance and the minimum acceptable level of support.

Part 2 Security Requirements

2.0 Security Requirements.

2.1 General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

2.2 Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required. IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days)*. A Declaration for Federal Employment (OF-306) should then be submitted to the Contracting Officer Representative (COR), who will submit this form along with a Contractor Request for Investigation (CRI) (DFAS Form 9035) to DFAS Personnel Security as soon as possible, but not less than fifteen (15) calendar days prior to the intended start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

2.3 Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), COR, and the DFAS Personnel Security Office.

2.4 DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

2.5 Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the COR, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that person’s delinquent on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

2.6 Foreign Travel by DFAS Contractor Personnel

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

2.7 Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

2.8 Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI).

The DFAS manager of the requiring office will determine what CUI contractor personnel are given access

to. CUI may not be disclosed to contractor personnel unless required for contract performance.

Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

2.9 Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

2.10 Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

2.10.1 Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

2.10.2 Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/

Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

2.10.3 Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

2.10.4 Level I Antiterrorism Awareness Training. All contractor personnel shall take this training.

For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

2.10.5 Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

2.10.6 Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

2.10.7 Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

2.10.8 DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

2.10.9 Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

2.10.10 Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

2.10.11 Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training:

Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

- Contractor employees required to take the training

- Contractor employees who have completed the training

- Contractor employees who are delinquent

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

Part 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.0 GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Government Furnished Equipment: Laptops shall be furnished by DFAS and shipped to the remote working locations of those fulfilling the activity of the contract. All software resident on the computers required to complete the tasks will be made available to the contractor after Desktop Management Initiative (DMI) and Cyber Security Service Contractor (CSSP) approval. Only DFAS Government furnished equipment shall be connected to the DFAS Enterprise Local Area Network (ELAN). The contractor shall be fully responsible for maintaining the inventory, providing physical security, and returning the equipment and materials to the Government in the same condition in which they were received, after completion of the period of performance.

Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI.

For contractor personnel working at alternate locations agreed upon by DFAS and the contractor, access will be provided to the required platforms. The Government shall provide the access network connection, via the Cisco AnyConnect Virtual Private Network for any personnel not working at the DFAS site.

The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of business each workday, Government equipment and materials shall be secured.

3.2 DFAS IT Policy Concerning Contractor Furnished Equipment (CFE).

In accordance with Chapter 3 of DFAS Regulation 8400.1-R, personally owned workstations, laptop computers, software, and printers, including computers connected remotely will not be connected to the DFAS Enterprise Local Area Network (ELAN).

This prohibition is a security requirement to protect the ELAN from the spread of malicious logic (viruses and Trojan Horse programs) and to protect sensitive but unclassified (SBU) information from being compromised.

Part 4 Specific Tasks

4.0 Tasks/Requirements

The specific tasks that the contractor will perform are identified in the Performance Requirement Summary (PRS), which is attached as exhibit 1 and fully incorporated herein. It sets forth how the contractor’s activities will be monitored and measured. The tasks required are organized into the following system lifecycle categories: requirements development, technical design, configuration management, source code development and maintenance, testing, implementation, and production support activities. Each category of work has specific detailed tasks that set forth the results the contractor must accomplish and the performance measures for each. A more general description of the work required to be performed and expectations governing how that work will be performed are provided below.

4.1 Task 1: Contract Program Management

The contractor shall track in a government reporting system the hours worked on various projects using codes provided to them. The tracking and updating of the above information shall be captured in a Staffing Matrix and detailed in individual project milestone charts. The contractor shall also prepare a monthly Staffing Matrix to include each contractor performing under this T.O. The Staffing Matrix shall highlight any changes from the previous report. The Staffing Matrix shall list the Contractor’s Name, Subcontractor, Start Date, Stop Date, and any other information agreed to by the Government and the contractor.

The contractor shall prepare and deliver a weekly Status Report to the COR. The contractor shall report by project/system that details the system, Government team leader, Contractor(s) assigned, summary of activities for the week, progress, problems encountered, and solutions to the problems.

4.1.1 Monthly Performance and Cost Report

The contractor shall prepare and deliver on a monthly basis a Performance and Cost Report and a Summary Project Status Report to the COR no later than the 5th workday of the month. The contractor shall maintain and report IAW the Government’s instructions the following: the current status of this T.O.; relevant information regarding problem areas and courses of action taken in their resolution;

potential problems anticipated; significant activities, work progress, and T.O. costs; metrics, and cost data; forecasts; and analyses. The metrics shall focus on how the contractor performance rates against the acceptable level of performance (ALP) set forth in the PRS for the work performed by the contractor. The contractor shall report status and cost IAW the Government-approved.

A soft copy of the Performance and Cost Report (not including Travel attachments) shall be attached to the contractor’s invoice. Upon the expiration of the period of performance, the contractor is responsible for submitting the final invoice within sixty calendar days of the end of the period of performance.

4.1.2 Management Reviews (MRs)

The contractor shall prepare and provide Management Reviews (MRs) to identify and address progress, problems, and other pertinent information. The Government may require these Management Reviews intermittently in order to address pertinent issues. The contractor shall identify all Subcontractors and address progress, problems, and other pertinent, detailed information. If required, the contractor shall ensure the following topics are available for discussion at the MR: the management of T.O. activities, scheduling, costs, and technical status.

4.2 Task 2: Requirements Management & Analysis

4.2.1 Requirements Development

When requested, the contractor will work with stakeholders from the DCAS user community and Program Management Office (PMO) in the DFAS Enterprise Solutions & Standards (ESS) organization to assist in the PMO's efforts to gather requirements for system change requests (SCRs).

4.2.2 Functional Analysis

The functional analysis process reviews the requirements provided in SCRs, ensuring the requests are legible, understandable, and align with the DCAS Master Requirements Document format. It also identifies the business process impacts and use-case scenarios in scope of the SCR. When requested, the contractor will analyze and review the Functional Analysis document(s) drafted for a DCAS SCR and provide feedback and seek clarification on items within the document that may impact the software development team's ability to realize the technical requirements of the change.

4.2.3 Requirement Review & Analysis (RRA) Milestones Meeting

The contractor will attend requirements review and analysis milestone meetings and participate by reviewing and discussing with the relevant stakeholders the requirements and functional analysis developed for the milestone's SCR.

4.3 TASK 3: Technical Design Activities

4.3.1 Technical Analysis

The contactor shall provide sound technical analysis and designs to satisfy and unit-test the requirements identified in an SCR's functional analysis or other statement of requirements. This technical analysis will identify the changes to DCAS's technical architecture that will be required to implement the SCR. DCAS I&T will provide the format for this Technical Analysis document.

4.3.2 Testing Analysis

The contractor will analyze the software testing activities required to validate a prospective software change. The contractor will use the SCR's functional analysis to establish the scope of functional testing necessary to validate the effectiveness of the change after it has been implemented into a test environment. The contractor will formally document this analysis in a Testing Analysis document, the format of which will be provided by DCAS I&T.

4.3.3 Analysis/Design Peer Review

The contractor will perform a peer review of the technical analysis and/or testing analysis work products completed by DCAS I&T's development and/or software testing staff to verify the completeness and accuracy of these work products.

4.3.4 Design Review Milestone Meetings

The contractor will attend design review milestone meetings and be prepared to present and/or discuss the technical analysis and/or testing analysis offered for the SCR in scope of the milestone. The contractor will also review the technical solution, provide comments, and discuss action items until approval is received to begin developing source code and testing the technical solution.

4.4 Task 4 Configuration Management

4.4.1 Environment Management

The contactor shall provide environment management support. The contractor will collaborate with DCAS I&T management to prepare and refresh development and test environments per the requirements of the product team leaders.

4.4.2 Configuration Management Information System (CMIS) Duties

The contractor shall update various records in DCAS I&T's configuration management information system (CMIS), as directed by DCAS's system life cycle policy documentation.

4.4.3 Source Code Version Control Branch Management

The contractor will create and maintain source code branches and the production baseline within DCAS I&T's version control management system, as directed by DCAS's system life cycle policy documentation.

4.5 Task 5 Source Code Development and Maintenance

4.5.1 Source Code Development and Modification

The contactor shall provide source code development and maintenance support. The contractor will develop and/or modify source code, commonly using the PL/SQL or Java languages, depending on changes needed. Coding shall be segregated to an assigned source code branch and development environment.

4.5.2 Unit Testing

As code is developed, the contractor shall test individual units of source code or sets of one or more program modules, together with the associated control data, usage procedures, and operating procedures, to determine if the observed functionality satisfies the requirements of the SCR for which it was developed.

4.5.3 Code Peer Reviews

The contractor will perform software reviews in which a work product (document, code, or other) is examined by its author and one or more colleagues, in order to evaluate its technical content and quality.

4.6 Task 6 Testing Support

4.6.1 Test Script Development

The contractor will develop the test script(s) to be executed during formal test events that exercise the integration and execution of modified source code within the use case and data requirements of a change request.

4.6.2 Test Script Execution

During designated test events, the contractor will execute the…