DCPS PWS_4.20.2026.docx

PERFORMANCE WORK STATEMENT (PWS)

Defense Civilian Pay System

Part 1

General Information

1. GENERAL:

1.1 Introduction. The contractor shall provide all personnel and items necessary to perform the functional and technical support for the Defense Civilian Pay System (DCPS) as defined in this Performance Work Statement (PWS) except for those items specified as Government furnished property and services.

1.2 Background. The primary purpose of this contract is to obtain information and technology (I&T) support for the Defense Civilian Pay System (DCPS) located at the Defense Finance and Accounting Service (DFAS), Indianapolis, IN. DCPS was selected as the standard Department of War (DoW) formally Department of Defense (DoD), civilian pay system in 1991. The system maintains pay and leave entitlement records, deductions and withholdings, time and attendance data and other pertinent employee personnel data. Through the use of DCPS, DFAS is standardizing civilian payroll policies, processes, systems and procedures throughout the Department.

Multiple accounting systems interface with DCPS by receiving one or a combination of several standard accounting interface files. These files are created on a daily, weekly or biweekly basis and are electronically transmitted to the appropriate installation level or departmental accounting system. Each disbursing officer that services a DCPS payroll office is responsible for the disbursement of funds, as vouchers and certified by the payroll office.

The DCPS Automated Information System (AIS) is developed and maintained by a single Central Design Activity (CDA), I&T Payroll Services - Indianapolis. The CDA provides functional requirements analysis; database design and maintenance; identification of system hardware and telecommunications requirements; technical design; programming; documentation; and implementation support and training materials for customers. The CDA also monitors operation of pay processing and receipt of interfacing files between trading partners and resolves problems for customers and payroll offices. Customers of DCPS include the DoW, Health and Human Services, Department of Energy, Veterans Affairs, Executive Office of the President, and the United States Agency for Global Media.

1.3 Objectives. The overall objective of this PWS is to define the tasks necessary to obtain the full software life cycle support in the development and maintenance of DCPS.

1.4 Scope. The contractor shall provide all necessary personnel, management, materials, administrative and technical services required to meet the requirements and/or tasks outlined in this PWS. The software and non-software support services to be acquired fall within the general areas of implementing change requests to the system and performing routine system maintenance. The software and non-software support services to be acquired fall within the general areas of:

Software Testing

Appendix A provides a list of the required Systems Skills necessary to perform these support services.

1.5 Period of Performance (PoP). The period of performance shall be for one (1) Base Period of 12 months and four (4) 12-month option periods.

1.6 Quality Assurance Plan (QAP). The contractor shall develop, maintain, and manage an effective QAP to ensure services are performed in accordance with this Performance Work Statement (PWS) and the performance standards set forth in the Performance Requirements Summary (PRS) at Technical Exhibit 1. The contractor’s QAP is the means by which it assures compliance with the work requirements and shall include procedures to identify, prevent, and ensure the non-recurrence of defective services. The plan should consider the directions provided in Section 7.1 of this PWS and will be used to collect and monitor performance data for reporting to the Contracting Officer Representative (COR). The contractor shall deliver their proposed QAP with their quote. After the initial QAP is accepted, the contractor must receive the Contracting Officer's (CO) acceptance in writing for any proposed changes, and a revised plan must be submitted within 5 business days of any changes. Unless otherwise indicated, the rating period for performance will be quarterly, with formal monthly status reports on progress.

1.7 Recognized Holidays.

Independence Day

If the holiday occurs on a Saturday the holiday will be observed on Friday. If the holiday occurs on Sunday the holiday will be observed on Monday.

1.8 Hours of Operation. The contractor shall conduct business between the hours of 6:00am and 6:00pm, Monday - Friday except for federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for any of the above reasons. Production Support personnel are required 24/7 to perform operations and help desk support.

1.8.1 Extended/Emergency Hours. When mission needs dictate, contractor staff shall be available to support the work described within this PWS outside of standard facility duty hours, including nights and weekends. The Contracting Officer Representative (COR), Contracting Officer (CO), or management will provide reasonable advance notice for such requirements. Except in cases of a bona fide emergency, "reasonable notice" is defined as a minimum of 48 hours. For emergency situations, the COR, CO, or management will provide notice as soon as is practicable, and the contractor shall be required to respond accordingly.

1.9 Place of Performance. The work will be performed at the DFAS Indianapolis Center or at other locations agreed to by the COR or Contracting Officer and the contractor. Travel may be required to CONUS locations to support DCPS customers. CONUS sites are predominantly military bases or other Government installations. See paragraph 1.24 for further travel information.

1.9.1 Remote Location. The contractor may be authorized to work from a remote location when it’s advantageous to the DFAS mission. This must be coordinated with and approved by the COR.

1.10 Security and Privacy Act. All work performed relative to the requirement identified in the Performance Work Statement is unclassified and requires access to sensitive information, covered by the Privacy Act of 1974 and other DoW/DoD and DFAS regulations.

1.11 Security Requirements.

(a) General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National.

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

(b) Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical-Sensitive (formerly IT-II) or higher-level Investigation granting National Security eligibility. Contractor personnel must also have current enrollment (within 5 years) in the Continuous Vetting program, in accordance with Trusted Workforce 2.0 standards. No access to classified information is required. In accordance with standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days) *.

Contractor personnel must apply for a fingerprint appointment immediately (the next business day) upon award date.

Contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day after providing fingerprints) to the Contracting Officer Representative (COR). The information needed in the Declaration for Federal Employment (OF-306) also be submitted to the COR by contractor personnel.

The COR will submit the OF-306, DFAS Form 9035, and proof of fingerprints to DFAS Personnel Security all at once. Under no circumstances should this documentation be submitted less than fifteen (15) calendar days prior to the intended performance start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

Contractors obtaining favorable security evaluations and DoW/DoD CACs for required contractor employees performing on this contract are a prerequisite for contractor performance and invoicing. Also, the failure of a contractor to provide employees who can obtain a favorable security adjudication and a DoW/DoD CAC in a timely manner may be considered negatively when assessing contractor performance, termination, or other.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person comes directly from another DoW/DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

(c) Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DoDM 5220.23, “Industrial Security Procedures For Government Activities,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 2000.1-I, “Force Protection Mission,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. Ensure that all contracting officers include applicable clauses in all contracts that require work to be performed for a DFAS location. The contractor shall immediately report any occurrences of violation of stated regulations to the DFAS Manager of the area to which they are assigned, Contracting Officer (CO), COR, Director, Force Protection, and the DFAS Personnel Security Office.

DoW/DoD Issuances can be located at the following web link:

https://www.esd.whs.mil/dd/dod-issuances/ DFAS Instructions can be located at the following agency portal web link:

Official Forms and Pubs - All Documents

(d) DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program," further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for the United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke contractor personnel access to DFAS IT systems, sensitive information and/or DFAS facilities.

(e) Incident Reporting Requirements. In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the CO, the COR, the Director, Force Protection, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that a person’s delinquency on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the Government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to government data, facilities, and/or equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

(f) Foreign Travel by DFAS Contractor Personnel. Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoW/DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/en/international-travel/travel-advisories.html/ for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

(g) Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, DFAS 2000.1-I, DFAS 5200.1-I, DFAS 5200.8-I, and DFAS 5200.10-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

(h) Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance. Contractor personnel must monitor CUI for aggregation and compilation based on the potential to generate classified information. Contractor personnel must report the potential classification of aggregated or compiled CUI to the DFAS Manager of the area to which they are assigned, the CO, the COR, and the Director, Force Protection.

(i) Installation Entry and Common Access Card (CAC) Requirements. The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describe the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

(j) Training. DoW/DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoW/DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a CAC, or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

1. Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

2. Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

Cyber Awareness Challenge Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

3. Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

4. Level I Antiterrorism Awareness Training. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

Level I Antiterrorism Awareness Training All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

5. Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

6. Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

7. Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

8. DoW/DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

DoW/DoD Mandatory Controlled Unclassified Information (CUI) Training

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

9. Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

Unauthorized Disclosure of Classified Information and Controlled Unclassified Information

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

(k) Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

(l) Training Methods: Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training: Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoW/DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoW/DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

1.12 Post Award Conference/Periodic Progress Meetings. In accordance with Federal Acquisition Regulation (FAR) Subpart 42.302(a)(3), the contractor shall attend any post-award conference convened by the contracting activity. The Contracting Officer (CO), Contracting Officer's Representative (COR), and other Government personnel may meet periodically with the contractor to review performance. These meetings serve as the formal mechanism for the Government to provide performance feedback and for the contractor to identify any issues or challenges. Both parties shall work to resolve outstanding issues discussed in these meetings. All such meetings will be held at no additional cost to the Government.

1.13 Knowledge Transfer Plan. The incumbent contractor will carry out a thorough knowledge transfer and phase-out plan to ensure a smooth handover of all contract duties to the new contractor and/or designated Government staff. This transition will take place during a formal phase-out period, which will last no more than 90 days before the contract ends. The exact length of this period will be set by DFAS.

During the phase-out period, the incumbent contractor is required to fully cooperate and provide on-site support to help transfer all operational and system-related knowledge. The incumbent contractor must also perform a final system configuration audit to confirm that all configuration items, source code, and related documentation are complete, up to date, and stored in the designated DFAS repositories, as specified by the Software Life Cycle process.

The following tasks are required to ensure that all contractors have fully documented their applications. This includes, but is not limited to:

1. A system configuration audit is to be conducted in order to ensure that all configurable items are fully documented in DFAS Now and the Oracle Designer database.

2. Validation of the documents to ensure documentation is current. Some examples of documentation include:

a. Operations Manual.

b. Maintenance documentation.

c. Process documentation.

d. Entity relationship diagrams.

e. Other systems documentation as determined by DFAS.

3. Help desk procedures are fully documented.

4. Release schedule documentation for all currently planned releases. This documentation shall include all milestones such as Critical Design Review (CDR), Testing Dates, Implementation dates, etc.

1.14 Contracting Officer Representative (COR). A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.15 Type of Contract. A combination of Firm Fixed Price (FFP) and Labor Hour (LH) CLINS will be applicable.

1.16 Identification of Contractor Employees. All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contract personnel will be issued Government Common Access Cards (CACs) identifying them as a contractor after favorable security adjudication. Contractor employees must wear CAC’s while in the facility.

1.17 Contractor Travel. Performance under this contract may require contractor personnel to travel in support of official duties, such as information gathering, system analysis, software testing, or installation. All travel requires prior written authorization from the Contracting Officer (CO) or the designated Contracting Officer’s Representative (COR).

Allowable travel costs will be reimbursed by the Government in accordance with Federal Acquisition Regulation (FAR) Subpart 31.205-46, "Travel Costs." The contractor is responsible for coordinating and booking all travel arrangements for its personnel. A detailed invoice with supporting receipts must be submitted for reimbursement.

1.17.1 Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Under no circumstances will costs be reimbursed for travel performance for personal convenience and daily travel to and from normal work site, to include parking expenses. A CLIN will be used for contractor travel reimbursement.

1.17.2 Relocation costs and travel costs incident to relocation are not allowable and will not be reimbursed hereunder. All travel requires Government approval/authorization and notification from the COR.

1.18 Organizational Conflict of Interest. In the performance of this requirement, contractors and subcontractor personnel may receive or develop proprietary, source selection, or other sensitive information that could create an Organizational Conflict of Interest (OCI), as defined in Federal Acquisition Regulation (FAR) Subpart 9.5.

The contractor shall immediately notify the Contracting Officer (CO) in writing upon becoming aware of any actual or potential OCI. Concurrently, the contractor shall submit a comprehensive Mitigation Plan detailing the actions to be taken to avoid or mitigate the conflict.

The CO has the sole discretion to determine the acceptability of the contractor’s Mitigation Plan. If the CO determines that the OCI cannot be acceptably avoided or mitigated, the CO may impose any remedies deemed necessary. These remedies may include, but are not limited to, prohibiting the contractor from participating in future contract requirements related to the OCI.

1.19 Monthly Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, no later than the 10th day of the following month, identifying the training status of all contractor personnel. This report can be integrated with the regularly scheduled Monthly Status Reports

1.20 Section 508 Compliance. All Information and Communication Technology (ICT) developed, procured, maintained, or used under this contract shall comply with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d). Compliance shall be measured against the accessibility standards as amended and outlined in the regulations implementing Section 508.

The contractor shall identify all ICT products and services provided under this contract and provide documentation detailing their compliance with the applicable accessibility standards. This documentation, such as a completed Voluntary Product Accessibility Template (VPAT®), must be made available to the Government upon request. The contractor must specify where this compliance information can be verified.

If a proposed ICT product or service is not fully compliant, the contractor must demonstrate through market research that it is the most compliant solution available that meets the Government’s requirements. For any non-compliant ICT, the contractor shall provide a detailed report that:

· Identifies each specific accessibility standard that is not met.

· Describes in detail how the product or service fails to meet the identified standard.

· Specifies the degree of partial compliance.

PART 2

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

2. GOVERNMENT FURNISHED ITEMS AND SERVICES:

2.1 Government-Furnished Property, Equipment, and Information (GFP/GFE/GFI).

For contractor personnel performing work on-site at a DFAS facility, DFAS will provide all necessary facilities and services. This includes, but is not limited to:

· Workspace: Office space, desks, chairs, and climate control.

· Office Supplies: Standard office supplies equivalent to those used by Government personnel.

· Hardware: Computers, monitors, printers, and other necessary peripherals.

· Telecommunications: Access to Government telephone and facsimile networks, including access to commercial lines where required for official duties.

· Network Access: Electronic mail accounts and access to the DFAS network.

· Software: All Government-off-the-Shelf (GOTS), Commercial-off-the-Shelf (COTS), and custom software required for performance of duties will be provided and licensed by the Government.

· Storage: Secure storage space for equipment and documents as required.

2.2 Remote Access. For contractor personnel authorized to work at alternate locations, DFAS will provide logon IDs and access to required platforms via a Government-managed Virtual Private Network (VPN). The contractor is responsible for providing all other resources, including internet connectivity and a suitable workspace for its remote personnel.

Any additional facilities or services required for performance outside a designated Government site are the responsibility of the contractor and must be proposed as part of the contractor's technical solution.

2.3 Desktop Management Initiative (DMI). DMI is the DFAS Standard for software/hardware. All computers connected to DFAS sites must be configured under the Desktop Management Initiative or existing site configuration.

2.4 Only DFAS property of the Government shall be connected to the DFAS Enterprise Local Area Network (ELAN).

2.4.1 DFAS IT Policy Concerning Contractor Furnished Equipment (CFE). In accordance with Enclosure 8 of DFAS Regulation 8400.1-R, dated August 2008, personally owned workstations, laptop computers, software and printers, including computers connected to the DISP, will not be connected to the DFAS ELAN. This prohibition is a security requirement to protect the ELAN from the spread of malicious logic (viruses and Trojan Horse programs) and to protect sensitive but unclassified (SBU) information from being compromised. Contractors performing duties in a DFAS facility may be provided DFAS owned workstations and printers. Contracts that require contractor-provided workstations and printers to connect to the ELAN shall require written approval from the Director, Infrastructure Management prior to connecting. Approval for connection to the ELAN is contingent on the contractor furnished equipment meeting all stipulations cited in paragraphs C3.3.4.1 through C3.3.4.10 of Chapter 3 of DFAS Reg 8400.1-R dated August 2008.

The contractor shall notify the DFAS LAN support personnel prior to permanently removing any previously connected workstations from DFAS property. Laptop computers taken home by contractors will not be erased until the person is permanently removed from the DFAS project or the laptop is being removed from DFAS ELAN service. The Government personnel will zero the disk drive(s) using Government approved (Ghost 7-pass) software. This ensures that DFAS licensed software and sensitive but unclassified and privacy act protected information is not removed from Government control.

PART 3

SPECIFIC TASKS

3. SPECIFIC TASKS:

Basic Services: The contractor service requirements are summarized into task descriptions that relate directly to mission essential items.

3.1 DOCUMENTATION AND TRAINING MATERIALS

3.1.1 Create Customer Documentation. The contractor shall create or maintain all documents defined within the business practice handbook necessary to allow proposed system changes to take place. Documentation shall be informative and complete to the customer regarding upcoming system or process changes. All documentation shall be Section 508 compliant as provided in 36 CFR part 1194.41 (Subpart D) Information, Documentation and Support and other Government requirements.

3.1.2 Develop Training Materials. The contractor shall develop new training materials related to using, developing, and maintaining the payroll system, micro-applications, or other software utilized by the project. Materials will be presented in a professional manner to system users.

3.2 REQUIREMENTS ANALYSIS

3.2.1 Functional Analysis Support

3.2.1.1 Review and Analyze Requirements. The contractor shall review submitted point papers, DCPS Action Requests (DARs), System Change Requests (SCRs), email requests, or meeting action items. Written analysis of proposed changes shall be provided, to include affected system components and expected level of effort to make requested changes. All responses shall be coordinated with the customer.

3.2.1.2 Document Requirements Turnover Acceptance. The contractor shall meet with customers to review requirements documentation to ensure all requirements are complete.

3.2.1.3 Develop the Functional Requirement. The contractor shall perform a detailed analysis of the proposed system change to ensure that all relevant details and impacts are encompassed, capturing all material design items. The functional portion of the SCR document will be developed and written in accordance with professional standards and business processes.

3.2.1.4 Hold Functional Peer Review. The contractor shall review and analyze the functional documents prior to presenting and/or participating in Peer Review meetings. DARs, if applicable, shall be reviewed for any deficiencies. Corrective action will be recommended to avoid repeating the problems.

3.2.1.5 Document Issue Repository. The functional peer review meeting shall be fully documented, to include the date held, attendees, and disposition of the functional document. This documentation will be kept in the approved repository for DCPS.

3.2.1.6 Document Risk Register. The contractor shall determine risks associated with implementing requested changes. All risks shall be analyzed and assessed for risk and magnitude. Results shall be documented in the approved risk register. Mitigation strategies will be identified and applied to the maximum extent possible.

3.2.1.7 Hold the Functional Requirements Turnover Review Meeting. The contractor shall perform a review of requirements documentation with the customer and participate in Turnover Review meetings to present the review.

3.2.1.8 Document Issue Repository. The contractor shall document the functional turnover meeting in the approved repository, including date held, attendees, and disposition of the functional document.

3.2.1.9 Obtain Work Package Acceptance. The contractor shall ensure all issues and concerns identified during the functional turnover review are addressed and resolved. Issues, concerns, and resolutions shall be documented in the review system. SCRs shall be updated in accordance with current business processes. The contractor shall obtain all necessary approvals for the work package.

3.2.1.10 Update the Configuration Management System. The contractor shall ensure the functional analysis portion of the SCR is updated in the approved configuration management system in accordance with business processes. Functional requirements shall be written or attached in the configuration management system. The DFAS configuration management systems shall be utilized for SCR impacting and tracking.

3.2.1.11 Create Customer Documentation. The contractor shall create or maintain all documents defined within the business practice handbook necessary to allow proposed system changes to take place. Documentation should be informative, i.e. clear and complete, to the customer regarding upcoming system or process changes. Documentation should be Section 508 compliant as provided in 36 CFR part 1194.41 (Subpart D) Information, Documentation and Support and other government requirements.

3.2.1.12 Process DCPS Action Requirements. The contractor shall analyze and research DARs. Plans shall be developed to resolve issues identified in the DAR. Resolutions shall be documented in the appropriate tracking system in accordance with business practices. Resolution of DARs may require system changes, data calls, program development and/or other resolutions. All actions are documented in accordance with business practices and executed to resolve the DAR.

3.2.2 AUDIT SUPPORT

3.2.2.1 Attend Meetings. The contractor shall attend in-brief/out-brief meetings and subsequent follow-on meetings to identify needed items that must be produced for auditors. Items required by the auditor shall be documented.

3.2.2.2 Research and Produce Artifacts. The contractor shall produce requested artifacts from auditors and/or other approved organizations as determined by the System Manager or his designated representative. New reports or data files shall be generated and/or copies of existing reports or data files provided. Other information requested includes but not limited to SCRs, documents, standard operating procedures, manuals, policies and procedures; reports run from other AIS utilized by the project; security plans; and/or software screen shots shall be provided to the auditors.

3.2.2.3 Research Findings. The contractor shall research audit findings to identify a suggested response to audit findings. An analysis of findings shall be written pertaining to audit issues.

3.2.2.4 Implement Resolutions to Findings. The contractor shall assist with implementation of the results of the audit findings.

3.3 TECHNICAL DESIGN

3.3.1 TECHNICAL DESIGN SUPPORT

3.3.1.1 Develop Cost Estimates. The contractor shall develop a high-level rough order of magnitude (ROM) in accordance with documented procedures.

3.3.1.2 Review and Analyze Requirements. The contractor shall review submitted point papers, DARs, SCRs, email requests, or meeting action items. Written analysis of proposed changes shall be provided, to include affected system components and expected level of effort to make requested changes. All responses shall be coordinated with the customer.

3.3.1.3 Document Requirements Turnover Acceptance. The contractor shall meet with customers to review requirements documentation to ensure all requirements are complete.

3.3.1.4 Document Issue Repository. The contractor shall document the functional turnover meeting in the approved repository, including date held, attendees, and disposition of the technical document. The contractor shall ensure all issues and concerns about the technical analysis are resolved and all needed approvals are obtained.

3.3.1.5 Develop Schedule Estimate. The contractor shall perform a cogent, professional analysis of the requirement. Estimates of the time needed to complete the SCR shall be developed. Estimates shall be documented in accordance with the established DFAS and DCPS business processes maintained primarily within the DCPS project’s Business Process Handbook (BPH) or other project materials, subsequently known as “the aforementioned business processes.”

3.3.1.6 Develop the Design Document. The contractor shall design the technical portion of an SCR. The contractor shall provide a detailed analysis of a system change, ensuring the SCR encompasses all relevant details. DFAS Now shall be updated with all applicable and relevant documentation.

3.3.1.7 Hold Technical Peer Review. The contractor shall review and analyze design documents. The contractor shall present and/or participate in Peer Review meetings. DARs shall be reviewed for any deficiencies and corrective actions recommended to avoid repeating the problem.

3.3.1.8 Document Issue Repository. The contractor shall document the technical peer meeting in the approved repository, including date held, attendees, and disposition of the technical document.

3.3.1.9 Document Risk Register. The contractor shall determine risks associated with implementing requested change. The contractor shall analyze and assess risk magnitude and impact, documenting the results in the approved risk register. Mitigation strategies shall be identified to the maximum extent possible.

3.3.1.10 Hold the Critical Design Review Meeting. The contractor shall perform a review of design documentation with the customer, programmer, and testers. The contractor shall present and/or participate in Critical Design Review meetings.

3.3.1.11 Update Configuration Management. The contractor shall provide the technical analysis portion of the SCR and ensure it is updated in the approved configuration management system in accordance with business processes. Technical requirements shall be written or attached in the configuration management system. The contractor shall utilize the configuration management system for SCR impacting and tracking.

3.3.1.12 Create Customer Documentation. The contractor shall create or maintain all documents defined within the business practice handbook necessary to allow proposed system changes to take place. Documentation shall be informative, i.e. clear and complete, to the customer regarding upcoming system or process changes. Documentation shall be Section 508 compliant as provided in 36 CFR part 1194.41 (Subpart D) Information, Documentation and Support and other government requirements.

3.3.1.13 Process DCPS Action Requests. The contractor shall analyze and research DARs.