RFI Atch 1 - ESS Next PWS_DRAFT.pdf

Department of Defense (DoD)

Program Executive Office (PEO) - Defense Healthcare Management Systems (DHMS)

Enterprise Software Services (ESS) Next

Performance Work Statement (PWS)

Solicitation Number:

Contract Number:

Date:

Version:

DRAFT

1. Background The Program Executive Office – Defense Healthcare Management Systems (PEO DHMS) is a key Federal Health Information Technology (IT) partner and is responsible for delivering the single Electronic Health Record (EHR) and other technologies for the Department of Defense (DoD), Veterans Affairs (VA), and the United States Coast Guard (USCG). Sitting at the nexus of healthcare and defense, the PEO is in a unique position to make substantial national impact on the challenges facing both domains. National Defense, like healthcare, faces challenges in resources, capacity, and capability that can be addressed through innovative technology strategies.

To support this mission, PEO DHMS is pursuing a contracting strategy to field Enterprise Software Services (ESS) Next. ESS Next builds off of the incumbent ESS contract that provides a variety of pre-production environment, software, and physical support for products managed by DHMSM, JOMIS, and EIDS. In addition to transitioning and maintaining current services, ESS Next will improve their provisioning of services through automation, leveraging standards, and enhancing the existing offerings. The next generation will take advantage of the cloud and integrate with other Government offerings including DHA’s AWS cloud relationship.

In the short term, ESS Next will continue to provide only pre-production environments for Program Managers (PMs) under PEO DHMS to develop, test, and integrate new capabilities and services.

Capabilities/services developed under the ESS Next contract will be done in collaboration with and for PMs under PEO DHMS. However, the architecture being developed will be scalable and flexible.

This will allow for the addition of new enclaves for each DHMS PMO to potentially consume production workloads in the future if needed by the organization.

2. Purpose & Scope This is a non-personal services contract to provide for sustainment services of the Enterprise Services Software (ESS) and this PWS sets forth the responsibilities and commitments of the Contractor that will support the next generation of ESS or ESS Next.

The purpose of this acquisition is to provide users with the digital and physical capabilities needed to support the development, testing, and delivery of digital products and applications for the MHS Enterprise.

3. Desired Outcomes/Tasks/Objectives for ESS Next ESS Next will offer users access a standardized list of service offerings from which they can seamlessly self-provision various digital, virtual, and physical services and capabilities. For example, services available for provisioning include, but are not limited to, software services (managed tools/technologies used to execute development and testing), infrastructure services (compute, network, storage), physical space and support services (physical area to perform testing in the Medical Enterprise Test Innovation Center (METIC), technical and logistical support to conduct Operational Assessment (OA) events, virtual desktop services, and containerization services (serverless compute engine).

Specifically, the Contractor shall have responsibility for the performance of the following services in ESS Next:

1. Program Management

2. METIC

3. Data Center as a Service (DCaaS)

4. Infrastructure as a Service (IaaS)

5. Desktop as a Service (DaaS)

6. Platform as a Service (PaaS)

7. Software as a Service (SaaS)

8. Container as a Service (CaaS)

9. General Services (apply to all other Services)

10. Cyber Security and Policy Adherence (apply to all other Services)

Detailed descriptions and requirements for each of the services listed above are outlined in the subsequent sections.

3.1 Program Management

Program Management services ensure the coordinated delivery, communication, management, and monitoring of the Services delivered and described in this PWS.

PEO DHMS Engineering provides ESS managed services under a single program management office. The contractor shall assist PMOs and customers to ensure the requirements are collected and documented and appropriate services are provided to meet the requirements.

The contractor shall also assist with onboarding and navigating the ESS managed services and enterprise resources. As part of this, a single service deck should be provided to expedite issue resolution and perform problem management responsibilities. For non-standard requests from the PMOs, the ESS program management coordinates with PEO DHMS engineering for approval and provision of services.

The contractor shall provide development and maintenance of the detailed processes and guides, resourcing, and acquisition that are required for the delivery of the ESS services. The contractor shall also provide an automated capability to receive, track, and inventory equipment, devices, and test assets in the METIC (described in paragraph 3.2) and DHMS Data Center (DDC).

The contractor shall oversee and manage the licensing of software and hardware assets across METIC, cloud, and DDC environment. This includes developing and managing Service Level Agreements (SLAs) for all defined requirements, including tracking performance standards, Acceptable Quality Levels (AQLs), and methods of assessment is a core function of program management. Monitoring, reporting, and issues management are also included as part of the overall Program Management along with the prioritization of all work to perform at the required Service Levels in accordance with Government requirements. Communication shall occur at multiple levels with all required entities, leaders, and users through various vehicles from governance meetings to ad hoc reports.

Program Management represents, oversees, and manages all Services delivered by the Contractor and would be the last category to transition. The Contractor and Government shall participate in Monthly Program Reviews to monitor the relationship. The Contractor shall prepare the agenda, various reports and presentations, and generate meeting minutes in accordance with the Management Plan, CDRL AXXX, and the Monthly Program Reviews, CDRL AXXX.

The Monthly Program Reviews will include utilization metrics listed below:

1. % of available Compute utilized

2. % of available Memory utilized

3. % of available Storage utilized

4. % of available Network utilized

5. # active user accounts

6. # of METIC visit requests

7. METIC space utilization

8. # of licenses utilized for all software tools/technologies

9. # of software and hardware assets procured/provisioned

10. Cost usage reports in cloud

11. # of containers provisioned

12. New capabilities provided

Program Management is also responsible for fiscal oversight along with cost and risk reporting as described in CDRLs Functional Cost Hour Report AXXX, Cost Data Summary Report (CDSR) AXXX, Contractor Funds Status Report (CSFR) AXXX, Contractor Risk Management Plan (CRMP) AXXX, Risk Assessment Report AXXX, and Contract Work Breakdown Structure (CWBS) and CWBS Dictionary AXXX.

Contractor shall be responsible for obtaining staff, facilities, tools, hardware, software, and subcontractors to manage and perform the Services with all appropriate security clearances. The Contract shall also monitor and report on compliance of the delivery of all services and utilizing subcontractors that qualify as diversity or minority classifications.

The Contractor shall comply with all provided Government policies, standards, and regulations applicable to Government information, information systems, personnel, physical and Cyber security (Management Plan CDRL). The Contractor shall also develop and maintain technical documentation and an issues list (including documentation of the issues and potition of both parties) and facilitate and participate issue resolution. (Monthly Program Reviews CDRL

AXXX).

In the course of executing Program Management Roles and Responsibilities, the Contractor shall prepare materials for periodic government meetings, participate in issue resolution, provide policies and standards (when necessary), maintain strategy for the evolution of the Services and present improvement roadmaps at governance meetings, and oversee all services within the scope of the contract and propose operational improvement activities.

The Contractor shall actively participate in governance or program review meetings, support all government reviews and audits as required, provide reports to the government (as required), effectively manage costs reporting actual and forecast (CDRL AXXX, AXXX, AXXX), and collect and document user requirements and provide services to meet those requirements. The Contractor shall also develop, update, store, and maintain architecture documentation that describes the various “as a service” topology. In addition to these services, the contractor shall also provide an on-demand dashboard and/or reporting capability for software and hardware assets in on-prem and cloud environments.

3.2 The METIC

METIC is a shared Government approved laboratory (GAL) occupying 16,361 square feet with modern office accommodations, conference rooms, secure storage, and collaboration space. The facility also contains 7,700 square feet of open, reconfigurable lab space to accommodate concurrent events. The facility uses, on average, XXkW per month.

The METIC is accessible to the Military and Federal Health Communities as a fully managed facility. The facility contains large and reconfigurable test areas to meet specific test events, along with conference rooms and collaboration areas. It leverages the Test Infrastructure (TI) to provide network connectivity and access to numerous external data sources hosted by DoD, VA, and commercial entities. As part of the managed services, the METIC provides change and Configuration Control Management (CCM), Access Management, Cyber Security, Asset Management, System Administration, Test Equipment Calibration, and Service Desk support.

The Contractor shall fulfill all tenant requirements for the METIC, including assuming lease ownership for the facility, including all facilities management services such as trash services, water and sewer services, pest control, etc.

The METIC facility is a secure and shared resource in which the contractor provides operational management services, to include hosting for PEO DHMS applications and application services to the DHMS PMOs and the Defense Medical Health community at large. The METIC complements the Test Infrastructure (TI) and the DevSecOps platform by providing a modern, flexible, and user-agnostic test facility in the Washington, D.C. metropolitan area capable of supporting test events involving medical devices (examples included in Attachment XX) meant for deployment in fixed facilities such as hospitals, as well as operational medicine software meant to support theater operations.

The contractor shall provide maintenance and sustainment support of the physical space for the DHMS-owned GAL for Military and Federal health communities to use for software and hardware testing in operationally representative environments. The contractor shall provide a self-service mechanism for scheduling events in the METIC and document/distribute SOP for stakeholders on the process.

The ESS Next contractor shall be responsible for providing the following additional METIC service offerings:

• Provide support for specialized projects, including facilitating POCs for new tools/technologies with refresh requirements. Specialized projects include.

o Tech refresh: replacement of hardware devices (laptops, medical devices) o Major OS Upgrades (desktops and servers)

• Clinical equipment with refresh requirements: [add list]

• Maintain property book to track and receive all hardware and software assets in the

METIC and DDC.

• Provide application administration services in the METIC, including provisioning, backup, restoration, and user access management for applications.

• Provide a self-service mechanism for scheduling events in the METIC and document/distribute SOP for stakeholders on the process.

• Provide database administration services in the METIC, including provisioning, backup, restoration, and user access management for databases.

• Provide network capability to allow users to connect to .com and .mil in the METIC and

DDC and connect to Wi-Fi in METIC.

• Provide systems engineering support services as a core function of the METIC. These services include architectural and engineering expertise, designing enhanced solutions, and enabling automation to improve and scale current capabilities.

• Provide testing IT support to the DoD organizations, the Veterans Administration (VA), and other Government organizations requesting use of the METIC and DDC.

• Ensure that all entrance points and critical areas within the METIC and DDC facilities meet the security requirements outlined in the TIA-942 standard, including physical access control for server rooms and sensitive areas.

• Ensure that the METIC facility operates in compliance with industry and government standards, providing all necessary utilities, safety measures, and operational support for continued service.

• Ensure that management support services are in place to effectively coordinate and manage operations within the METIC, including resource allocation, event scheduling, and periodic communication with government stakeholders.

• Maintain the Authority to Operate (ATO) for TI.mil pre-prod environments and the site accreditation for the METIC & DDC data centers.

• Provide a loading dock and staging area to receive and track equipment shipments.

Ensure the capability to manage the acceptance, inventory tracking, and coordination of incoming shipments, with flexibility to handle outbound shipments on an as needed basis

• Provide sufficient office space, furniture, photo copier services, and ancillary equipment to accommodate PMO equipment and staff usage to accomplish work in the METIC.

• Provide dedicated separate space within the METIC to support the FF GAL (Fixed Facility Government Approved Lab).

• Provide dedicated separate space within the METIC to support SIPRNET access that is accredited to process and store classified SECRET information.

• Obtain necessary "facility clearance (FCL)" for a dedicated space within METIC to access or create classified information. This is required to support to configure/support SIPRNET network access that is accredited to process and store classified SECRET information.

• Monitor physical security of infrastructure in data center 24x7x365 in real-time using a building management system.

• Manage chip/devices catalog, remote management, and monitoring/alerting tools.

• Provide locker for storage of securable supplies (iPhones, CACs, iPads, etc.) in the Labs.

• Provide on-demand ability to ship equipment to/from the METIC Lab to external agencies supporting development or test activities via self-service ticketing process.

• Provide physical storage space for assets that are not in static configuration in the Lab, including spares or equipment as it waits for DRMO.

• Provide an on-demand intermediate, digital, secure storage for test evidence and files from applications in the Lab (or in cloud) so testers can upload to test tool at later date.

• Monitoring and tracking of facility access.

3.3 Data Center as a Service (DCaaS)

The Contractor shall fulfill all tenant requirements for the DDC, including assuming lease ownership for the facility. In this data center, the contractor hosts and maintains multiple network connections and provides access to multiple redundant internet service providers. The DDC provides power redundancy (N+1), and cooling redundancy (N+2) capabilities to ensure high availability of data center services.

The Contractor shall continue to provide operations and maintenance support to the DHMS-owned physical assets and necessary coordination with TI staff as required to fully provision and configure any TI virtualized capabilities and management software as appropriate within the shared responsibilities.

The contractor shall transition and migrate some of the services (IaaS, PaaS, CaaS, SaaS, and DaaS) to cloud as part of the target state vision for hybrid cloud operating model. As part of the transition and migration to cloud, the contractor shall develop self-provisioned automated cloud-enabled solutions and eventually reduce the footprint in the DDC data center to realize cost savings for PEO DHMS.

The TI is configured with production-like legacy environments to support development, testing, performance product integration and test activities. These environments are set up to mimic existing legacy Clinical Systems and interface with other healthcare systems across DoD, VA, and commercial partners. The test environments are hosted in two separate and distinctive enclaves, TI.COM and TI.MIL. The TI.COM enclave provides full development flexibility and access to the commercial internet. The TI.MIL enclave provides a production representative environment, complete with a Zone-B ATO accreditation and a native connection to DHA’s Medical Community of Interest (MedCOI) for inter-operability with joint DoD medical community communications and business partners through the Non-classified Internet Protocol Router Network (NIPRNet).

The below services are inherited from DHA and are supported as part of the DCaaS services, and the Contractor shall support these services in ESS Next:

• Active Directory

• SMTP Mail relay

• Network Time Protocol

• Load Balancing

• Network Address Translation (NAT)

• Port Access Translation

• Patch Repositories (RHEL/SuS)

• Backup (VTL/Tape Libraries)

The DDC currently possesses the below facility certifications, and the contractor shall be responsible for maintaining these certifications. Additionally, as the services are migrated to cloud, similar certifications should be obtained and managed in cloud environment as well:

• NIST 800-53/FISMA

• SOC 1 Type II

• PCI-DSS

• SOC 2 Type II

• ISO 27001

The ESS Next contractor shall be responsible for providing the following additional DCaaS offerings:

• Provide DCaaS support to all DHMS programs as well as other military health organizations as required. Allow users easy and timely remote access to servers, storage, and networking resources through a Wide Area Network (WAN) or similar communication structure.

• Ensure that virtualization services, including VDI and resource pools, are provided as part of the overall DaaS or IaaS offerings within the DDC.

• Support data center facilities, including installation and maintenance of UPS power, cooling, and rack services, as required and approved.

• Verify, manage, and track physical security for designated data centers.

3.4 Infrastructure as a Service (IaaS)

The contractor shall maintain a private cloud development and testing infrastructure to support the transition to MHS GENESIS and provide seamless interoperability testing between DoD, VA, and Government organizations. The Contractor shall also provide a virtualized environment that complies with DoD cyber security requirements. The below managed services are offered to DHMS PMOs and other stakeholders, and shall be continued to be offered by the contractor responsible for ESS Next:

• Deploy and maintain managed Test Infrastructure (TI). This includes provisioning of Virtual Machine (VM servers), Operating System (OS), and below (i.e., Compute, Memory, Storage, and Network). Dedicated compute, memory, and storage is allocated for a project, PMO, or group based on the requirements. The assigned resource pools are managed and used by the assigned Govt. owner under each PMO.

• The Virtual Machines OS options include:

o RedHat Enterprise Linux 7 / 8 o Windows 2012 R1 / R2 o Windows 2016 R1 o Windows 2019

• Provision and manage database instances, including MS SQL DB, Oracle DB, and Oracle

RAC.

• Provide support for internal data connection management, including Private IP space, VLANs, ACLs, and DMZ.

• Within IaaS, the current Contractor provides hardware/software virtualization management for VMs, memory management, and storage management network management, service desk management and cybersecurity services in hosting DoD legacy healthcare systems, and technical solutions for PEO DHMS partners and stakeholders.

The managed provider ensures service is available at the Operating System (OS) level and below, (virtualization, resource pools). PEO DHMS performs monitoring, operations and maintenance, and support services for the TI.

The ESS Next contractor shall be responsible for providing the following additional IaaS

• Provide Infrastructure as a Service (IaaS) support to all DHMS programs as well as other military health organizations as required.

• Create POC/playbook to prepare for implementation of hybrid model for IaaS services

(leveraging on-prem “private cloud” and “public cloud”) via automation Infrastructure as a Code (IaC).

• Develop and enable a self-service provisioning portal (via IaC) with standardized infrastructure offerings (i.e., servers, storage, and network resources) accessible via service catalog.

• Provide .mil, .com, and Med-COI network access and connectivity to test enclaves and external connections.

• Provide a hybrid model for IaaS services by leveraging on-prem “private cloud” and “public cloud” services via automation (IaC).

• Provide IT and hardware configuration support for setting up and connecting equipment to the network in the Lab when needed.

3.5 Desktop as a Service (DaaS)

The contractor shall provide DaaS in a private cloud hosted offering in which hosts and manages the back end of a virtual desktop infrastructure (VDI) deployment. With DaaS, desktop operating systems (OSes) run inside virtual machines on servers in the DHMS Data Center (DDC). All the necessary support infrastructure, including storage and network resources, also lives in the DDC.

The contractor shall stream virtual desktops over a security certified network, where end users can access these virtual desktops, and the apps loaded into them through client software or a web browser.

The contractor shall manage the Virtual Desktop Images (VDI image). The supported version is Windows 10 and supports multiple desktop applications inherited from DHA approved image.

Dedicated VDI pools are built and managed to host VDIs.

The ESS Next contractor shall be responsible for providing the following additional DaaS

• Provide Desktop as a Service (DaaS) support to all DHMS programs as well as other

• Maintain and track desktop licensing for VDIs.

• Provide and maintain network access to VDI, AVHE, NIPRNET, MedCOI, and external partner connections as PMOs would need B2B for partner test environments.

• Provide capability to remotely connect Virtual Desktop Infrastructure (VDI) to DHA network within the Lab to remove the need for AVHE and reduce latency.

• Provide remote Virtual Desktop Infrastructure (VDI) for PMOs to test applications within the METIC (including Fixed Facility Government Approved Lab or FFGAL), connected to DoD network enclaves (e.g., MED-COI, NIPRNET, SIPRNET).

• Support DHA imaging, security updates, and patching on the infrastructure and laptops in METIC, DDC data centers, and in cloud.

3.6 Platform as a Service (PaaS)

The contractor shall maintain the current DevSecOps PaaS, providing teams the ability to produce, build, secure, and test code and applications. Samples of templated pipelines are provisioned for the developers to use and customize to perform their tasks for their deployment needs. The current platform management suite provides a suite of tools to produce managed services.

For ESS Next, the contractor shall enhance the current DevSecOps platform to include standardized toolset and enable a Continuous Integration / Continuous Delivery (CI/CD) pipeline solution that produces containerized and non-containerized products ready for installation on a laptop/local system or directly deployed to a production environment in both .COM and .MIL enclaves.

The PaaS platform shall serve users with CI/CD pipelines through which developers can rapidly build and deploy Kubernetes-managed containerized applications, as well as legacy applications in an Agile development framework wholly integrated with DoD STIG requirements to ensure data confidentiality, integrity, and availability. The contractor managed PaaS platform should facilitate the breakdown of stovepipes to enable the user community to access a common set of tools and services.

The PaaS offering shall also support the PEO DHMS capabilities: 1) implementing Agile software development across the enterprise; 2) allowing contractors to develop rather than manage infrastructure and software tool platforms; and 3) leading Defense Health in the adoption of the DoD DevSecOps initiative to accelerate capability delivery to the warfighters.

The ESS Next contractor shall be responsible for providing the following additional PaaS

• Provide PaaS support to all DHMS programs as well as other military health organizations as required.

• Develop a “platform management suite” with standardized suite of tools (tools are standardized via governance process) to provide an avenue to product managed services.

• Develop and provide a centralized platform (via PaaS) to enable standardized DevSecOps framework, standardized processes, associated standardized tooling, and templatized CI/CD pipelines to automate development and testing in the cloud.

• Develop industry standard set of tools/technologies at the core of PaaS offering for version control, issue tracking, security tracking, and centralized log analysis.

• Provide fully managed tools (standardized, packaged, license controlled, and automated tools) to allow stakeholders to conduct development, integration, testing, and other automated tasks.

3.7 Software as a Service (SaaS)

The contractor shall provision packaged (pre-installed/configured) software solutions for use by DHMS users. These software solutions provide users individual software tools to use a la carte that are decoupled from a PaaS solution. For example, the PaaS solution provides access to Jira in the CI/CD pipeline tool set that users may need access to without the other tools provided by the PaaS. The current SaaS offerings provided by the current Contractor leverage the IaaS and PaaS solutions and the advantages those provide, extending the capabilities of the ESS project and better serving the PEO and the PMOs.

The current SaaS offerings provide sustainment, maintenance, and support of the existing DHMS Testing Infrastructure (TI), along with the Armed Forces Health Longitudinal Technology Application (AHLTA) legacy software applications. These SaaS offerings provide continuous maintenance, and sustainment of an enterprise software development environment aligned with the DoD Enterprise DevSecOps Reference Design. The contractor shall provide SaaS offerings which ensure users have ready access to the software tools they need to perform development and testing tasks.

Additionally, the standardized SaaS service shall provide fully managed tools for the PMOs (end-users) to consume these tools to conduct development, integration, and testing activities.

The ESS Next contractor shall work with PEO DHMS Engineering to own and take responsibility for software licensing, maintenance, and security. This allows the PMO users (end-users) to focus on development, integration, and testing.

SaaS offerings shall include, but not be limited to:

• AHLTA (Armed Forces Health Longitudinal Technology Application – A legacy application)

• Jira Software

• Zephyr for Jira

• Git Integration for Jira

• Confluence

• ACAS (security scanning tool)

• Fortify

• GitHub

The ESS Next contractor shall provide the following additional SaaS offerings:

• Provide Software as a Service (SaaS) support to all DHMS programs as well as other

• Enable self-service portal for DHMS customers to access and utilize SaaS Offerings via automated service catalog products (incl. any plug-ins) and enable the capability to track and monitor licenses for the SaaS offerings.

• Support PEO DHMS with research, identification, and procurement of SaaS candidates / tools.

• Enable SaaS capability (via Resource Validation Documentation Checklist (RVDC) process) to allow users timely access to licensed software products.

3.8 Container as a Service (CaaS)

The contractor shall provide containers and package CI/CD pipelines developed under PaaS service and offer as a service for consumption by the PMOs.

The ESS Next contractor shall be responsible for providing the following additional CaaS

• Provide CaaS support to all DHMS programs as well as other military health organizations as required.

• Develop, manage, and support “serverless computing” by providing scalable containers to allow developers to rapidly deploy applications.

• Support and manage requirement analysis for pre-production environments to host Kubernetes Platform for container services in both .COM and .MIL enclaves.

• Offering tools for scaling, orchestration, and managing containers to enhance the software delivery process for the PMOs.

• Providing standardized container management platform bridging the gap between development and operations teams by providing a shared platform for deploying, managing, and scaling applications across .COM and .MIL environments

• Standardized CaaS platform to manage automated containers' deployment, scaling, and management using a container orchestration tool such as Kubernetes.

• The containers should be built up from an immutable image. These containers should allow the developers and testers to use the same image that gets deployed to production.

These containers should be made as a standard unit for software deployment for all PMO systems to attain consistent configuration and deployment process across all environments.

3.9 General Services (applicable to all other Services)

The following General Services shall be provided by the ESS Next Contractor:

Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

Ethics: The Contractor shall conform to standards of conduct and codes of ethics, which are consistent with those applicable to Government employees as provided in the Joint Ethics Regulation 5500.07.R.

The Contractor will provide services to order, set-up, and operate the pre-production environments. Hardware, software, and the facilities will be provided and made accessible by the Government. Other general requirements the Contractor will be responsible for include:

• Conduct gap analysis to determine how to implement access to secret network/vault for DHMS and DoD health programs conducting high side testing using Secure Internet Protocol Router Network (SIPRNet).

• Provide access to secret network/vault for DHMS and DoD health programs conducting high side testing using SIPRNet in secure facilities.

• Ensure and maintain connections between the DDC and key data centers, including, but not limited to, the Defense Manpower Data Center (DMDC), to facilitate necessary data exchanges between MHS GENESIS, DoD manpower activities, and other critical data sources.

• Establish and maintain effective helpdesk processes to ensure timely support and resolution of user issues.

• Host, support, and provide ease of use automated managed software for any/all tools/technologies through an automated self-service portal.

• Install and set up performance testing tools, as requested by system/application owners for capacity planning.

• Maintain current Virtualized or DHA standard upgrades as required by the Government to operate GFE/CFE within the network systems of DoD.

• Manage and maintain a domain controller to authenticate and authorize users' access to the network.

• Manage and provide access to appropriate 'as a service' offerings for authorized users.

Users include, but are not limited to, DMIX, JOMIS, DHMSM, EIDS, and other outside agencies (FEHRM, VA, TATRAC, DHA FRCS, etc.), with access managed according to the specific needs of each entity.

• Perform ongoing optimization, improvement, upgrades, administration, and operation of networks and systems to support DCaaS, CaaS, DaaS, IaaS (e.g., VMWare resource pools, storage), PaaS, and SaaS capabilities.

• Provide backup and restoration of servers to mitigate risk of hardware failure or data loss enabling back-out of failed updates or upgrades. Backups shall be taken before each test evolution backup at a minimum daily.

• Provide data migration services for data hosted in various tools and infrastructure in METIC, DDC, TI.com, TI.mil, & cloud to the enterprise shared services tools (i.e., SDLC tool data).

• Provide NIPRNet network capability with clear demarcation pertaining to ownership of equipment, services, and maintenance.

• Provide ongoing support for creating, configuring, and tearing down systems (servers, networks, and storage) as required for testing activities within the testing environment.

• Provide operational support and optimize DoD Network enclaves' (e.g., Med-COI, NIPRNet) network connection for Garrison and .mil for DHMS program capabilities such as OpMed.

• Provide technical support services to advise and assist registered users with issues concerning their technical products between the hours of 8:30am to 4:30pm (ET) M-F over the phone or via other means of communication. Additionally, provide support through a ticketing system online (available 24/7) with a response during normal business hours.

• Sustain infrastructure through configuration management, cyber security, and maintenance of the following storage devices including network attached storage, controller-based storage, and storage area network surveillance.

• Partner with the PEO DHMS CM team to review and manage Change Requests submitted to the PEO CCB (our understanding the CCB only applies to prod environments).

3.10 Cybersecurity and Policy Adherence (apply to all other Services) All Services must be developed and performed in accordance with the Government’s Cyber Security Policies along with all other Government Standards. Appendix A-2: Government Policies and Standards provides a list for reference.

All information security (IS) Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic Government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report, a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of Contracting Office (KO) request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

3.1 Cybersecurity

The Contractor shall:

a) Implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF). Configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

b) Ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

c) Comply with the Joint Force Head Quarters – Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

d) Implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity architectures, cyber survivability, cyber resiliency, zero trust, ICAM and risk governance objectives.

e) Establish appropriate administrative, technical, and physical safeguards to protect all Government data, to ensure the confidentiality, integrity, and availability of Government data in accordance with the requirements specified.

f) Comply with DoD training requirements in Department of Defense Directive (DoDD)

8140.01 and DoD 8570.01-M. Contractors shall identify, document, track, and report qualifications of contract support personnel who perform cyberspace work roles.

g) Implement Zero Trust Architecture (ZTA) and deliver on Zero Trust pillars and capabilities to the Government to meet DoD Zero Trust Strategy and Roadmap (Nov 7, 2022), Zero Trust Overlays (June 4, 2024), and DoD ZT Reference Architecture (Version 2.0 July 2022) guidance.

h) Implement Identity, Credential and Access Management (ICAM) capabilities to support Zero Trust Architecture for the Government that meets OPM Memo M-19-17 and DoD Enterprise ICAM Reference Design (Version 1.0 June 2020) guidance.

i) Ensure that personnel accessing IS have the proper and current IA certification to perform IA functions at contract award in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-2001, including:

i. DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

ii. Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

i. Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

ii. Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

j) Provide a DoDM 8140.03 and DoD 8570.01 Compliance Report (CDRL A025) including:

i. A list of cybersecurity functional responsibilities for Contractor personnel, by category (e.g., technical or management) and level (e.g., computing environment, network environment, or enclave)

ii. The cybersecurity training, Joint Interoperability certification, Joint Interoperability certification maintenance, and continuing education or sustainment training required for the Contractor cybersecurity functional responsibilities

iii. A matrix documenting and tracking Joint Interoperability certification status of Contractor cybersecurity personnel, updated as Joint Interoperability certifications change or expire and personnel are added or removed

k) All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

3.1.1 Assessment and Authorization (A&A)

The Contractor shall:

a) Support the ESS Next Assessment and Authorization (A&A) activities to include development of artifacts for the Security Authorization Package (CDRL A021).

b) Comply with all applicable cybersecurity standards and directives outlined in:

i. The Defense Information Systems Agency (DISA) Information Assurance

Support Environment (IASE) site: https://public.cyber.mil/

ii. The NIST references and security guidance found at NIST's Computer Security

Resource Center site: http://csrc.nist.gov/

iii. The USCYBERCOM orders and directives found at:

https://www.cybercom.mil/J3/orders/default.aspx

c) Mitigate all security risks and vulnerabilities found during C&A and continuous monitoring activities in accordance with the DoDI 8510.01.

3.1.2 Security Incident Management

a) When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the contractor shall: Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts.

This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other IS on the contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the contractor’s ability to provide operationally critical support.

b) In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a CUI-Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

c) Provide an Incident Management Plan (CDRL A016), including an Information Operations Condition (INFOCON), to meet the requirements in accordance with the Chairman of the Joint Chiefs of Staff Manual (CJCSM-6510.01B).

d) Execute the activities identified in the Incident Management Plan (CDRL A015) in the event of a cyber-incident.

e) Analyze incidents and report results in a Technical Report (CDRL A024) to the Government-assigned Computer Network Defense Service Provider (CNDSP) and

DHMSM PMO.

f) Support any actions deemed necessary by CNDSP Tier 1 and Tier 2 in accordance with DoDD 8530.1.

3.1.3 Cybersecurity Vulnerability Management (CVM)

a) Manage and deliver a Technical Report (CDRL A024) documenting ESS Next compliance with the CVM program in accordance with the PEO Cybersecurity Strategy.

b) Manage and deliver a Cybersecurity Vulnerability Management Plan (CDRL A027) documenting the Contractors processes, approach, plans, and methodology applicable to all Cybersecurity Vulnerabilities published by the DoD and United States Cyber Command (USCC).

3.1.4 Maintain Situational Awareness/Continuous Monitoring

A cybersecurity vulnerability is any flaw or weakness that could be exploited to gain unauthorized access to, damage, or otherwise affect ESS Next.

a) Configure solutions to allow Endpoint protection, allow unattended credentialed scans, and allow patching without contractor intervention.

b) Comply with DoD Instruction 8582.01, “Security of Non-DoD Information Systems

Processing Unclassified Non-Public DoD Information.

i. Devices and systems must be configured in such a way that allows the updating of malware definition signatures on a scheduled basis.

ii. Scanning shall encompass the entire system (file system, operating system, and real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the contractor shall provide a detailed list of exclusions with justifications.

iii. The contractor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. Data Loss Prevention, Intrusion Prevention System, Antivirus, etc.) without performance degradation of the contractor device or system.

iv. In cases where the operation of security applications is not technically achievable, the contractor shall provide detailed justification and a POA&M describing steps towards mitigations or compliance with this requirement.

c) Be able to duplicate all fielded equipment/product that falls under the authorization boundary. The contractor shall maintain the system or device in an operational condition with the latest security patches installed.

d) Ensure that all fielded equipment/product falling under one authorization is tested to maintain the ATO or approved. For each version owned by DHA and originally purchased through the contractor’s contract, the contractor will ensure that each component within the authorization boundary is represented in the test/laboratory group.

e) Maintain continually monitor the authorized security configuration and notify the Government within forty-eight (48) hours of any new vulnerabilities discovered either in the laboratory or production environments.

f) Test all Information Assurance Vulnerability Alerts (IAVAs), patches, updates, and upgrades in the test/laboratory environment across all non-production environments. All non-production environment IAVAs, patches, updates, and upgrades will be approved by the PEO DHMS Change Control Board prior to contractor implementation. Approved changes shall be implemented quarterly.

g) Ensure the contractor’s device or system is in compliance with the DoD Information Assurance Vulnerability Management (IAVM) program upon each additional deployment.

h) Monitor the public DoD Cyber Exchange website for new or updated STIGs. The contractor shall implement updated STIG compliance for systems or devices within three

(3) months of their availability on the DoD Cyber Exchange.

i) Reassess major upgrades such as major software or hardware revision for ATO or addition to the APL. Minor upgrades must be assessed by the Government to determine if a reauthorization is required. The contractor shall support reauthorizations due to both major and minor upgrades.

j) Update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system or device.

k) Ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

3.1.5 Annual Review Support

Once the Designated Approval Authority (DAA)/Approving Official (AO) has accredited the system, the Contractor shall:

a) Support ESS Next annual reviews activities as defined in the references found on the

IASE site.

i. Annual reviews shall be completed prior to one (1) year from the date of the last signature on the approved Security Authorization Package (CDRL A021)

ii. Annual reviews shall include updates to the artifacts for the Security

Authorization Package (CDRL A021) as required.

3.1.6 Risk Assessments/Security Impact Assessments

a) Provide expertise to monitor the risk posture of ESS Next throughout the contract.

b) Assess cybersecurity risks following an incident or identification of vulnerabilities that may impact the cybersecurity posture of the system.

c) Document findings in a Cybersecurity Risk Assessment Report (Technical Report CDRL

A024)

d) Submit all RMF-required documentation for review and approval per the Assessment

Timeline

e) Obtain approval from the Government for any contractor developed RMF policies, plans, and procedures, prior to implementation.

f) Provide any additional documentation required by the Government for completion of the assessment process to the Government.

g) Provide technical scans per the Assessment Timeline

3.1.7 Cybersecurity Compliance Validation

The Government will approve the cybersecurity baseline for ESS Next and the standard tools that will be used for the cybersecurity efforts. The DoD is in the process of transitioning from the DoD Risk Management Framework (RMF) NIST 800-53 Rev 4 to RMF NIST 800-53 Rev 5 with future transition to continuous Authority to Operate (cATO) for IT assessment process.

The Contractor shall:

a) Utilize the DoD RMF for IT processes unless directed by the Government to utilize DIACAP processes. DIACAP processes and documentation may be required for certain individual MTFs which have not yet transitioned to the DoD RMF for IT

b) Provide cybersecurity artifacts that demonstrate ESS Next compliance with the DoD cybersecurity requirements, as defined in the Security Authorization Package (CDRL A021)

c) Scan the environments and system components using a Government approved tool set or provide a POA&M describing how they will work to close the vulnerability with clear milestones within the expected timeframe to meet AO guidance.

d) Conduct regular security scans and submit a Technical Report (CDRL A024).

i. Close all discovered vulnerabilities no later than one (1) month of discovery.

Critical findings (Very High and High) must be remediated within 21 days of discovery.

ii. Plan of Action and Milestones (POA&M) will need to be submitted for vulnerabilities that cannot be closed within one (1) month of discovery and identify all vulnerabilities and proposed mitigations within acceptable timeframes.

POAMs for Critical findings (Very High and High) should be submitted for vulnerabilities within 21 days of discovery.

iii. Metrics and Analysis reports should be delivered to Government as needed.

iv. Submit to the Government for approval, all mitigation plans that address any open vulnerabilities.

v. All vulnerabilities must be mitigated in accordance with DoDI 8510.01 based on

Category level.

e) Support Independent Government scan(s) of ESS Next and environments, review the

Government findings summary reports, provide analysis and metrics regarding the variances, and rectify any variances as appropriate in future scans.

f) Participate in cybersecurity Interim Program Reviews (IPRs)

i. Review the vulnerability…