DRAFT_PWS_MESU_3.8.19-rev.docx

PERFORMANCE WORK STATEMENT (PWS)

as of 3/8/2019

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DoDAAC):

Address:

Phone Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

DoDAAC:

Address:

Phone Number:

E-Mail Address:

2. Contract Title. Defense Information Systems Agency (DISA) Department of Defense (DoD) Mobile Enterprise Services – Unclassified (MES-U)

3. Background. DISA’s Mobility Program Management Office (PMO) represents the DoD enterprise services for unclassified mobility capabilities. Defense Mobility Unclassified Capability (DMUC) is the DoD mobility enterprise service offering that enables commercial solutions for approved, unclassified, customer owned, mobile devices access to the unclassified DoD Information Network (DoDIN) and commercial information services. MES-U is comprised of an Enterprise Mobility Management (EMM) suite, network gateways, Tier III service support, commercial mobile devices (unclassified voice and data services), and an identity management system.

Below is a high-level description of the current DMUC capabilities:

0. Mobile Device Management (MDM)

0. Supporting DEE and non-DEE customers

0. Supporting DMUC approved devices

0. Mobile Application Store (MAS)

1. DoD Apps

1. Personal Use Mobile Apps (PUMA)

0. Mobility Information Assurance

2. Mobile Endpoint Protection (MEP)

0. Mobile Devices and Operating System (OS)

3. NIAP certified, FIPS 140-2 validated, STIG complied mobile devices

3. iOS, Android, macOS, Windows

0. DISA Enterprise Services

4. Defense Enterprise Email (DEE)

4. DoD Component Email domains

4. User Conferencing including Voice over Internet Protocol (VoIP), Chatting and Video conferencing

0. Mobile Content Management (MCM)

5. SharePoint

5. Software as a Service (SaaS)

5. Other emerging enterprise storage solutions (Defense Enterprise Office Solutions (DEOS), milDrive, Storage as a Service (STaaS))

0. Public Key Infrastructure (PKI)/Public Key Enablement (PKE) is associated with PKI enablement efforts including:

6. Purebred over-the-air (OTA) certificate credentialing capability to enable DoD personnel to use DoD PKI credentials on mobile devices.

6. Trusted Platform Module (TPM)/derived credential enablement

6. Next generation behavioral/Artificial Intelligence (AI) identity management

6. Additional mobility related PKE initiatives

0. Mobility Gateways

7. Mobile devices are allowed to securely access Department of Defense Information Network (DODIN) via Virtual Private Network (VPN) infrastructure

0. Mobile Apps Network Operation Center (NOC)/Network Operations (NetOps)

8. Mobile Application Vetting

8. DMUC Customer Tier-1 Portal

8. Mobility interfaces, where operational status of the MDM/MAS and mobile device, are shared with the DISA-owned network operation center and NetOps infrastructure.

8. The NetOps/NOC is contractor owned, subscription based with the Mobility PMO procuring a yearly subscription.

0. DISA Storefront (Business System) and an automated tool for merging data with MDM

0. Health and Monitoring system

0. Event Management Systems

0. Ticketing system that tracks and generates helpdesk trouble tickets

12. Because the Mobility PMO is engaged in the helpdesk operation, interfacing the current DISA ticketing system is necessary

4. Objectives: Provide continuing support to the DMUC, which includes the sustainment of current capabilities and integration of new capabilities across the unclassified mobile platforms. Specifically, provide unclassified system and interface integration, engineering, testing, and Tier III support for the DoD enterprise mobility solutions. Engineering activities also include impact assessment to deployment of resultant new equipment and/or software for addressing new and/or updated commercial solutions supporting the DoD MES-U capabilities.

5. Scope. The scope of this requirement is to support current and future Mobility capabilities to enhance DISA’s ability to provide unclassified mobile communication services to the entire DoD. This requirement includes: system engineering, integration, and testing. The effort also includes engineering requirements to allow DMUC capabilities to interface with other sub-systems and partner networks identified in this PWS as well as future design integrations.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of this work effort and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract may not exceed 45% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

The scope includes upgrades to systems as a result of technology evolution, industry standard changes and DoD regulatory requirements.

The Contractor shall provide the necessary support as outlined in section 6 Performance Requirements.

6. Performance Requirements. All task areas apply to the full performance period of this requirement. There may be multiple vendors supporting the Mobility PMO providing other capabilities not included in this effort. The contractor awarded this work shall engage with other contractors supporting the Mobility PMO, as required, to accomplish Government requirements, goals, and objectives as efficiently and effectively as possible. In addition, the Contractor shall become familiar with the DISA ECOSYSTEM, the ECOSYSTEM Line of Business (LOB) model, and acquiring service support from the DISA support facilities.

The Contractor shall conduct these activities in accordance with DISA’s processes and as part of an integrated team with the Government and other Contractors. The Contractor shall review, evaluate and leverage existing COTS and Government solutions where possible to provide the best value. The Government shall retain ownership and title to all materials provided to the Contractor for use in connection with performing the services under this contract. The Government’s licensing rights in all deliverables, including custom code, developed and/or delivered under this contract shall be in accordance with the DFARS clauses.

The contractor’s solution shall comply with appropriate DoD-approved architectures, programs, standards and guidelines, such as Defense Information Infrastructure (DII), Security Technical Implementation Guidance (STIG), DII Common Operating Environment (COE), DoDIN, and Shared Data Environment (SHADE).

6.1 Program Support. (FFP) The contractor shall provide management controls and support for organizational resources to meet the cost, performance, and schedule requirements during contract execution. The Contractor’s work shall meet or exceed performance and schedule requirements throughout contract execution. The Contractor shall identify, prevent, and ensure non-recurrence of defective and inadequate service. The Contractor shall also recommend solutions to new requirements and existing needs using best practices, processes, services, technologies, or business models that are readily available.

6.1.1 Contract Management. The Contractor shall provide effective and efficient program management in managing the technical and functional activities within this PWS. The contractor shall provide a management plan outlining activities to be performed in support of this contract. The contractor shall include the following in the management plan: program planning, financial reporting, quality assurance, quality control, strategic and operational planning, progress/status reporting, and program reviews.

A Kick-off meeting shall be conducted no later than 10 working days after the contract award. This meeting will be between the Government and the contractor and will be the venue to facilitate a successful execution of this contract, including transition activities. The Kick-off meeting agenda shall include the following:

· Common understanding of contract

· Common understanding of technical direction

· Presentation of all contract deliverables to include proposed formats and reporting methods

· Transition Plan of the current activities supporting DMUC capabilities

· Other relevant items may be introduced at the discretion of the contractor and/or the Government.

The Contractor shall prepare a Task Order Management Plan (TOMP) describing the technical approach, organizational resources and management controls to be employed to meet the performance and schedule requirements throughout contract execution. The TOMP, at a minimum, should address or include the following: organization, resources, personnel management, management structure/control (by name), execution plan, labor execution plan, quality assurance/control plan, contract management plan, implementation plan, risk management and subject matter expert (SME) support. The TOMP shall be updated throughout the performance of this task to reflect changes and to further define program criteria and milestones. All modifications to the TOMP shall be submitted to the Government for approval prior to execution. In addition, the TOMP shall detail the coordinated interaction between system development and integration activities as well as the maintenance and security compliance of existing and developing capabilities.

As part of the TOMP, the Contractor shall establish a comprehensive risk management process that includes risks identification, evaluation, and mitigation of risks associated with cost, schedule, technical, and performance of this effort. Additionally, the team shall develop a risk matrix to track project risks (such as schedule, cost, program, and engineering) that may be revealed during the project and will decide upon initial action and communication plans that will help ensure successful issue resolution and project execution. The risk matrix will be maintained and delivered to the Government as part of the monthly status report (MSR) update. The contractor shall tailor their risk assessments in according with the Department of Defense Risk, Issue, and Opportunity Management Guide for Defense Acquisition Program where applicable. The guide can be found at: http://www.acq.osd.mil/se/pg/guidance.html. The contractor shall communicate to the Government immediately when risks/issues arise that impact critical path items.

The TOMP shall also include a Transition Implementation Plan (TIP), outlining activities and timeline required for the contractor to transition support services identified in this PWS to a new contractor as required. The Contractor shall support concurrent network operations services and receive all mobility operational support services from the incumbent Contractor. This shall include, but is not limited to, the following areas of responsibilities:

· Government Furnished Information (GFI), (i.e., all Configuration Items), source code, system architectures, system access controls, and other program artifacts

· Information Assurance (IA) (Configuration management support (current status and processes)

· IA support

· MDM support

· Implementation management support (to include history and current status)

· System performance analysis

· VPN

· System and network engineering

· System deployment and integration support

· Incident detection, handling and reporting

· Asset management responsibilities (to include transitioning active maintenance/support plans and licenses), transition all administration and user accounts

· Government Furnished Equipment (GFE) which may include relocating all Government owned property at Contractor facilities

· System monitoring requirements in order to facilitate a seamless transition and assure minimum service disruption of the current on-site administration support, Service Desk Tier I and Tier II responsibilities and Program Office Tier III responsibilities

· License and certificate expiration tracking

The Contractor shall have complete information for the on-site operations and shall have full access and knowledge to all required systems to administer the mobility system. This includes the DISA Global Trouble Management System (GTMS) for effectively managing the EMM suite. The Contractor shall ensure an official handoff of all supporting privileged user accounts to the system and disable all accounts used by the predecessor Contractor. The Contractor will create a transition checklist of required information, documentation and system access. This checklist will be used to facilitate the transitions between the Contractor and the incumbent Contractors.

All operational support requirements to be transitioned include, but are not limited to the following:

· Roles and Responsibilities in any Government managed forum currently supported by the Incumbents

· “Left seat – right seat” functional/knowledge transition from Incumbents so to minimize impact to the program

· Coordination processes and requirements with DISA Global Operations Command and Watch Officer

· System maintenance and administration requirements

· Configuration Control Board (CCB) processes

· Network management support, trouble analysis procedures, network and system monitoring and administration/coordination

· Asset (hardware and software) maintenance and licensing tracking and support

· Circuit configuration advisement

· General administrative tasks as they pertain to personnel access and clearances for Government facilities

The Contractor shall provide all mandatory Government Standard Operating Procedures (SOPs) and Concept of Operations (CONOPS), which include, but are not limited to the following:

· Mobility Operations and Maintenance Manual

· Authorized Service Interruption (ASI) SOP 100-55-08

· Operations and Maintenance (O&M) Convergence Network Operations C2 CONOPS

· SOP for DISA GTMS Ticket Opening/Updating/Closing 13-GSM-SOP-OPS-0021-04, Version 04, as they apply to Network Operations Concepts and Network Management policy/procedures governed at the DISA and DoD Enterprise Level

· Transition support shall also include all real time monitoring and management requirements of DISA Services for operational awareness and Cyber Defense.

The Contractor will support weekly meetings during the transition period to ensure a smooth transition of operational support services. The Government will facilitate the execution of the TIP to ensure continuity of all current activities supported by the Incumbent contractor. The Contractor shall also minimize service disruption and service degradation during and after a transition period from the incumbent Contractor.

The Contractor shall update the TIP to support the transition to a follow-on team as specified by the Government.

(2) Risk Matrix

(3) Kick-off meeting

6.1.2 Work Breakdown Structure (WBS). The Contractor shall analyze and decompose the scope in this PWS and provide a WBS and corresponding WBS Dictionary. The WBS shall be the structure for communication for this contract and be the common link that unifies the planning, scheduling, cost estimating, budgeting, contracting and performance reporting. The WBS shall provide clear traceability of work efforts and end products. The WBS shall be no less than three levels and its baseline shall be established at an Integrated Baseline Review (IBR) conducted within 30 calendar days of contract award.

6.1.3 Integrated Master Schedule (IMS). The contractor shall provide the Government Program Manager (PM) or designee with an event driven IMS. The Contractor shall use Microsoft Project or other software designated by the Government for developing and maintaining the schedule. The contractor shall review, and identify any dependencies or interrelationships between the contract and other program efforts and significant dates. The Contractor shall prepare and maintain a WBS) and an IMS for the overall contract to include schedules for each subtask and the level of effort (LOE) for task completion. The WBS and IMS shall address dependencies, risks, key milestone events, critical path activities, and delivery dates. The schedule will also outline all resources assigned to individual tasks and the LOE for each task’s completion. The Contractor shall coordinate with the appropriate Government Functional Leads and assess the risks identified in the schedule and recommendation for program resolution. The WBS and schedules shall be developed and base-lined in collaboration with the Government schedule team.

The baselined schedule shall not be modified without the Government’s approval. The schedule shall be coupled with weekly management control meetings to ensure all organizations and activities underway are coordinated and support the objectives of the overall program. The Contractor shall submit an updated IMS to the Government PM on a weekly basis.

6.1.4 Program Reporting. The Contractor shall submit MSR that includes financial, performance, and schedule status including proposed changes and deviation from the planned schedule, technical accomplishments, issues and risks, program metrics, and planned activities for the next reporting period. Any issues requiring Government response or action shall be identified to the Government immediately, and status captured in the monthly reports.

The initial MSR shall include the deliverables planned by month, group by work categories (e.g. systems engineering, integration, Tier III, A&A, etc.) for the period of performance. In each subsequent report, the Contractor shall show planned projections by month, the actual work performed (deliverable) by month to date, and an updated projection of the remaining deliveries across the period of performance. The Contractor shall identify any differences from the previous projection for the period the report covers and explain how that difference affects the projection for work yet to be accomplished.

In addition, the Contractor shall identify key and other personnel providing support on this contract as part of the MSR. The Contractor shall include a “roles and responsibilities” matrix for all staff members, security clearance, and identify all dedicated full time and part time equivalents to ensure adequate coverage and proper workload distribution.

The Contractor shall provide a weekly status report outlining the progress of current and future tasks with completion status, as well as identifying any issues and risks, dependencies, engineering updates that require Government interaction for resolution and/or impact agreed upon delivery. At a minimum, the update shall outline what work has been performed, what problems have been encountered that may impact cost and/or schedule, potential solutions for any problems, and projected tasks for the next week. The update shall also include metrics on the programs performance with regard to capabilities provided to the customer and the outcome from those capabilities. The weekly updates shall be captured and provided in the Government recommended reporting system (e.g. MIDS).

The contractor shall use the Forge.mil (https://software.forge.mil), DoD Enterprise Portal Service (DEPS), or similar tools specified by the Government to store draft and final versions of contract artifacts. This includes, but is not limited to, deliverables outlined in the PWS, such as briefings, requirements, design documents, source code, test cases, configuration management, and other documentation.

The Contractor shall notify the COR(s) no later than two business days after becoming aware of changes/additions/departures in key personnel working on the contract.

The Contractor shall conduct monthly in-progress reviews that includes a summary of all individual tasks as requested by the Government, and presented in the MSR. This review shall take place within 5 business days of the submission of MSR. The Contractor shall provide a discussion/review of progress against cost and schedule performance, programmatic and technical risks, and identify and resolve critical issues and actions. The Contractor shall discuss analysis of the risks involving cost, schedule, and performance parameters associated with software, hardware, and programmatic aspects of the project.

The Contractor shall identify high risk factors and develop alternatives to reduce risk. Upon Government approval, the Contractor will implement and monitor the selected alternatives. The Contractor shall work with the DoD Mobility PMO to deconflict any schedule or deployment issues.

(7) Weekly Status Report

6.2 Systems Engineering (SE). (CPFF) The Contractor shall implement a sound system engineering process in support of the MES-U capability and its alignment to the DMUC mission requirements while balancing performance, risk, cost, and schedule. The Contractor shall propose and provide an engineering solution that aligns with DoD Reliability, Availability, and Maintainability (RAM) (http://www.acqnotes.com/Attachments/DoD%20Reliability%20Availability%20and%20Maintainability%20(RAM)%20Guide.pdf) and the Mobility PMO’s system engineering process. DoD RAM ensures that the Government acquires quality products/systems that satisfy user needs with measurable improvements to mission capability and operational support in a timely manner, and at a reasonable cost. The Contractor shall analyze, develop, and/or evolve technical solutions and document the solutions to ensure stakeholder requirements are satisfied. The Contractor shall re-use available technology to the greatest extent possible, with considerations for integration costs, configuration management, and future requirements for enhancements. The SE process ensures all requirements are identified and properly incorporated into the design phase, then integrated into the capabilities. The Mobility system engineering (SE) process spans from the tasking of developing new capability requirements to the operational hand off to DISA Ops of stated capability to eventual disposal.

6.2.1 System Engineering Plan (SEP). The Contractor shall support and perform all activities related to the Mobility SE process. The SEP is a “living”, “go to” technical planning document and the blueprint for the conduct, management, and control of the technical aspects of the contractor’s plan to manage to the Government’s SE process.

The contractor shall implement a Systems of Systems (SoS) approach to the fullest extent possible and wherever applicable. The Contractor shall support existing engineering efforts and plan for future engineering efforts to improve capabilities and performance. The Contractor shall take over any new and existing engineering efforts. The Contractor shall be responsible for the entire engineering lifecycle. The Contractor shall support and perform the following activities:

· Develop, maintain, and execute an SEP supporting MES-U capability development and integration

· Support major reviews, including Chief Mobility Engineer in the Engineering Review Board: requirements review (ERB#1), preliminary design review (PDR) (ERB#2), critical design review (CDR) (ERB#3), system readiness reviews (ERB#4a/b), functional configuration audit and Mobility CCBs

· Interface or coordinate with JTIC, DISA and other DoD Components so to provide the necessary inputs

· Scale the MES-U SEP based on the scope and complexity of the program/system effort

· Develop plans and timelines for the integration or install of the system(s); this shall be reflected in the MES-U engineering schedule deliverable

The SEP shall be kept current throughout the acquisition lifecycle.

(9) PDR

(10) CDR

6.2.2 Requirements Process. The Contractor shall work with the Government to engage Stakeholders, including the operational community, the Requirements and Analysis Office (RAO), the Mission Partner Engagement Office (MPEO) for determination and delineation of the overall MES-U operational requirements. The contractor shall develop a requirements management plan. Mobility requirements shall be updated to harmonize with the newer Information Technology Infrastructure Library (ITIL) and DoD Enterprise Service Management Framework (DESMF) processes. The activities associated with this Task shall vary based upon the priorities established by the Government.

The Contractor shall:

1. Elicit and document operational needs and objectives into defined requirements that are cohesive, traceable, unambiguous, and testable to guide the development of emerging MES-U capabilities.

1. Perform analysis and formalization of requirements for clarity, completeness and feasibility, as well as an activity to propose changes to requirements to improve these three aspects.

1. Give consideration to the operational processes and procedures; possible constraints and limitations; operational environment; and reliability, maintainability and availability.

1. Decompose and maintain traceability between high-level operational requirements to project or system-level requirements, which will be realized through Integrated Project Teams (IPT) and documented in the Requirements Traceability Matrix (RTM)

1. Assist the Government to describe capability needs of the defined processes as functional requirements.

1. Participate in the management and tracking of MES-U requirements through the entire engineering lifecycle.

1. Provide visibility to continuously validate and refine user requirements.

(12) RTM

(13) Requirements Management Plan

6.2.3 Capability Integration. The Contractor shall support existing integration efforts and any future integration efforts to improve, expand, or add new capabilities to the unclassified mobility suite. In addition, the Contractor shall suggest new and replacement commercial solutions for unclassified archived components, especially for those nearing End-of-Life (EOL) as listed on the Approved Products List (APL) and other Government authorized equipment listings. The Contractor shall take over any new and existing integration efforts. Efforts listed below are inclusive but not limited to this effort.

The Contractor shall lead and assist with technical integration efforts and provide oversight and policy guidance to ensure compliance with standards for developing, implementing, and maintaining sound integrated and interoperable architectures taking into consideration any related architectures (e.g., system interfaces, etc.).

The Contractor shall assist in the integration of current solutions with DoD and DISA-supported backend systems such as: Enterprise portal, Enterprise Email, Unified Communications, Public Key Enterprise, and other Enterprise security solutions offered by DISA in addition to non-DISA capabilities. The Contractor shall assess and assist in the integration of data and event reporting requirements to external enterprise systems (e.g., enterprise NetOps tools). During the integration activities the Contractor shall deploy SMEs to the DECC facilities, as required, where the equipment is hosted.

Based on priority and requirements each capability will be chosen by the Government, and shall be documented by the Contractor in the program capability roadmap, and the Contractor shall assist in developing an engineering/implementation plan. The plan shall include detailed schedule, deliverables, activities and costs based on the engineering design to deploy a capability in the operational baseline.

6.2.3.1 Integration of Current Service Capabilities. The Contractor shall provide support in strategic integration of program requirements (e.g. hardware, software, applications, network interfaces, internal/external SoS) to facilitate sharing of information to ensure system compatibility and to leverage best practices, lessons learned, and experiential knowledge to the greatest extent practicable.

The Contractor shall provide technical support on the deployment and implementation of DoD/DISA Mobility solutions on DoD networks, systems, and endpoint devices. The Contractor shall develop deployment and implementation plans and provide back-end technical support on the execution of these plans.

Integration support shall include economies of scale and shall promote the highest level of synergy with a common goal and objective. The Contractor shall provide facilitation support as driven by the stakeholder analyses to garner the highest levels of participation among partners and ensure the end product gives full consideration to their needs.

The Contractor shall also provide support in the strategic integration of future program requirements/capabilities to facilitate new and/or enhanced sharing of information to ensure system compatibility and to leverage best practices, lessons learned, and experiential knowledge to the greatest extent practicable.

The Contractor shall provide technical support on the planning, migration and implementation/deployment of new/enhanced DoD/DISA Mobility solutions on DoD networks, systems, and endpoint devices. The Contractor shall develop the deployment and implementation plans, whether it be a new or enhanced capability and provide back-end technical support on the execution of these plans. The following are examples of future, strategic mobility capability:

· Mobile Content Management (MCM) wherein the contractor shall propose a detailed plan for moving the current DEPS to any future DISA enterprise storage/sharing solution such as SaaS MCM service provider.

· Mobile Endpoint Protection (MEP). Support existing engineering efforts and plan for future engineering efforts to improve capabilities and maintain commercial solutions for on-device monitoring and compliance using designated hardware and software. If an approved MDM-integrated MEP solution is available, then transition and integration from the current architecture shall be executed, if approved by the Government.

Integration support shall include economies of scale and shall promote the highest level of synergy with a common goal and objective. The Contractor shall provide facilitation support as driven by the stakeholder analyses to garner the highest levels of participation among partners and ensure the product gives full consideration to their needs.

6.2.3 Architecture Support. The Contractor shall provide the PMO with architecture engineering services. The Contractor shall provide technical support and engineering services necessary to develop comprehensive MES-U architecture. The MES-U architecture is composed of many sub-functional systems and partner networks. The Contractor shall assist in designing and developing MES-U technical documentation (ex. technical diagrams, Operational Views, System Views, and other DoDAF V2.02 or later diagrams). The Contractor shall support End to End Systems Architecture review and propose changes. The Contractor shall continually propose improvements for Government consideration throughout the life of the contract.

The Contractor shall periodically assess capability gaps of the current MES-U architecture and develop architecture roadmaps and transition plans, as appropriate, based on “as is” and “to be” architectures derived from the approved “to be” requirements based on applicable resources (e.g. DISA/DoD Security, DISA Requirements Analysis Office, etc.). Capability Research shall include but not be limited to performing in-depth research on mobility focused technologies, cyber security systems, applications, services, gateway management improvements and any new applications that improve the current operational capability.

The Contractor shall identify and evaluate emerging technologies to increase capability and support an expedited release schedule. The Contractor shall work directly with industry to identify future technologies such as hardware, software and services that shall work into the unclassified portfolio including vendor relationships.

The Contractor shall perform operational assessments to determine any technology, policy, procedures gaps (e.g. SOPs, Tactics Techniques & Procedures (TTPs), etc.) and/or other shortcomings in the MES-U portfolio. The mobility market place is constantly changing and evolving. The Contractor shall examine all operational environments along with but not limited to policy and procedures supporting the environments.

The Contractor shall periodically assess capability gaps of the current DoD/DISA MES-U architecture and develop/provide architecture roadmaps/transition plans based on “as is” architecture and the “to be” DoD/DISA architecture based on DoD security requirements as well as desired and planned future capabilities.

The Contractor shall perform capacity analysis, planning and testing on the current unclassified infrastructures to the capacity level based on the requirement’s analysis forecasting. The capacity testing will determine a baseline number of consecutive connections for each independent capability. This information will be used with a forecasted amount of future subscribers to determine what changes may be needed to the support the increased user base.

The Contractor shall provide the requirements and designs to the Government for review and approval prior to building, integrating, and implementing the capabilities. The Contractor shall analyze, develop, and/or evolve technical solutions and document the solutions to ensure value throughout the lifecycle of the project by providing continued understanding of how systems work through Software Design Description (SDD) and Interface Design Descriptions (IDD). Documentation will include but is not limited to high level pseudo-code for algorithms and business logic, data requirements, design specifications, hardware and software configuration, system architecture designs, system interface specifications, and protocol analysis.

The Contractor shall create or update all documentation on the design and development of each release cycle. Documentation will include, but is not limited to, System Modeling Language (SysML) artifacts, Interface Design Documents, Software Design Documents, applicable DoD Architecture Framework (DoDAF) version 2.02 views or later. The following are the current required DoDAF views within DMUC:

Information Scope, purpose, intended users, environment depicted, analytical findings (if applicable)

Activities Mapping Describes the mapping between the capabilities required and the activities that enable those capabilities.

Description Operational nodes, activities performed at each node, and connectivity and information flow between nodes.

Chart Command, control, coordination, and other relationships among organizations.

SV-1. Thus, SV-2 shows the communications details of SV-1 interfaces that automate aspects represented in OV-2.

tems, Services-Services Matrices Provides detail on the interface characteristics described in SV-1 for the architecture, arranged in matrix form.

Table 1: Current DMUC Views

For more information on DoDAF & SysML diagrams and artifacts visit http://dodcio.defense.gov/Library/DoDArchitectureFramework.aspx

(15) SDD

(16) DoDAF Architecture Artifacts

6.2.4 Testing. The Contractor shall provide support to maintain an accurate Government baseline for MES-U within DISA’s Joint Interoperability Test Center (JITC) lab at Fort Meade, MD. To complete this baseline, the Contractor shall build, design and, deliver a virtualized testing environment(s) to be used at JITC. The Government has the computing capacity in place to support functional testing in this facility. The Contractor shall establish a dedicated engineering and testing team to support the multiple MES-U interfaces. The Contractor shall establish, as a part of the IMS, a baseline testing schedule to be integrated with the Government’s testing schedule(s).

The Contractor shall work with the Government assigned engineer and other functional teams to develop a realistic and executable test strategy supporting MES-U. This test strategy includes, but is not limited to, functionality, capacity, scalability, vulnerability, data ingest, and integration with other dependent interfaces. Furthermore, the testing strategy shall demonstrate the percentage of test cases that will or can be executed at different stages of the project’s testing phases within the various mobility associated environments that currently exist. DISA requires ample Contractor testing to ensure fully integrated, defect-free solutions delivered to the DISA’s JITC lab for Government Acceptance Testing (GAT), limited integration testing, and pre-production stress and scalable testing with operational data sets. During testing in these environments, the Government verifies whether the requirements are met. Finally, when the contractor-delivered solution has graduated from these testing environments, the contractor’s solution shall be deployed to the operational environment where the Government can validate the effectiveness of the MES-U capability against the intended requirements and/or planned capacity upgrades.

The Contractor shall perform adequate and sufficient testing, to include new mobile devices and Operating System (OS) testing, to ensure all solutions are in compliance with the DISA architecture, security requirements and all operational and systems requirements are met. The Contractor shall be responsible for providing the latest approved mobile devices and, at the Government’s direction, providing non-approved devices for specific testing as applicable. The Contractor shall perform end-to-end integration testing using their test environment for all developed solutions prior to delivery to the Government. The Contractor shall participate in integration/regression test activities performed in the Government at the request of the Government. Testing shall be documented through formal Test Reports, consisting of Test Cases derived from operational requirements.

· The project schedule shall establish specific delivery dates for each set of test procedures and test report

· A formal Test Report shall include a baseline of the system prior to testing, test plan, requirements, results, unresolved issues, and recommendations

· The Contractor shall have the test procedures completed at least three (3) business days prior to scheduling of all test/evaluation activities

· The Contractor shall provide the test plan within five (5) business days of completion of a test/evaluation activity

6.2.4.1 Contractor Software Unit Testing. For software upgrades or replacements, the Contractor shall perform unit testing to identify issues and defects and ensure all necessary functionalities/activities and/or fixes have been executed and recorded prior to delivery of applications for Government Functional Testing (GFT). The Contractor shall identify discrete units prior to unit testing and test each unit thoroughly before delivery to the Government. The Contractor shall design and execute unit test scripts to test all system modules and interfaces that correlate to all in scope requirements, gaps, enhancements, and design modifications. The Contractor shall provide test results that demonstrate that each requirement and business rule has been addressed in the design and tested. The Test Report should be organized by module, identified by test scenario/function and include Pass/Fail test results. Open issues must be identified, each with description of the issue, an impact assessment and planned resolution and/or workaround. The Contractor shall deliver a build or a patch, application release notes, URLs, test data, user IDs and passwords to accompany the release being delivered.

6.2.4.2 Contractor Validation and Verification Testing. The Contractor shall ensure that the services and supporting systems(s) have been built to the specified technical, functional and operational requirements. The validation and verification process shall include requirement reviews, design reviews, code inspections, and product testing to ensure the system fulfills the specified requirements. The verification process shall be conducted internally by the Contractors to include Unit Test and Internal Integration and Regression testing.

6.2.4.3 Interoperability and Integration Testing. The Contractor shall test interoperability and compliance of all MES-U components to include both internal and external (3rd party) developed/integrated capabilities. The contractor shall perform full interoperability and integration testing of developed systems prior to delivery to Government. The integration testing shall ensure that updates to the existing production environment will not be compromised or cause issues with existing production configurations. All resulting Test Reports shall outline the capabilities to ensure all interface standards have been met for feasibility of re-use and interoperability of 3rd party developed capabilities.

6.2.4.4 GFT and User Acceptance Testing (UAT). The Contractor shall create Test Cases based on the operational requirements, develop the user acceptance testing documentation and manage the resolution of issues/defects identified as a result of GFT and UAT. Independent validation and acceptance will be conducted by the Government and/or Government-designated end users to include scrutiny of the operational behavior to verify that the capability is operating as intended and satisfies the operational need.

The Contractor shall document all test results in the final Test Report. All testing shall comply with the Government approved Configuration Management Plan and approved requirements.

6.2.4.5 Test Event Support. During the deployment of operational capabilities, the Contractor shall support the Government requirement to complete official testing events with JITC. The Contractor shall assist in providing support to JITC before, during, and after the test events. The Contractor shall assist in test planning, creating timelines, test schedules, system testing preparation, support during the test event in many different areas and then assist in the creation of the test report. The test schedule shall be included in the overall program/engineering schedule deliverable.

6.2.5 Deployment. The Contractor shall plan, control, oversee, and support deployment of MES-U capabilities. The Contractor shall leverage the Lab for maintaining the baselines and performing final testing. The Lab utilization shall be documented in the System Deployment Plan. A System Deployment Report shall be created at the conclusion of each system deployment event.

The contractor shall support testing, implementing, and assessing impacts of software/hardware patches, upgrades and enhancements; software and hardware change verification and release in accordance with an established Configuration Management (CM) plan. For critical and/or high priority issues, the Contractor may be required to provide onsite assistance.

(19) CM Plan

6.3 Cyber Security Engineering A&A. (FFP) Cyber Security is a priority to the Government throughout the entire system development lifecycle (SDLC). The contractor shall be responsible for compiling, evaluating, submitting, and maintaining all cyber security requirements for the MES-U baseline(s). The Contractor shall be responsible for following all RMF. This Framework shall include access to multiple internal DISA Systems and applications.

The MES-U baselines and processes shall be current and compliant with all DoD security requirements, to include but not limited to Security Recommendation Guides (SRGs), Security Technical Implementation Guides (STIGs), IA Vulnerability Management (IAVM), National Information Assurance Partnership (NIAP) component certifications where required, as well as any other applicable security policies applicable to the infrastructure components of the overall MES-U system solution.

The Contractor shall support all cyber security related meetings and tasking related to the A&A of the MES-U current and future baseline(s). This shall include but is not limited to cyber related reports, cyber related briefings, and any other task deemed required by the Government.

The Contractor shall provide qualified security professionals to serve as the Information System Security Officer to support the program. Supporting individuals shall meet 8570 IAM Level I qualification and compliance requirements (e.g. Security+) and conduct all security engineering, security, and A&A, and continuous monitoring activities for the program.

The Contractor shall conduct all Security engineering and A&A support in compliance with all applicable A&A guidance including:

· DoDD 8500.1: IA, which establishes policy and assigns responsibilities under Section 2224 of title 10, United States Code to achieve DoD IA through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supports the evolution to network centric warfare.

· DoDI 8500.2: IA Implementation, which implements policy, assigns responsibilities, and prescribes procedures for applying integrated, layered protection of the DoD information systems and networks under DoD Directive 8500.1

· DoDI 8510.01P: Risk Management Framework (RMF) for DoD Information Technology (IT), March 12, 2014

· DoDI 8510.01: DoD Information Assurance Assessment and Authorization Process (RMF), which establishes the DoD process for authorizing the operation of DoD information systems consistent with the Federal Information Security Management Act (FISMA) and DoD policy.

· DoDI 8520.2: Public Key Infrastructure (PKI) and Public Key Enabling, which prescribes procedures for developing and implementing a Department-wide PK Infrastructure.

· DoDI 8580.1: IA in the Acquisition System, which describes required and recommended levels of IA activities relative to the acquisition of systems and services.

· NIST.SP.800-53R4: Security and Privacy Controls for Federal Information System and Organizations, April 2013

· NIST SP800-37R1: Guide for Applying the RMF to Federal Information System, February, 2010

· NIST SP800-53AR1: Guide for Assessing the Security Controls in Federal Information System and Organizations, June 2010

· NIST SP800-60_Vol1 and Vol2: Guide for Mapping Type of Information and Information System to Security Categories, August 2008

· JIE CONUS Core Data Center and Application and System Migration Memo, July 11, 2013

· DISA DAA Vulnerability Management Policy Memo, Dec 18, 2013

The contractor shall develop and submit required artifacts for A&A efforts to include but not be limited to documentation for addressing any program privacy assessments and concerns, system security plan, risk assessment report, incident response plan, contingency plan and disaster recovery documentation, documentation supporting continuous monitoring efforts, annual FISMA…