DRAFT CDF_PWS_v6_MRF_edit.pdf

UNCLASSIFIED

Defense Intelligence Agency (DIA)

Chief Information Office (CIO)

Common Data Fabric (CDF)

Performance Work Statement (PWS)

07 November 2024

Draft Version 6

Table of Contents

1. BACKGROUND

2. SCOPE

3. OBJECTIVES

4. REQUIREMENTS

5. PLACE OF PERFORMANCE

6. KEY PERSONNEL

7. TRANSITION

8. GOVERNMENT FURNISHED EQUIPMENT, INFORMATION, BADGES, KEYS AND/OR

FACILITIES PROVIDED

9. SAFETY

10. SECURITY

11. SUPPLY CHAIN RISK MANAGEMENT

12. REIMBURSABLE EXPENSES (TRAVEL, CONFERENCE, TRAINING, EQUIPMENT, OR

MATERIAL, ETC.)

13. NON-PERSONAL SERVICE STATEMENT

14. CONTRACTING OFFICER REPRESENTATIVE (COR)

15. INTERNATIONAL SERVICES

16. DELIVERABLES

17. INFORMATION SECURITY

18. ANNUAL TRAINING

19. NON- DISCLOSURE REQUIREMENTS (NDA)

20. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1. BACKGROUND

1.1. The Defense Intelligence Agency (DIA) is seeking a vendor to provide program and technical capability implementation, management, and enhancement services to the Common Data Fabric (CDF) Portfolio of capabilities. These capabilities consist of CDF Data Brokering and API management, Policy Capture Tool (PCT), and Common Transformation Service (CTS).

1.2. The CDF delivers a data brokering capability from machine-to-machine across the

Defense Intelligence Enterprise (DIE). The CDF serves as a scalable, modular, open architecture that enables systems to collect, process, and disseminate intelligence data.

Through the CDF, the Defense Intelligence Enterprise (DIE) will enable the integration of new and emerging capabilities into their existing architecture. CDF operates on multiple networks to enable seamless data brokering from tasking to collection to near real-time dissemination out to the warfighter. The CDF represents a technical solution to the complex challenge of sharing data in the DIE, constrained by networks, cyber policies, and human behavior. CDF initially began as a prototype five years ago as a refinement for Distributed Common Ground / Surface System (DCGS) Modernization that has since moved to production/operational point. The current solution utilizes Cloudera Data Flow Management and Cloudera Data Platform Private Cloud; however, this may change at the Government's discretion.

1.3.The CDF has transitioned from the prototype phase to the operational phase. The prototype focused on the following benefits:

1.3.1. Modernization of the Distributed Common Ground I Surface System (DCGS)

Enterprise

1.3.2. Establishment of a working enterprise deployment model.

1.3.3. The capture of "machine-to-machine" data sharing policy.

1.3.4. Self-service access to data consumers.

1.3.5. Application of a commercial data lake platform for data brokering.

1.3.6. Elimination of bilateral sharing agreements.

1.4. The PCT will provide a web-based self-service interface for customers to record their systems and data set policies. Customers will be able to enter policies for their system and/or dataset into PCT to create their associated Data Sharing Agreement (DSA).

1.5. The CTS provides a capability integrated with CDF to provide data workflows supporting the capture of lineage, transformations, and operations of the data. The current solution utilizes Cloudera Data Flow Management; however, this may change at the Government’s discretion. CTS supports transformations for new and legacy information sharing frameworks that have unique constraints on data format and filtering.

2. SCOPE

2.1. The scope of this Task Order, (TO), includes the following tasks:

2.1.1. Task 1: Program Management.

2.1.2. Task 2: Customer Services (Customer Support and Policy Capture).

2.1.3. Task 3: Cyber Security Service.

2.1.4. Task 4: CDF Portfolio of Capabilities Systems/Application Architecture and

Engineering.

2.1.5. Task 5: Commodity (Hardware/Software) Procurement.

2.2. Period of Performance: It is anticipated that the Period of Performance for this effort will be for one (1) Base Period of twelve (12) months and four (4) Option Periods of twelve

(12) months each.

3. OBJECTIVES

3.1. The objective of this requirement is to provide program and technical services to support design, implementation, and enhancement of the CDF portfolio of capabilities (Common Data Fabric, Policy Capture Tool, and the Common Transformation Service). The effort is multifaceted and involves delivering new, improving existing, and maintaining services for the following CDF components:

3.1.1.Customer Services (Customer Support and Policy Capture): Planning, organizing, leading, and managing all contact with current and potential DIE customers to ensure the DIE customers are informed on CDF current and future capabilities and assist customers through the CDF onboarding process.

3.1.2.Cyber Security Services: Planning, identification, and incorporation of security controls, documentation, and corresponding Risk Management requirements into CDF Architecture. Following DIA Cybersecurity processes, or other Intelligence Community (IC)/Department of Defense (DoD) defined Security Authorization processes to obtain and maintain the Authority to Operate, (ATOs).

3.1.3.Systems/Application Architecture and Engineering: Operate and maintain to deliver the current CDF capabilities as system engineers and developers. Provide research, development, test, and evaluation to integrate future upgrades to the capabilities. Provide a real time monitoring of the CDF services of the CDF operations and security activity. Develop a Discovery service for CDF customers to easily view data resource availability and associated data policy requirements. Follow agency standards for configuration and change management processes for the capabilities and data policies.

3.1.4.Commodity (Hardware/Software) Procurement: Purchase of CDF portfolio software (subscription to Cloudera software) and provide installation support.

3.2. The above elements of this requirement apply across multiple security domains, deployment models, and environments. Security domains include Non-classified Internet Protocol Router Network (NIPRNet), Secret Internet Protocol Router Network (SIPRNet), and Top Secret//Secure Compartmented Intelligence (TS//SCI) domains connected to the Joint Worldwide Intelligence Communication System (JWICS) with the ability to extend to Special Access Programs (SAP), coalition, bilateral, and other mission networks as dictated by prioritized requirements. Deployment models include cloud (multiple), on-premises, and at the edge. On NIPRNet, SIPRNet, and JWICS, CDF employs development, testing, and production enclaves for the CDF Portfolio. DIA anticipates the potential for multiple instantiations of the CDF supporting different combinations outside of these three security domains, deployment models, and environments as necessary to meet customer requirements. For example, a specific CDF instantiation on-premises may be appropriate for certain coalition customer use cases.

4. REQUIREMENTS

4.1. The Contractor shall provide and sustain the CDF portfolio to provide a data brokering capability to support the war fighter, mission partners, and decision makers. The Contractor shall provide labor, management, supervision, and training, to meet the requirements set forth in this Performance Work Statement (PWS).

4.2. Task 1: Program Management

4.2.1. The Contractor shall provide and oversee agile delivery, program management and planning services with the capability to manage large projects applying Project Management Institute (PMI) best practices (e.g., Project Management Body of Knowledge, (PMBOK), Guides & Standards).

4.2.2. The Contractor shall identify and assign a Program Manager (PM) to function as the responsible officer in charge (ROC), accountable to address the Government’s questions and supervise the Contractor employees for this effort. The PM shall be responsible for, and report any significant deviations in the project’s technical, cost, and/or schedule parameters immediately to the Contracting Officer Representative (COR). In support of Program Management, the Contractor shall:

4.2.2.1.Coordinate and hold a TO kick-off meeting within five business (5) days of award.

4.2.2.2. Provide the management, staffing, and associated programmatic activities to enable an integrated, timely, low-risk, and high-quality delivery for the Government.

4.2.2.3. Provide support in the planning and execution of special projects including composing summary analysis reports and advising Government on feasibility, risk, budget, and schedules. Serve as the single point of contact for TO project management and technical assistance, providing supervision of Contractor activities for both prime and sub-contractor staff.

4.2.2.4. Coordinate, prepare, and support In-Progress Reviews for significant initiatives.

4.2.2.5. Prepare and deliver a Weekly Activity Report (WAR)/Significant Activity Report

(SAR) detailing major achievement/accomplishments for the week across all tasks.

4.2.2.5.1 Prepare and deliver a Monthly Status Report (MSR).

4.2.2.5.2. Prepare and deliver a Monthly Contract Burn Rate Report.

4.2.2.5.3. Prepare and conduct a Monthly Management Review (MMR).

4.2.3. The Contractor shall assign a Technical Director (TD) to this effort. As such, the TD is responsible for collaborating with cross-functional teams to develop and refine the CDF Portfolio capabilities to align with business objectives, development goals, and security requirements. In this role, the Contractor shall:

4.2.3.1 Integrate agile delivery methodologies (such as agile Scrum and Kanban) to ensure iterative development and continuous improvement, in alignment with DoD and IC agency-level software development lifecycle standards.

4.2.3.2. Apply current industrial development best practices that contain iterative and incremental project management techniques similar to agile software development lifecycle standards and utilizing DIA’s Risk Management Framework (RMF).

4.2.3.3.Conduct/facilitate Technical Exchange Meetings and Preliminary Design, Critical Design meetings.

4.2.3.4.Work directly with the CDF Government program management office to establish priorities, set expectations and deliverables, and monitor the overall financial execution of the program.

4.2.3.5. Design and implement secure CI/CD pipelines, automation frameworks, and deployment processes that seamlessly integrate security checks and controls.

4.2.3.6. Champion the integration of security practices throughout the software development lifecycle (SDLC), including threat modeling, code analysis, vulnerability scanning, and penetration testing.

4.2.3.7. Collaborate with Product Directors and development teams to implement security best practices, such as secure coding guidelines and secure software design principles.

4.2.3.8. Identify potential security risks and vulnerabilities in applications, infrastructure, and processes, and work with relevant stakeholders to implement appropriate mitigations.

4.3. The Contractor shall also assign Product Directors (PDs). As such, the PDs build strong relationships with Government stakeholders, understanding their requirements, challenges, and objectives. The PDs serve as the primary point of contact in their respective product areas, ensuring alignment between the product development roadmap and Government priorities. In this role, the Contractor shall:

4.3.1. Develop a comprehensive product strategy.

4.3.2. Create and maintain a clear and prioritized product roadmap that aligns with the Government’s objectives and timelines.

4.3.3. Collaborate with engineering, design, operations, and other teams to define features, functionalities, customer experiences, customer care processes, and project milestones.

4.3.4. Translate Government needs into detailed product requirements, user stories, and use cases, and clearly communicate these requirements to development teams and ensure accurate implementation.

4.3.5. Ensure the quality and performance of products meet Government standards and compliance requirements.

4.3.6. Coordinate testing and validation processes to guarantee reliability, security, and functionality.

4.3.7. Prepare reports and presentations that effectively communicate product plans, progress, and results. PDs serve as Deputy Program Manager (DPM) focused on ensuring technical delivery maximizes value delivered to CDF customers.

4.4. Task 2: Customer Services (Customer Support and Policy Capture)

4.4.1. The Contractor shall provide customer services through outreach support and system/data policy capture support interfacing with customers across the DIE to determine possible systems and data sets for onboarding to the CDF capability. The Contractor shall interface with DIE customers to determine their current and future data needs as well as any possible data transformations that may need to occur. This effort is to perform customer outreach to identify the key Information Systems data sets and systems supporting the DIE. In support of Customer Services, the Customer outreach support shall:

4.4.1.1. Manage stakeholder/customer engagement to onboard systems and data sets into the CDF Portfolio.

4.4.1.2. Identify systems for integration into CDF.

4.4.1.3. Create and manage a prioritized list of systems to be integrated into CDF with alignment to customer requirements and use cases, (Systems Onboarding Priority List).

4.4.1.4. Manage, track, and perform customer engagements at the direction of the CDF Program Management Office, (CDF Engagement Tracker).

4.4.1.5. Identify missing systems of benefit to the DIE.

4.4.1.6. Create, maintain, and update a customer onboarding process.

4.4.1.7. Integrate with Program Services and Capabilities to guide stakeholders through the onboarding processes.

4.4.1.8. Continuously communicate with customers to ensure all policies in the CDF Integrated Operations Guide are being adhered to.

4.4.2. The Contractor shall provide policy capture support by work with customers to identify and record policies that govern data exchange. These policies will document how the consuming system must protect the data. The policy discovery process will involve understanding of applicable DoD policy and doctrine governing machine-to-machine exchange of information in support of each deployed CDF environment. The Contractor understands that each CDF environment operates on policy unique to the environment. (Example: IC Directives are typically only applicable to the CDF instance on the JWICS network).

4.4.3. Customers requiring policy capture support will come from the customer outreach support services or the Program Management Office (PMO). The policy capture support tasks will include, but are not limited to:

4.4.3.1. Define Interconnect System Agreements (ISAs) between the data owning system and DIA; this will be done in conjunction with the Cyber Security Support services following a standard ISA format.

4.4.3.2. Define and codify policy agreements, Data Sharing Agreements (DSAs), at the data resource level that will directly support the mission needs of warfighters and analysts across the DIE.

4.4.3.3. Generate an executable DSA following a standard DSA format.

4.4.3.4. Provide complete traceability to applicable published directives, issuances, manuals, and issuing authorities, policies, and doctrine so the original intent of the system owner can be understood, codified, and applied to the data set.

4.4.3.5. Provide management of all generated DSAs to include configuration management, trusted signature verification, revalidation prior to expiration date, and reporting to PMO to support periodic DSA reviews.

4.4.3.6. Integrate with the Chief Data Office (CDO) to ensure Data Management

Plans are documented for required data sets and tied to the corresponding

DSA.

4.4.3.7. Integrate with program services and capabilities for the customer onboarding process.

4.4.3.8. Determine the Needs, Retention, and Volume metrics from Data Providers and Consuming Missions.

4.5. Task 3: Cyber Security Services

4.5.1. The Contractor shall provide Cyber Security Services to support the CDF Portfolio.

The Contractor Information System Security Engineer (ISSE) and Information System Security Officer (ISSO) staff shall follow DoD and IC Cybersecurity processes and policies to achieve and maintain an ATO for all CDF Portfolio components. Systems security is foundational to all activities associated with CDF.

Systems Security Life Cycle (IAW ICD 503 Risk Management Framework (RMF)) engineering is applied to all activities to achieve and sustain the necessary ATO for a new, existing, or modified service or solution. This includes preparing the necessary compliance and acceptance documentation and coordinating activities necessary to comply with the appropriate security regulations.

4.5.2. For the CDF RMF requirements, the Contractor shall complete all associated tasks with RMF and collaborate with associated authorizing officials as required to:

4.5.2.1. Ensure that security requirements and objectives are identified, implemented, automatically monitored, automatically reported in compliance with RMF and other security directives as detailed by the Information System Security Manager (ISSM).

4.5.2.2. Ensure all applicable system security requirements are met in accordance with the network of deployment and associated system security level.

4.5.2.3. Document all security relevant changes in the associated risk management system (Xacta/eMASS). Xacta and eMASS are systems used to document all relevant System Cyber Security documentation.

4.5.2.4. Identify, assess, and document all vulnerabilities in the CDF Portfolio according to DIA CIO Cyber Security policies.

4.5.2.5. Assist the ISSMs in performing systems security requirements analysis where needed in preparation for security compliance and relay findings through the ISSMs that may impact design, operations and/or performance to the relevant engineering or operations groups.

4.5.2.6. Enhance and deploy security services architecture.

4.5.2.7. Participate in customer Technical Exchange Meetings (TEMs) to gather requirements and participate in Security TEMs in relation to systems security and system accreditation as required.

4.5.2.8. Maintain currency on all system security documentation for accreditation in accordance with all specified National Institute of Standards and Technology (NIST) 800-53 controls for all project and service activities in support of ATO to include but limited to: System Security Plan, Monitor, Strategy, Security Control Traceability Matrix, CONOPS, architecture and boundary diagrams, etc.

4.5.2.9. Collaborate on IA activities with the ISSMs and the appropriate Cyber

Security Program Offices to ensure incorporation of RMF strategic goals and objectives.

4.5.2.10. The Contractor is responsible for submitting the Supply Chain Risk

Management (SCRM) evaluation for all incorporated software and coordinating review with DIA Information Assurance using the RMF.

4.5.2.11. Work with DIA Cyber Security and partner Agencies/Departments as ATO authority.

4.5.2.12. Verify that security measures are taken, maintained, reported on and updated as required.

4.5.2.13. Notify the Government in writing (via assigned ISSM(s)) to edit

Information Assurance Vulnerability Alert (IAVA) and Plan of Action and Milestones (POA&M) documentation when expected measures have not been implemented.

4.5.2.14. Meet mission objectives in accordance with applicable security policies and directives.

4.5.2.15. Collaborate with ISSM and security engineering to ensure all systems are compliant with security directives as designated by the ISSM.

4.5.2.16. Design/enhance firewalls and controlled interface security architectures based on requirements provided by ISSM and appropriate security organization(s).

4.5.2.17. Identify, implement, automated management, automated monitoring, and automated reporting of detailed ongoing security hardening, patching, and virus-checking.

4.5.2.18. Implement procedural protective measures, fully automating repeatable processes and reporting to maintain systems compliance toward ATO.

4.6. Task 4: CDF Portfolio Systems/Application Architecture and Engineering

4.6.1. System/Software Engineering: Operate and maintain to deliver the current CDF capabilities as system engineers and developers. Integrate future upgrades to the capabilities.

4.6.2. Service Management (Tier 1 & 2): Utilized current DIA ticketing capability, ServiceNow, for automating, streamlining, and providing service management support to ensure the CDF continuously delivers value to consumers, including customer support, incident management, capacity management for system changes, project management, and cyber security change (Tier 1 & 2 support). Customer support is provided during normal Government business hours, Monday – Friday 9 am to 5 pm (EST).

4.6.3. Service Operations and Maintenance (Tier 3): Providing service operations support, application management, system/software maintenance, and operations management. Day to Day system operations as system administrators.

4.6.4. RDT&E: Researching, developing, testing and evaluation of new components and enhancements to the CDF Portfolio capabilities.

4.6.5. The Contractor shall provide technical support to the CDF Portfolio capabilities. The CDF Portfolio consists of three capabilities, the CDF Data Brokering and API management (CDF), Common Transformation Service (CTS), and the Policy Capture Tool (PCT). In support of the CDF Portfolio Systems/Application Architecture Engineering services, that contract shall:

4.6.5.1. Provide installation of new CDF Portfolio capabilities and upgrade the current capabilities (on-premises or cloud based).

4.6.5.2. Manage and install current capability and associated new software licenses.

4.6.5.3. Engineer system scaling and redundancy to meet Government requirements.

4.6.5.4. Advise and engineer integrations between the CDF Portfolio capabilities with new and existing technologies/capabilities within the DIE (i.e., Enterprise Cross Domain and Enterprise Public Key Infrastructure (PKI) services).

4.6.5.5. Integrate DIA Zero Trust guidelines and requirements as placed into effect.

4.6.5.6. Onboard new API connections for systems and datasets tied to the associated data policies for the systems and data sets for the enforcement of machine-to-machine policy-based access.

4.6.5.7. Maintain the CDF Data Catalog of data available within CDF.

4.6.5.8. Provide Tier 0 through 3 customer support.

4.6.5.9. Build data pipelines to perform the Extract Transform Load (ETL) functions to transform data based on the consumer data format needs within the CDF Portfolio, CTS.

4.6.5.10. Provide lineage and data documentation to document the data being transformed for brokering to the data provider. Lineage tracking includes identifying data origin, what happens to it (transformations) and where it moves (consuming systems) over time. Data lineage gives visibility while greatly simplifying the ability to trace errors back to the root cause in a data analytics process.

4.6.5.11. Develop a web-based self-service interface to capture data sharing policies as entered by the system representatives, PCT.

4.6.5.12. Automate the generation of an electronically executable Data Sharing Agreement (DSA) as an output from the PCT.

4.7. Task 5: Commodity (Hardware/Software) Procurement

4.7.1. The Contractor shall acquire Hardware and Software on behalf of the government to provide to the government to maintain the CDF Portfolio capabilities. The Contractor shall purchase Cloudera Data Platform Private Cloud Base Edition and Cloudera Data Platform Flow Management licenses to support the CDF Portfolio.

The Contractor shall evaluate the current infrastructure to ensure the proper license coverage, Cloudera License Evaluation. Based on the Cloudera Licenses Evaluation, the Contractor shall provide a cost estimate for any ODC to the Government for approval. The resulting licenses will be provided to the Government, ODC Licenses.

Table 1

License Type Amounts Cloudera Data Platform Private Cloud Base Edition - Annual Subscription per Node for up to 16 Cores/128 GB RAM for compute or up to 48

TB

for storage. US Citizen US Soil Support Engineers, Technical Support Case SLAs Sev 2-4 8x5 Mon-Fri, Sev 1 24x7 Mon-Sun. 203 Cloudera Data Platform Flow Management Edition - Annual Subscription, 4 Cores - Business Support. AGPL License 47

Table 2

Deployments CDP (nodes) CFM (4 core units)

CDF - J 89 14

CDF - S 89 14

CDF - N 25 3

CTS - J 0 8

CTS - S 0 8

Totals 203 47

5. PLACE OF PERFORMANCE

5.1. The work shall be performed at Contractor provided facilities unless there is a specific mission need for onsite personnel (e.g., OCONUS).

5.2. The Contractor shall be responsible for the installation and maintenance, to include all required security requirements as well as the equipment and software necessary to provide Contractor’s employees with access to the required Government networks. This includes, but is not limited to STIGs, Information Assurance Vulnerability Management (IAVM), Intelligence Community Vulnerability Management (ICVM), security auditing and monitoring and provision of security log data, Federal Information Security Management Act (FISMA), and IAW DoD and DIA requirement.

5.3. The Contractor shall provide all required network connectivity to the Contractor Sensitive

Compartmented Information Facility (SCIF) from a DIA provided connection point.

5.4. The Contractor shall be responsible for providing access to JWICS wide area network (WAN) and associated local area network (LAN) capabilities within Contractor provided facilities. The Contractor shall be responsible to install and maintain, at their expense and as needed, the internal LAN within the Contractor’s SCIF. This LAN shall terminate in a Contractor-provided, independently controllable access space within the SCIF. This space shall be properly cooled and powered to host at least two full 72” racks of equipment (crypto, routers, switches, etc.) with an 8-foot ceiling minimum. Additional requirements may be necessary to properly secure and control access to crypto equipment and shall be coordinated with the appropriate DIA office by the Contractor’s SSO. If the Contractor needs the specifications on the appropriate/authorized configuration for the LAN cabling, it is available from DIA upon request.

5.5. The Contractor shall provide all other necessary equipment, software, and supplies required to complete this task order. The Contractor may recommend Commercial Off- The-Shelf (COTS) or other previously developed software components to support automation and improved application development and operations. The Contractor shall be responsible for providing an estimate of initial and on-going cost relating to appropriate licensing for the intended maintenance and use. After the tool is installed and approved for the operational network by IA, any changes to that tool are subject to Change Management (CM) and IA requirements.

5.6. The Contractor shall ensure network equipment is replaced every 5 years in accordance with industry best practices or risk being disconnected from JWICS and other DIA operates networks.

5.7. The Contractor shall ensure facilities hosting any classified CDF deliverables shall have proper SCIF accreditation for sensitive compartmented information and network connectivity with sufficient capacity to support the work defined in this PWS.

5.7.1. The Government retains the right to evaluate and approve these SCIFs. The

Government may schedule periodic service/SCIF audits and inspections.

5.7.2. The Government shall be given access rights to CDF SCIFs.

5.8. Certain elements of work performed under the scope of CDF are unclassified and may be performed at alternate duty locations outside of SCIFs with prior approval from the CDF Program Manager and CDF COR.

5.9. At the explicit request of the CDF Program Manager, travel to/attendance at Technical

Exchange Meetings and conferences hosted by Industry or Government entities at the explicit request of the CDF Program Manager.

5.10. Operational Hours: The Contractor shall provide CDF services during core business hours, as determined at each site. On-call hours shall commence after core duty hours and be provided as required, in the case of a surge event or operational anomaly.

5.10.1. The Contractor shall provide staffing for a 40-hour work week. The Contractor shall obtain written COR approval prior to any performance in excess of 40 hours per week to ensure availability of funding.

5.10.2. The Contractor’s employees shall work a 40-hour work week that may include shift work or compressed work schedules to meet mission requirements. The Government reserves the right to adjust hours as mission dictates by providing a 24-hour advanced notice.

5.10.3. Extended Hours: The Contractor shall provide extended hours, as requested.

Extended hours worked under this contract (in excess of 40 hours per week) may be required and shall be authorized in advance only through the COR or ACOR.

Extended hours require pre-approval from the Government, unless for an unplanned emergency. In the occurrence of an unplanned emergency, the Contracting Officer shall be informed at the beginning of the next business day.

Extended hours are an exception to normal Government business hours and shall only occur due to mission demands (mission essential/critical applications) or to provide on-call maintenance as required.

5.10.4. Surge and On-call Support: The Contractor shall provide surge personnel (work over and above normal operations) for short durations for tasks that cannot be accomplished by existing personnel. Surge over and above requirements shall be authorized in advance only through the COR or ACOR.

5.10.5. The Contractor shall maintain an on-call schedule outlining 24/7 enterprise service availability requirements. On-call Contractor personnel will contact the Government Program Manager and Contractor PM and arrive on-site within 2 hours of notification.

6. KEY PERSONNEL

6.1. The Government defines “Key Personnel” as persons in the Contractor’s organization who provide in-depth experience and management. The following roles are key personnel:

6.1.1. Information Systems Security Officer (ISSO): will manage and coordinate Risk Management Framework (RMF) activities for a system or systems as defined by the customer. Coordinate actions, as needed, with associated ISSO's for related systems. Lead colleagues as necessary and work in close coordination with all system stakeholders. Create and maintain existing information system security documentation, including System Security Plan (SSP), Critical Asset definitions, Security Controls Matrix and/or Assessment, Security Policy, and Security Configuration Guides for both high value assets and security services. Prepare system documentation for assessment in accordance with

RMF.

6.1.2. Information System Security Engineer (ISSE): will provide an Information System Subject Engineer for the assessment and authorization and continuous monitoring processes. Provide cybersecurity requirements analysis of architectures and designs.

Identify architecture development best practices. Identify technical gaps and provide solution recommendations for services acquisition, development, migration, implementation, and monitoring. Explain security controls/requirements and guidance to the System Owners and System Teams and recommend implementation strategies. Identify vulnerabilities and recommend mitigation alternatives for Plan of Action and Milestones (POA&M) items.

6.1.3. System Administrator: will maintain and support the integrity of the operating system environment and various computer systems. Perform systems maintenance tasks, such as system back-up, recovery, and file maintenance to promote uptime and efficient performance. Acquire, install, and test system software upgrades and computer components. Configure software and resolve technical problems. Maintain documentation of IT infrastructure and troubleshooting procedures.

6.1.4. Program Manager: will manage and oversee all aspects of a technology project to ensure it is completed on-time and within budget. Have overall responsibility for managing scope, cost, schedule, internal staffing, vendors, and contractual deliverables. Develop detailed project plans. Monitor project milestones and generate periodic status reports.

Evaluate and manage risk. Incorporate quality measures and standards to project deliverables. Possess strong knowledge of technology.

6.1.5. Technical Director: will direct the technical project management function. Develop and establish strategic project management and quality standards and methods that ensure on-time and in-scope delivery. Guide the development of technical estimates, work plans, methodologies, and deliverables. Build project delivery team skills and capability. Remove obstacles and negotiate with stakeholders. Manage and mitigate risk in all projects. Will have deep and broad knowledge of technology.

6.2. The Contractor shall provide written notice to the Contracting Officer at least thirty (30) calendar days before substituting or removing individuals in these key personnel positions.

7. TRANSITION

7.1 The Contractor shall begin the phase-in efforts immediately after task order award. The Contractor shall submit a Transition in Plan as part of their proposal. In this plan, the

Contractor shall specify how it will phase in seamless personnel staffing and support so that no delays or degradation of services is experienced by DIA. In the plan, the Contractor shall include adequate time to hire appropriate personnel, conduct inventories, assume network control, issue subcontracts, etc. after task order award. The Contractor shall commence implementation of the proposed Transition Plan immediately upon task order award. During the phase-in period, the Contractor shall be responsible for finalizing all employee clearance requirements. The Contractor shall complete the necessary steps for assumption of the operation during the phase-in period and shall meet all requirements as specified in the PWS with the beginning of full performance. The phase-in period shall be no more than 90 calendar days. The Transition In Plan should include, but is not limited to the following:

7.1.1. An operational plan, with Government concurrence, to manage and execute the transition of functions, as defined within this task order, from the incumbent to the Contractor’s personnel. This plan shall be called the CDF Transition Plan and shall address staffing and transitioning work from the incumbent which reduces risk during the transition period.

7.1.2. Ensure Contractor assumes prescribed accountability and responsibility for all operations activities supported by this task order within 60 days of the contract kick off meeting.

7.1.3. Include a specific, detailed plan for SCIF, equipment, and personnel accreditation

(as applicable) needed upon award of the task order.

7.1.4. Address the Contractor’s proposed approach to sustaining critical operations. It shall describe the specific activities, assignments, milestones, and schedules necessary to successfully execute the transition schedule. At a minimum, the plan shall address Task Order Startup to include ramp-up time and activities, identification of key personnel staffing, team hiring, risk management, and orderly assumption of operations. As part of this plan, the Contractor shall demonstrate the continued support of operations processes, as currently performed. Also show, by location, how these functions/processes are transitioned to this task order.

7.1.5. Include a Transition Manager as well as a list of key personnel involved in the transition efforts.

7.1.6. The Contractor Transition Manager shall work with the existing CDF COR and

CDF Contractor Program Manager to capture key elements to ensure a smooth transition.

8. GOVERNMENT FURNISHED EQUIPMENT, INFORMATION, BADGES, KEYS

AND/OR FACILITIES PROVIDED

8.1. Contractor-Provided Facilities: The Contractor, at their expense, shall provide IT hardware and software, as well as any special tools and/or equipment requirements needed to perform work in Contractor owned/operated/leased facilities utilized for this PWS. The Contractor owned/operated/leased SCIF (TS/SCI) shall be operational and ready for occupancy within 6 months of the contract kick off meeting. The Contractor owned/operated/leased facility will be located within 50 miles of DIA HQ’s.

8.2. The Contractor shall provide desktop equipment capable of accessing all classified networks.

These components must meet security and network requirements.

8.3. The Contractor shall be responsible for the installation and maintenance, to include all required security requirements as well as the equipment and software necessary to provide Contractor’s employees with access to the required Government networks. This includes, but is not limited to, Security Technical Implementation Guidelines (STIGs), Information Assurance Vulnerability Management (IAVM), Intelligence Community Vulnerability Management (ICVM), security auditing and monitoring, provision of security log data, FISMA, and IAW requirements.

8.4. The Contractor shall provide all required network connectivity to the Contractor SCIFs from a Government provided connection point.

8.5. The Contractor shall be responsible to comply with all SCIF requirements and standards for operating classified IT systems. The Contractor shall be responsible to provide and maintain, as needed, the internal networks within the Contractor’s SCIF. Additional requirements may be necessary to properly secure and control access to crypto equipment and will be coordinated with the appropriate Government office by the Contractor’s Special Security Officer (SSO).

8.6. Contractor-Provided Facilities: The Contractor is expected to provide a SCIF that meets the requirement in to serve as an Alternate Operations Cell location. The Contractor shall:

8.6.1. At their expense, provide IT hardware and software, as well as any special tools and/or equipment requirements needed to perform work in Contractor owned / operated facilities utilized in support of this PWS. The Contractor Owned and operated SCIF shall be operational within 6 months of the contract kick off meeting.

8.6.2. The Contractor shall provide the desktop equipment which provides access to all classified networks. These components must be IAW DoD and DIA requirements.

8.7. Government Furnished Equipment/Property: Upon completion or termination of this contract, unless sooner requested by the Government, the Contractor shall return to the Government all such physically deliverable property or equipment, as well as any Contractor acquired property which may accrue to the Government under contractual terms, provided such property has not been previously incorporated into any contractual line items as a part hereof, tested to destruction, or otherwise expended or rendered valueless as a result of performance.

8.8. The Contractor shall maintain physical security of Government Furnished Equipment and

Property to prevent the loss of data, software and hardware (e.g., physical access, etc.).

8.9. The Contractor shall furnish reports required by applicable FAR and Agency guidance.

8.10. Utilization of Government Furnished Equipment / Property shall be limited to work assigned under this PWS.

8.11. The Contractor shall return all contract materials, Government-provided data, and any materials procured during the contract (i.e., any hardware and/or software licenses procured at Government expense) at closeout.

8.12. The Contractor shall produce, and maintain, a list of all equipment purchased under the ODC

Materials CLIN under this contract documenting each item purchased, location, date of receipt, current location, and other information as specified within the PWS.

8.13. The primary work location for this requirement is in the Contractor Provided Facilities. It is anticipated in the beginning of the contract there may be a transition period based on the SCIF plan provided during Proposal evaluation. The contractor shall submit, for Government approval, its request for Government provided space, along with a final plan to migrate from Government to Contractor provided facilities, within 45 days of the contract kick off meeting.

8.14. While providing support in Government Space: The Government will provide Contractor personnel with an office environment (at Primary support locations listed above) that includes workstations, telephones and computers with access to the internet and LAN. The office environment may be shared to support shift work or space shortages as approved by the COR and agreed to by the Contractor and Government.

8.15 Reasonable Accommodations: Contractor employees are not in an employee/employer relationship with DIA; therefore, the contracting company is responsible for providing Reasonable Accommodations to their employee. While DIA will work with the contracting company to the extent that it is possible to facilitate a solution to a specific issue, DIA has no responsibility to provide Reasonable Accommodations for Contractor employees in order to enable them to perform work within DIA spaces.

8.16. Licensing and Software: The Contractor shall first receive COR approval prior to purchasing any software, licensing, equipment or materials under this task order. The COR shall coordinate with the appropriate CIO Organization (i.e., Enterprise Licensing Team) to ensure the software, licensing, equipment, or materials are not currently available prior to approving the purchase.

8.17 Unauthorized Disclosure of Government Information Systems: The Contractor is strictly prohibited from disclosing any data derived from Government information systems. This prohibition applies equally to extracts or summaries of such data, and includes oral, written or electronic media disclosures. The subject data include, but are not limited to, financial databases, program budget information databases, procurement information databases, and other informational databases. In limited circumstances, the Contracting Officer may authorize the Contractor's disclosure of such information when disclosure is necessary to the successful completion of the contract. The Contractor’s unauthorized disclosure of Government information systems data could result in the disqualification, debarment, or suspension of the Contractor. Such an unauthorized disclosure may also constitute a criminal violation of the fraud or information disclosure provisions of title 18 of the United States Code (U.S.C). In addition, the unauthorized disclosure of information related to national defense may constitute a violation of the “espionage” provisions of Title 18 of the U.S.C., sections 793, 794, and/or 798, or Title 50 of the U.S.C., section 783.

8.18. The Contractor shall provide the COR with a list of applicable employees prior to personnel gaining access to any information system(s).

8.19. Information systems are defined as any telecommunications and/or computer related equipment or interconnected system or subsystems of equipment used in the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmitting, or receiving of voice and/or data, and includes software, firmware, and hardware.

9. SAFETY

9.1. The work described herein is primarily sedentary, performed in an office setting. Some walking will be required throughout the workplace facilities and at work sites. The work environment involves everyday risks or discomforts that require normal safety precautions typical of such places as conference rooms or office spaces. There are no unusual physical demands.

9.2. Contractor personnel may perform services which require walking, moderate to heavy lifting, climbing ladders, crawling under desks, and eye/ear protection. Sites may expose personnel to hazardous conditions. Personal safety equipment (e.g., safety shoes, safety glasses, gloves) are the responsibility of the Contractor.

9.3. The Government will not directly reimburse the Contractor for safety equipment.

10. SECURITY

10.1. The Contractor shall comply with all applicable Government security regulations and procedures during the performance of this task order. The Contractor shall not disclose and must safeguard sensitive information, computer systems and data, privacy act data, and Government work products that are obtained or generated in the performance of this task order. All classified work under this task order requires a minimum TS clearance with SCI access. Additional information is provided in the DD Form 254.

Contractor personnel may be required to complete security training (provided by the Government) related to program specific requirements.

10.2. All work under this task order requires a minimum clearance of Top Secret/Sensitive

Compartmented Information (TS//SCI). Additional information is provided in the DD Form 254. A security clearance status of Top Secret/Sensitive Compartmented Information (TS/SCI) requires a CI polygraph test.

10.3. Access badges for Government facilities will be provided, as determined and approved by the COR, for properly cleared personnel to the extent required to conduct the work required under this task order.

11. SUPPLY CHAIN RISK MANAGEMENT

11.1. The Contractor shall adhere to the DIA Supply Chain Risk Management (SCRM) Risk Reduction Plan which includes establishing an internal process that:

11.1.1. Enables authentic Information and Communications Technology (ICT) (e.g., products, materials, and services) free from foreign subversion, exploitation, and sabotage, and will protect the supply chain by incorporating SCRM into all stages of the acquisition and O&M lifecycle.

11.1.2. Examine/screen ICT and electronic parts and accessories, establish trusted suppliers, and maintain a robust acquisition and tamper-evident shipping process.

11.2. For any purchases of ICT to be delivered to the Government:

11.2.1. Policies require the Government to ensure SCRM assessments are completed

(IAW DIAD 5010.100, ICD 731, DoD5200.44) for all ICT, including software, firmware, and hardware (e.g., appliances, sub-assemblies and component parts for break-fix actions) prior to acquisition and deployment.

11.2.2. The Contractor shall submit SCRM requests to the SCRM Program Office (once vetted through the internal Contractor Risk Reduction Process). An approval to proceed with the acquisition (e.g., SCRM Assessment Certificate) must be provided to, and approved by the Contracting Officer Representative (COR), prior to purchasing the ICT on behalf of the Government.

11.3. The Contractor shall ensure the acquisition of all hardware/firmware/software shall be:

(1) comprised of ‘new’ material (not used, refurbished, nor grey-market), (2) procured directly from the Original Equipment Manufacturer (OEM) and/or exclusively through an OEM-authorized federal reseller; and (3) acceptable by the OEM for inclusion/addition to the OEM contract. The acquisition shall be Trade Agreements Act (TAA) compliant. All internal hardware and sub-assemblies (i.e., hard drives, RAM, power supplies, daughter cards, etc.) shall be ‘new’ and must source directly from the OEM and/or the OEM’s authorized re-seller. The Contractor shall not integrate used, refurbished, nor grey-market parts. The Contractor shall not integrate parts previously stored or warehoused within spares or stock with agency ICT appliances.

11.4. ICT shipments shall not originate from foreign soil/locations (i.e., OEM’s distribution center) for direct deliveries to the Defense Logistics Operations Center (DLOC), or other Government points-of-use locations. Initial addressing and labeling documents to agency locations/facilities shall be affixed on U.S. soil. Equipment delivery attempts originating from foreign soil will not be accepted at the agency shipping destinations and shall be returned or made available for return pick-up at the Contractor’s expense.

12. REIMBURSABLE EXPENSES (TRAVEL, CONFERENCE, TRAINING,

EQUIPMENT, OR MATERIAL, ETC.)

12.1. All reimbursable expenses for the performance of work must be approved in advance by the Contracting Officer or the COR.

12.2. The Contractor shall not be reimbursed for any local travel. Local travel is defined as travel conducted on official business within a 50-mile radius of official duty station.

12.3. When work requirements within this PWS require the Contractor to travel, the Contractor shall receive approval from the COR prior to incurring any travel expenses. Contractor personnel must obtain written authorization from the COR that approves approximate travel, dates, expected duration, origin and destination, purpose, estimated costs, and the number and names of personnel traveling.

12.4. Travel expenses shall comply with all Department of State (DoS), DoD, CCMD, Area of Responsibility (AOR), and Government travel security requirements (e.g., pass clearances, request waivers, briefings, vaccinations, passports/visas, contingency plans, registered with Embassy/Consulate, approved Risk Assessment) and copies of required documentation. Travel time will be billed at the standard hourly rate.

12.5. International Travel: Travel costs are reimbursable per FAR 31.205-35. The Government will reimburse the Contractor for costs incurred, excluding profit or fee.

12.6. The Contractor shall use, report, redistribute, and dispose of Government Furnished Property (GFP) in accordance with FAR 52.245-1 and 52.245-9, DFARS clauses 252.245-7001, 252.245-7002, 252.245-7003, and 252.245-7004, and DIA Acquisition Regulation Supplement and Instruction (DARSI 5545.245-9000 and 9002) as applicable. The Contractor shall conduct an acceptance inventory of GFP and provide a written statement to the Contracting Officer (CO)/Property Administrator (PA) containing all relevant facts, such as cause or condition and recommended course(s) of actions if overages, shortages, or damages and/or other discrepancies are discovered upon receipt of GFP.