DRAFT COMBINED BASE CONTRACT PWS_NDES IV_3 Aug 2023_FINAL.pdf

UNCLASSIFIED

PERFORMANCE WORK STATEMENT (PWS)

FOR

Nuclear Data Evaluation Services (NDES) IV

Air Force Technical Applications Center

3 August 2023

Table of Contents

1 DESCRIPTION OF SERVICES

1.1 INTRODUCTION

1.2 BACKGROUND FOR 24 ANN SERVICES

1.3 BACKGROUND FOR 21 SURS SERVICES

1.4 SCOPE

1.5 PERIOD OF PERFORMANCE

2 SPECIFIC TASKS

2.1 MAINTENANCE, SUPPORT AND ENHANCEMENTS TO TRACKMAN AND LIMS

APPLICATIONS. (CDRLS A001 – A016)

2.2 MAINTENANCE, SUPPORT AND ENHANCEMENTS TO DASSLE SYSTEM. (CDRLS A001 –

A016) 8

2.3 MAINTENANCE, SUPPORT AND ENHANCEMENTS TO WORKFLOW SYSTEM. (CDRLS A001

– A016)

2.4 MAINTENANCE, SUPPORT AND ENHANCEMENTS TO EXDIS SOFTWARE. (CDRLS A001 –

A016) 9

2.5 MAINTENANCE, SUPPORT, AND ENHANCEMENTS TO OTHER IT SYSTEMS. (CDRLS A001 –

A016) 11

2.6 IT MODERNIZATION AND INTEGRATION. (CDRLS A001 – A016)

2.7 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) REQUIREMENTS. (CDRLS A001

– A016)

2.8 SUPPORT SOFTWARE IMPLEMENTATION ON AFTAC’S OPERATIONAL NETWORKS.

(CDRLS A001 – A016)

2.9 SUPPORT THE PORTABILITY OF SOFTWARE TO OTHER IT SYSTEMS (CDRLS A001 – A016)

2.10 CONTINUE THE OPERATIONAL AUGMENTATION AND/OR ENHANCEMENT OF SOFTWARE

(CDRLS A001 – A016)

2.11 PROVIDE TRAINING ON SOFTWARE OR APPLICATION TOOLS. (CDRLS A001 – A003, A006

– A010, A12)

2.12 PROGRAM MANAGEMENT. (CDRLS A001 – A016)

3 SERVICES SUMMARY (SS)

4 GOVERNMENT FURNISHED PROPERTY AND SERVICES

4.1 SERVICES

4.2 FACILITIES

4.3 UTILITIES

4.4 EQUIPMENT

4.5 MATERIALS

4.6 INFORMATION

5 GENERAL INFORMATION

5.1 SPECIAL IT REQUIREMENTS

5.2 DEVSECOPS AS A SERVICE AND AGILE SOFTWARE DEVELOPMENT

5.3 CONTRACTOR IDENTIFICATION IN THE GOVERNMENT WORKPLACE

5.4 INDUSTRIAL SECURITY

5.5 PHYSICAL SECURITY

5.6 PRIVACY ACT

5.7 LOCATION(S) OF WORK

5.8 HOURS OF OPERATION

5.9 RECORDS

5.10 CONTRACTOR MANPOWER DATA REPORTING

5.11 SAFETY REQUIREMENTS

5.12 CONTRACTOR PERSONNEL TRAINING

5.13 SPECIAL TRAINING, CERTIFICATIONS AND QUALIFICATIONS

5.14 KICK-OFF MEETING AND PERIODIC PROGRESS MEETINGS

5.15 CONTRACTOR TRAVEL

5.16 TRANSITION PERIOD

5.17 DELIVERABLES

APPENDIX A – ACRONYMS AND ABBREVIATIONS LIST

APPENDIX B – ESTIMATED WORKLOAD DATA

APPENDIX C – GOVERNMENT FURNISHED PROPERTY/INFORMATION

APPENDIX D – APPLICABLE PUBLICATIONS AND INSTRUCTIONS

SECTION 2

1 DESCRIPTION OF SERVICES.

1.1 Introduction.

This is a non-personal services contract. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The Contractor shall notify the Contracting Officer (CO) immediately if they perceive any actions constitute personal services.

These services shall not be used to perform any Inherently Governmental Functions.

1.2 Background for 24 ANN Services.

The 24th Analysis Squadron Nuclear Sciences Flight (24 ANN), part of the Air Force Technical Application Center (AFTAC) 709th Surveillance and Analysis Group (709 SAG), contracts with multiple laboratories to perform analysis of samples and uses the results to create reports.

During previous contracts, most recently Nuclear Data Evaluation Services III (NDES III), a suite of software and hardware systems were developed to manage sample logistics and analytical information. The systems developed under previous NDES contracts include the Trackman application, Data Acquisition System Lab Extraction (DASSLE), and Workflow.

Trackman will be phased out and replaced with Laboratory Information Management System (LIMS). These items are described in more detail below as part of the overall 24 ANN process.

The overall process begins when 24 ANN receives a sample and creates a new project in the database using the Trackman or LIMS tool. As 24 ANN processes the sample they use Trackman or LIMS as a virtual lab notebook and load basic sample processing information into the 24 ANN database through Trackman or LIMS. After samples are processed by AFTAC, they are sent to a network of contracted labs where samples are processed through multiple analytical techniques. The labs then load this information in the Data Acquisition System Lab Extraction (DASSLE) system. DASSLE transfers the data through a series of steps to a server at AFTAC where the information is stored on the 24 ANN database. This database can be accessed by Workflow and Trackman (or future tool) for displaying and visualizing data. Evaluators use these tools to visualize data and write reports. Once a report is written and approved, the report is loaded into Trackman or LIMS and the project is closed. The report and other documents associated with the project are stored on shared drives managed by AFTAC.

The NDES system manages five (5) primary elements: DASSLE, Trackman, LIMS, Workflow and the 24 ANN database.

Element Description Associated Software & Hardware

DASSLE

System which transfers data from the labs to AFTAC’s system

Software (XML, JAVA, Oracle SOA Suite, Oracle

Business Intelligence, Oracle Data Integrator, Oracle Web

Portal, Oracle WebLogic, PLSQL), Solaris UNIX

Servers

Trackman

Interfacing tool to 24 ANN database to record and view files and information associated with a sample

Software (Visual Basic)

LIMS (will replace Trackman)

Interfacing tool to 24 ANN database to record and view files and information associated with a sample

Software (JAVA, GROOVY, JBOSS EAP)

Workflow A report writing tool that displays and charts particle data

Software (Java, PLSQL, XML, Fortran)

24 ANN Database Database which stores 24 ANN data

Oracle 11g Enterprise Edition Release 11.2, Oracle 12 or later version

Trackman/LIMS: Trackman or LIMS is 24 ANN’s software tool that interfaces users to the 24 ANN’s database and various directories. This allows users and data managers to save and access documents related to projects and some basic information from the database. The software acts as a virtual notebook, allowing users to track, put in sample descriptions and save photo documentation from sample processing.

DASSLE: DASSLE is a hardware and software system that allows 24 ANN’s contracted analysis labs to upload sample information from their labs to secure Government servers.

Analysis data generated at the labs is loaded onto a secure webpage and converted to XML where it is submitted to an Oracle server. The data is then uploaded to another Oracle database through AFTAC specialized software. The data is then posted for use in the Workflow and Trackman or LIMS tools.

Workflow: Workflow is a software interfacing tool that accesses 24 ANN’s database and allows users to view data, display data in various graphical forms and search the sample collection.

Workflow provides graphical user interface to users for running nuclear reactor models and advanced algorithms in Java, C++ and FORTRAN.

1.3 Background for 21 SURS Services.

The 21st Surveillance Squadron, part of the Air Force Technical Application Center (AFTAC) 709th Surveillance and Analysis Group (709 SAG), contracts with multiple laboratories to perform analysis of samples and uses the results as part of its treaty monitoring mission. External Data Ingestion System (EXDIS) that enables a straightforward, flexible method for AFTAC, specifically the 21 SURS, to receive data from its partner laboratories and deployed units.

21 SURS receives information from a variety of organizations to include Department of Energy (DOE) laboratories, commercial laboratories, Department of Defense laboratories, and even mobile laboratories. These organizations all provide data in support of AFTAC mission. Prior to the development of EXDIS, these organizations provided this data through a variety of mechanisms such as email and file transfer protocol (FTP). None of these mechanisms had any built in quality control of the received data. The intent of EXDIS is to provide a mechanism for AFTAC partner organizations to easily submit data through a readily accessible web page, consolidate many of of these disparate reporting mechanisms, and provide built in quality control on submitted data.

AFTAC is in the planning phase of migrating several of its programs to a Government approved secure cloud vendor for Government (Gov) Cloud. AFTAC has selected EXDIS as one of its pilot programs for Gov Cloud deployment. The NDES III contract incumbent, previously deployed EXDIS, with the Government’s permission, to their controlled AWS Gov cloud, referred to as Secure Cloud Environment (SCE) herein, during an Internal Research and Development effort. AFTAC intends to leverage this deployment of EXDIS to the SCE to process 21 SURS unclassified data in parallel with existing 21 SURS processing methodology.

1.4 Scope.

The Contractor shall maintain, sustain, enhance and provide system integration services for the hardware and software systems associated with 24th Analysis Squadron Nuclear Sciences Flight (24 ANN) data management system. Services shall include but are not limited to the maintenance of Data Acquisition System Services Lab Extract (DASSLE) system, Trackman, LIMS and Workflow. The contractor shall also assist 24 ANN with interfacing between existing tools/database and modernization efforts which may include new tool applications and cloud-based services.

The Contractor shall maintain, sustain, enhance and provide system integration services for the EXDIS software program. Services shall include but are not limited to product sustainment and maintenance using AFTAC’s Continuous Integration Continuous Development (CI/CD) pipeline, installation on development and production networks, deployment to a Government approved secure cloud vendor, integration with AFTAC’s information technology (IT) systems, initial testing, updates in response to feedback, and rapid, even immediate, response to identified vulnerabilities/bugs preventing the presentation of the software’s web page on the open internet.

While initially meeting the requirements of 21 SURS, this contract can be used to address the needs of other materials analysis squadrons to use the EXDIS software program as a data ingest tool. Also, the Contractor shall also assist 21 SURS with interfacing between existing tools/database and modernization efforts which may include new tool applications and cloud-based services.

As funding allows, the Contractor shall develop new task tracking software tools and develop, maintain, sustain, enhance and provide system integration services for the hardware and software systems associated with other AFTAC units, modernization efforts, and cloud-based initiatives.

Services shall include but are not limited to product sustainment, maintenance and enhancements using AFTAC’s Continuous Integration Continuous Development (CI/CD) pipeline, installation on development and production networks, integration with AFTAC’s information technology (IT) systems, initial testing, updates in response to feedback, and rapid, even immediate, response to identified vulnerabilities/bugs. Specific task requirements will be further identified at the individual Task Order (TO) level.

1.5 Period of Performance.

The performance period is one base year with four option years.

2 SPECIFIC TASKS.

2.1 Maintenance, Support and Enhancements to Trackman and LIMS Applications. (CDRLs A001 – A016)

2.1.1 The Contractor shall maintain the software code associated with the Trackman and LIMS applications.

2.1.2 The Contractor shall ensure Trackman and LIMS are properly interfaced with the Oracle database to ensure data from Trackman and LIMS is correctly entered into the database and Trackman and LIMS displays accurate information from the database.

2.1.3 The Contractor shall ensure Trackman and LIMS are properly aligned with modernization efforts which may include new tool applications and cloud-based services.

2.1.4 The Contractor shall ensure Trackman and LIMS meet the requirements of AFTAC guidance 24 ANN OI 10-01. Government will provide guidance to the contractor when required.

2.1.5 The Contractor shall support the install and troubleshooting of Trackman and LIMS software on analysts’ operating systems.

2.1.6 The Contractor shall initiate and provide a plan of regularly scheduled SPRINT deliveries for all software enhancements.

2.1.7 Software SPRINTs shall be delivered according to the Contractor-provided schedule that is approved by the Government.

2.2 Maintenance, Support and Enhancements to DASSLE System. (CDRLs A001 – A016)

2.2.1 The Contractor shall maintain all aspects of the DASSLE Enterprise Lab Extraction (ELE system). This includes:

2.2.1.1 The Contractor shall maintain the website the AFTAC's contract labs use to input their data into the 24 ANN database. This shall include making modifications to input fields used to enter data, ensuring webpage functionality and its ability to properly transmit and save data.

2.2.1.2 The Contractor shall maintain the Oracle database which receives the data from the labs.

The Contractor shall perform quality assurance checks and modifications on the data to ensure the data is accurate and properly stored.

2.2.1.3 The Contractor shall check to ensure all data received and entered into the DASSLE ELE system is transmitted to the AFTAC secure servers.

2.2.1.4 The Contractor shall identify and report all data rejected from the ELE and AFTAC secure servers. The Contractor shall report any data rejection to the Government and provide support in resolving the issue. The Contractor shall report these deviations as soon as possible (ASAP) to the NDES COR and 24 ANN through email, telephone, or in-person.

2.2.1.5 The Contractor shall maintain the DASSLE ELE system under the requirement set forth in AFTAC guidance 24 ANN OI 10-01 and other official guidance provided by the Government.

2.2.2 The contractor shall maintain all aspects of the DASSLE on AFTAC secure network.

This shall include:

2.2.2.1 The Contractor shall ensure data transmitted from DASSLE ELE is complete and accurately captured on the AFTAC secure network database.

2.2.2.2 The Contractor shall ensure data saved on the AFTAC secure network database is properly formatted for size optimization and is available for SQL query.

2.2.2.3 The Contractor shall maintain the AFTAC secure network DASSLE system under the requirement set forth in AFTAC guidance 24 ANN OI 10-01 and other official guidance provided by the Government.

2.2.3 The Contractor shall ensure DASSLE is properly aligned with modernization efforts which may include new tool applications and cloud-based services.

2.2.4 The Contractor shall initiate and provide a plan of regularly scheduled SPRINT deliveries for all software enhancements.

2.2.5 Software SPRINTs shall be delivered according to the Contractor-provided schedule that is approved by the Government.

2.3 Maintenance, Support and Enhancements to Workflow System. (CDRLs A001 – A016)

2.3.1 The Contractor shall maintain the current functionality of Workflow. This shall enable the analyst to easily search and display analytical information from a project or series of projects (example data, searching techniques, and displays can be provided upon request).

2.3.2 The Contractor shall build wrappers for reactor modeling code and other code developed by third party companies written in languages such as FOTRAN, Java, or C++ for use in Workflow.

2.3.3 The Contractor shall assess the accuracy and completeness of the data transferred from the 24 ANN database to Workflow. The Contractor shall report all deviations to the Government and provide support in resolving the issue. The Contractor shall report these deviations as soon as possible (ASAP) to the NDES COR and 24 ANN through email, telephone, or in-person.

2.3.4 The Contractor shall ensure Workflow is properly aligned with modernization efforts which may include new tool applications and cloud-based services.

2.3.5 The Contractor shall initiate and provide a plan of regularly scheduled SPRINT deliveries for all software enhancements.

2.3.6 Software SPRINTs shall be delivered according to the Contractor-provided schedule that is approved by the Government.

2.4 Maintenance, Support and Enhancements to EXDIS Software. (CDRLs A001 – A016)

2.4.1 The Contractor shall maintain the software code associated with the EXDIS application.

2.4.2 The Contractor shall maintain the current functionality of EXDIS to include functionality with a reasonable, agreed-upon set of web browsers. This shall enable users to easily search and display information from a group or series of groups.

2.4.3 The Contractor shall ensure EXDIS is properly interfaced with databases to ensure that data from EXDIS is correctly entered into the database, and EXDIS displays accurate information from the database.

2.4.4 The Contractor shall maintain the services responsible for uploading data into the EXDIS application. This shall include making modifications to input fields, ensuring webpage functionality, and EXDIS ability to properly transmit and save data.

2.4.5 The Contractor shall ensure EXDIS is properly interfaced with modernization efforts which may include new tool applications and cloud-based services.

2.4.6 The Contractor shall support the incorporation of additional file types.

2.4.7 The Contractor shall ensure EXDIS meets the requirements of NDCA Reporting Guide.

Government will provide all needed information to the contractor when and as required.

2.4.8 The Contractor shall support troubleshooting of EXDIS software on user operating systems, AFTAC servers, and on the SCE.

2.4.9 The Contractor shall standup and maintain a SCE on the approved Gov Cloud supporting 24/7 mission availability of the EXDIS software.

2.4.10 The Contractor shall define and document specific SCE configurations that support EXDIS operations.

2.4.11 The Contractor shall perform quality assurance checks and modifications on EXDIS data handling to ensure the data is accurate and properly stored.

2.4.12 The Contractor shall check to ensure all data received and entered into the EXDIS system are properly placed to support AFTAC data flows.

2.4.13 The Contractor shall support 21 SURS in defining SCE deployment specific data flows.

2.4.14 The Contractor shall identify and report all data rejected from EXDIS. The Contractor shall notify 21 SURS, other relevant units, and the Contracting Officer’s Representative (COR) of the data rejection and provide support to the Government in correcting the situation.

2.4.15 The Contractor shall assess the accuracy and completeness of the data transferred to EXDIS. The Contractor shall report all deviations to the Government and provide support in resolving the issue. The Contractor shall report these deviations as soon as possible (ASAP) to 21 SURS, other relevant units, and the NDES COR through email, telephone, or in-person.

2.4.16 The Contractor shall monitor vendors of third-party components used in EXDIS software for cybersecurity related bulletins, patches, and updates.

2.4.17 The Contractor shall identify obsolete or unsupported third-party components used in EXDIS software.

2.4.18 The Contractor shall identify, test, and integrate third-party components used in the EXDIS software as necessary to support the stability, cybersecurity, and enhancements to the EXDIS software.

2.4.19 The Contractor shall identify, test, and integrate third-party components to replace obsolete or unsupported third-party components used in EXDIS software.

2.4.20 Upon request, the Contractor will use AFTAC’s CI/CD pipeline to validate EXDIS.

2.4.21 The Contractor will use its CI/CD pipeline to validate EXDIS software updates in preparation for deployment to SCE operational network.

2.4.22 The Contractor shall provide all mutually agreed upon EXDIS operational capability augmentations and/or improvements and mutually agreed upon changes to EXDIS business rules.

2.4.23 The Contractor shall initiate and provide a plan of regularly scheduled SPRINT meetings for all software enhancements.

2.4.24 The Contractor shall pause automated delivery to the SCE upon request.

2.5 Maintenance, Support, and Enhancements to Other IT Systems. (CDRLs A001 – A016)

2.5.1 In the case the Government changes their data management system away from Trackman, LIMS, DASSLE, Workflow, or EXDIS, the Contractor shall support the Government in the transition and deployment of new lab data management software, new tool applications, and cloud-based services.

2.5.2 The Contractor shall update and modify the 24 ANN database to support visualization of data in Google Earth or other Geo-locating software.

2.5.3 The Contractor shall support special projects, data requests and Research and Development (R&D) requests by extracting requested portions of the EXDIS or 24 ANN database for use in other software programs and for approved customers.

2.5.4 The Contractor shall support other AFTAC information technology (IT) operations and maintenance (O&M) efforts to include but not limited to: database maintenance and upgrades, system integration, graphical user interface (GUI) development, and computer modeling efforts.

2.5.5 The Contractor shall maintain the Contractor controlled SCE as a backup to AFTAC’s Development and Production Environments.

2.6 IT Modernization and Integration. (CDRLs A001 – A016)

2.6.1 Upon request, the Contractor shall serve as an IT systems integrator for 24 ANN and / or 21 SURS IT modernization efforts.

2.6.2 Upon request, the Contractor shall assist 24 ANN and / or 21 SURS with IT modernization efforts to include the potential development of a task tracker.

2.7 Security Technical Implementation Guide (STIG) Requirements. (CDRLs A001 – A016)

2.7.1 Upon request, all STIG compliance shall be applied to the relative environment.

2.7.2 Upon request, all system vulnerabilities shall be resolved or mitigated to the fullest extent possible, regardless of requirement category; CAT I, CAT II and CAT III requirements shall be met. Any requirements with unresolved vulnerabilities shall have a documented Plan of Action Milestones (POAM).

2.7.3 All compliance shall be in accordance with the most recent STIG version found on the Information Assurance Support Environment website on the unclassified internet.

2.7.4 All in-progress STIG checklists and any vulnerability scans shall be submitted with the monthly report.

2.7.5 Any system-specific standard operating procedures, system configuration guidance and user configuration guidance shall be incorporated into the monthly report.

2.7.6 The contractor shall meet the intent of the STIG in their own environment.

2.7.7 The contractor shall direct all STIG questions to the 709 SAG ISSO, other relevant unit

ISSO, and the AFTAC ISSM office.

2.7.8 Upon request, the Contractor shall ensure that all software or application tools developed receive and maintain the necessary certification to field (CTF) for AFTAC operational networks by addressing any identified vulnerabilities that prevent network certification.

2.7.9 Upon request, the Contractor shall provide urgent support for software updates in response to any identified security vulnerabilities, especially as EXDIS will be deployed outside the AFTAC firewall.

2.7.10 The Contractor shall provide quick response, urgent support for SCE updates in response to any identified security vulnerabilities.

2.8 Support Software Implementation on AFTAC’s Operational Networks. (CDRLs A001 – A016)

2.8.1 Upon request, the contractor shall support installing, training, testing, and validation of all developed software or application tools using the CI/CD pipeline on AFTAC’s development networks (CDE). The contractor shall provide all necessary files for installation on the CDE and assist with this installation.

2.8.2 The contractor shall support installing, training, testing, and validation of EXDIS software using SCE. The contractor shall provide all necessary files for installation on the SCE and assist with this installation upon request.

2.8.3 The contractor shall make any needed modifications to the code to address all identified software bugs, security vulnerabilities, and agreed upon feature updates.

2.8.4 Upon request, the Contractor shall provide AFTAC with a software product end list, all necessary files, and a plan for installation on AFTAC’s operational networks. The contractor shall also provide all needed assistance to install software or application tools on AFTAC’s operational networks.

2.8.5 Upon request, the Contractor shall provide AFTAC with a complete SCE configuration list, all necessary files, a plan, and all needed assistance for installation on AFTAC’s operational cloud.

2.8.6 The Contractor shall provide an initial software test plan. The contractor shall include acceptance test procedure in the software test plan.

2.9 Support the Portability of Software to Other IT Systems (CDRLs A001 – A016)

2.9.1 Upon request, the contractor shall maintain an offsite development environment as a backup to AFTAC’s Development and Production Environments.

2.9.2 Upon request, the contractor shall maintain the Contractor controlled Government approved SCE as a backup to AFTAC’s Development and Production Environments.

2.9.3 In case the Government changes their data management system away from a software solution, the Contractor shall support the Government in the transition and support new data management software.

2.9.4 The Contractor shall support special projects and other data request by extracting requested portions of the database for use in other software programs and for approved customers.

2.10 Continue the Operational Augmentation and/or Enhancement of Software (CDRLs A001 – A016)

2.10.1 The Contractor shall provide all mutually agreed upon operational capability augmentations and/or improvements and mutually agreed upon changes to business rules built with the software.

2.10.2 The Contractor shall initiate and provide a plan of regularly scheduled SPRINT deliveries for all software enhancements.

2.10.3 Software SPRINTs shall be delivered according to the Contractor-provided schedule that is approved by the Government.

2.10.4 The Contractor shall include SCE configuration, cybersecurity and delivery schedules into SPRINT planning.

2.11 Provide Training on Software or Application Tools. (CDRLs A001 – A003, A006 – A010, A12)

2.11.1 The contractor shall provide training to ensure that 21 SURS, 24 ANN, other AFTAC units, and external personnel permitted by the Government are fully able to use any software or applications tools that are developed under this contract. This includes additional training to familiarize the personnel of 21 SURS, 24 ANN or other AFTAC units with any new or modified software or application tool features and on usage of the system and applicable Business Rules.

2.11.2 Upon request, the Contractor shall develop specific training for the SCE environment that highlights the differences between AFTAC CPE and cloud deployment.

2.11.3 The Contractor shall provide copies of all training materials to include briefs and training data sets to the Government. The Government has unlimited data rights to any training materials developed under this contract.

2.12 Program Management. (CDRLs A001 – A016)

2.12.1 The Contractor shall promote full and open communication between AFTAC personnel and personnel from the Contractor. The Contractor shall perform management tasks to plan, organize, control, integrate, host and execute contractual requirements.

2.12.2 The Contractor shall host regularly scheduled status report meetings, at least once per Government fiscal quarter, with 21 SURS, 24 ANN and other AFTAC parties of interest.

2.12.3 The Contractor shall meet with 21 SURS, 24 ANN and other AFTAC parties of interest on an ad-hoc basis as necessary to address important and/or time-sensitive issues.

2.12.4 Upon request, the Contractor shall conduct formal Program Management Reviews (PMRs) every three months. In these reviews, the Contractor shall identify on-going tasks with associated schedules and expenditures to date, planned actions, staffing information and any difficulties encountered in performing work. The Contractor shall provide a draft agenda and draft presentation materials to the Government no later than three business days prior to each PMR.

2.12.5 The Contractor shall prepare and deliver monthly program status reports (MSR). The status report shall include a description of all work efforts performed during the month for all PWS tasks. The MSR shall include a status of all data deliverables for the reporting period.

2.12.6 The Contractor shall implement and maintain a data delivery and tracking system as documented in a Contractor Data Management Plan (DMP). The Contractor shall conduct internal data reviews to ensure all deliverable data conforms to Government Contracts Deliverable Requirements List (CDRL) requirements. The Contractor shall make all technical data available for review by the Government Contracting Officer’s Representative (COR). The Contractor shall prepare data for delivery to the Government. The Contractor shall supply technical documentation to the Government identified with (at a minimum) title, document number, revision, and date. The Government will have unlimited rights to use, duplicate or disclose all deliverable data, in whole or in part.

2.12.7 The Contractor shall update and maintain the following list of User and Administrator manuals and documentation and provide deliverables to the Government. All updates shall be provided as required to maintain document currency. The Government has unlimited data rights to any system manuals developed under this contract.

2.12.7.1 Technical Application Manuals and Technical User Manuals

2.12.7.2 Application Administrator Manuals

2.12.7.3 Installation, Operation, and Repair Manuals

2.12.7.4 Application Install and Configuration Manuals

2.12.8 The Contractor shall identify to the Government, prior to incorporation into any IT system, any software or hardware without unlimited rights. The Contractor shall not use or deliver any proprietary computer hardware or software for the integration, operation, or maintenance of IT systems without prior written Government PM or COR approval.

The Contractor shall obtain and furnish to the Government copyright releases for all COTS products and provide copyright releases for all software and documentation generated by the Contractor as a result of this contract. The Contractor shall not incur any license fees, agreements, or other limitations on the use of proprietary resources without prior Government PM or COR approval. The Contractor shall identify proprietary and licensing material at PM reviews.

2.12.9 Records management oversight of a Contractor’s records is necessary to ensure Air Force records keeping requirements are met. All records created as a result of processes prescribed in the PWS shall be maintained in accordance with AFMAN 33-363, Management of Records, AFI 33-364, Records Disposition-Procedures and Responsibilities, the Air Force Electronic Records Management Solution, AFTAC’s supplements to each of the forementioned publications, and are disposed of in accordance with the Air Force Records Disposition Schedule. At the conclusion/termination of this effort, all records shall be returned to the Air Force Office of Primary Responsibility (OPR) for proper disposition. Contractors who create and receive official records on behalf of the Air Force and are performing records management support are referred to as records professionals. Contractor records professionals shall be appointed in writing to the AFTAC Rcords Manager and shall meet the training and performance requirements identified in AFI 33-322, Records Management Program and applicable AFTAC supplement. Contact the AFTAC Records Manager for specific guidance and procedures.

SECTION 3

3 SERVICES SUMMARY (SS).

The contract service requirements are summarized in performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The Services Summary (SS) provides information on contract requirements and the expected level of Contractor performance to be successful. These thresholds are critical to mission success. Procedures as set forth in the applicable Inspection clause in the contract will be used to remedy all deficiencies. The Government retains the right to inspect any item included in the contract.

Performance Objective PWS PARA Performance Threshold

SS #1

The contractor shall develop and provide all deliverables per each attached CDRL. The contractor shall focus on timeliness, content, and quality for each deliverable product.

2.1-2.12 The contractor shall provide all deliverables on-time IAW CDRLs.

SS #2

Operating Criteria

2.1-2.12 All software, hardware and applications shall operate with full functionality after software installation and validation, during normal duty hours, 95% of the time or greater. This will be monitored on a monthly basis. All system malfunctions shall be resolved within 48 hours of identification.

SS #3

The Contractor shall deliver all required documentation for software updates.

2.1-2.12 STP and STR documentation shall meet submission dates as specified IAW CDRL.

SS #4

Response to software vulnerabilities

2.1-2.12 95% of the time the contractor shall provide an estimated timeline for an expedited vulnerability response within 1 calendar day of vulnerability notification.

The other 5% of the time the response shall be with 3 days.

SECTION 4

4 GOVERNMENT FURNISHED PROPERTY AND SERVICES.

4.1 Services.

The Government will meet with the Contractor to demonstrate software functionality, explanation of official guidance, and other areas to acquaint the Contractor with AFTAC data management systems.

4.2 Facilities.

The Government will provide up to two (2) workstations at AFTAC with telephone and NIPR and AFTAC secure network access. AFTAC’s Common Development Environment (CDE) networks will be available to install and test software before migrating to production/operational systems.

4.3 Utilities.

The Government will not provide any direct utility support.

4.4 Equipment.

The Government will provide servers, personal computers, executables, software and database code listed in table in Appendix C.

4.5 Materials.

The Government will not provide any additional material outside of items listed in Appendix C.

4.6 Information.

The Government will provide software and database code listed in table in Appendix C.

SECTION 5

5 GENERAL INFORMATION.

5.1 Special IT Requirements.

All IT products (requirements and solutions), to include software, hardware, processes and security products delivered to AFTAC as a requirement of this PWS shall adhere to the AFTAC IT and Platform standards. Hardware, infrastructure, storage, and database requirements must be identified as soon as possible and presented to the Change Management Board for approval.

This program expects the adoption and execution of the Preferred Agile Framework outlined by the Department of the Air Force, ensuring an architectural framework that can be adjusted throughout the period of performance. If feasible, adopting existing applications, components, and platforms is preferred over creating custom solutions.

Software development shall make good faith efforts to align software solutions to the AFTAC Software Development Strategy Document (SDSD) where supported, to include software security and quality considerations. Any deviations shall be presented to the Change Management Board as soon as they are identified. (Reference Appendix D, “Software Development Strategy Document”).

All software developed for AFTAC, except software, hardware, infrastructure, processes and services that cannot be supported such as High Performance Computing (HPC), will first be installed and tested in a development environment such as the Common Development Environment (CDE) at the appropriate classification level. For any software project that cannot be supported by the CDE, the project plan will be presented and approved by the appropriate Change Management Board. The contractor shall integrate software deliveries into AFTAC’s Continuous Integration (CI) pipelines, and provide on-site support for installation and configuration of software deliverables on AFTAC’s development and production networks. The contractor shall perform tasks to provide technical documentation and develop accreditation packages for NDES systems, whether residing at an AFTAC facility, at the contractor facility, or in a cloud computing environment. The contractor shall also provide support to install and configure any middleware necessary to run the delivered software. Some software will remain in the CDE indefinitely. This software is intended for installation in the Common Production Environment (CPE). The Contractor shall provide documentation as requested to support certification and accreditation processes as needed.

Software deliveries shall consist of source code of noncommercial software (except where such source code is unavailable), all software dependencies, unit tests, related data, and associated license rights that are necessary across the life-cycle of that software, including development, testing, operations, and maintenance as specified by CDRL’s. This includes all artifacts necessary to reproduce, build, or recompile the software from its source code and required software libraries;

to conduct required software testing; and to deploy on relevant system hardware as specified by CDRL’s. Binaries or executables without source code, unless identified as Commercial Off the

Shelf (COTS) with support or Government Off the Shelf (GOTS) software with restricted source code releasability, are not an acceptable delivery.

All software deliveries are complete after integration into AFTAC’s CI Pipelines, installed and running in the CDE if the appropriate environment exists, and contain clean security scans (to include source code scans, third-party dependency scans, and ACAS scans) if intended for the operational environment. Onsite support for installation onto CDE and production/operational networks may be required, as well as assistance with integration and system testing efforts. The final software product is considered completed once it can be run by a Government employee on AFTAC systems and it produces the results for which the software was developed.

The Contractor shall provide software changes and problem fixes as needed to support the operations, maintenance, sustainment, and integration of systems. The contractor shall provide to the Government all developed, modified, or converted source modules, processes, programs, scripts, operating instructions, databases, system files, documentation, test files and test conditions used to develop each approved systems change request. When specified by the Government, the contractor shall participate with the Government in testing the system. The Contractor shall provide documentation as requested to support certification and accreditation processes as needed.

5.2 DevSecOps as a Service and Agile Software Development

Contractor shall perform DevSecOps-as-a-Service (DaaS) for the USAF, where the government purchases the time and talent of software teams comprised of product managers, user-centric design specialists, and a mix of senior, mid-tier, and junior software engineers, adjusting composition as requirements dictate, to engage in customer discovery and user centered design with AFTAC operations, and continuously design/develop or assess/deploy non-proprietary, Unlimited rights, DevSecOps accredited software onto AFTAC software development platform(s), and others at the direction of the U.S. Government. The Contractor, along with AFTAC will operate on a sprint methodology over the course of the Period of Performance. The product team shall provide architecture and design support that is consistent with continuously evolving AFTAC platform(s) and maintain a modular testing framework to maintain at least 70% test code coverage for newly developed code. The Contractor product team shall improve upon existing software baselines while also continuously engaging end-users to provide feedback to influence future operational software development sprints. The Contractor shall use Agile frameworks such as Kanban and Scrum, or others as agreed to by the Government, as needed, and shall ensure all product backlogs are properly defined and sized. The Product Owner (AFTAC) will provide product backlog prioritization and grooming as needed. The Contractor shall NOT use the Scale Agile Framework (SAFe). The Contractor, along with AFTAC, shall foster an Agile environment where needs can and often will change.

5.3 Contractor Identification in the Government Workplace.

When conversing with Government personnel during business meetings, over the telephone or via electronic mail, the Contractor shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. The Contractor shall identify themselves on any attendance sheet or any coordination documents they may review.

Electronic mail signature blocks shall identify their company affiliation.

5.4 Industrial Security.

5.4.1 DD Form 254. Overarching security requirements and Contractor access to classified information shall be as specified in the DD Form 254, Department of Defense Security Classification attached to the contract. The Contractor shall have a final U.S.

Government issued TOP SECRET (TS//SCI) security clearance and be DCID 6/4 eligible with a current Single Scope Background Investigation (SSBI) upon award of contract.

5.5 Physical Security.

The Contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, property, and materials shall be secured.

5.5.1 Key Control. The Contractor shall establish and implement methods of ensuring that all badges issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

5.5.1.1 The Contractor shall immediately report the occurrences of a lost or duplicate badges to the COR.

5.5.1.2 The Contractor shall prohibit the use of badges issued by the Government by any persons other than the contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor’s employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

5.5.2 Combinations and Codes. The Contractor shall establish and implement methods to ensure all combinations and codes are not revealed to unauthorized persons. The Contractor shall ensure lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

5.5.2.1 Access lock combinations are “For Official Use Only” and shall be protected from unauthorized personnel.

5.5.2.2 Combinations to security containers, secure rooms, or vaults are classified information and shall be properly safeguarded. Only the Contractor employees with proper security clearance and need-to-know will be given combinations to security containers, secure rooms, or vaults.

5.5.2.3 Security alarm access codes shall be protected from unauthorized personnel. Security alarm access codes will be given to Contractor employees who require entry into areas with security alarms. The Contractor shall properly safeguard alarm access codes to prevent unauthorized disclosure.

5.6 Privacy Act.

Work on this contract requires the contractor to have access to Privacy Information. The contractor shall adhere to the Privacy Act, Title 5 of the US Code, Section 552a and applicable Agency rules and regulations.

5.7 Location(s) of Work.

The work to be performed under this contract shall be performed at Government, Contractor facilities, and facilities designated as Contractor work locations. In all cases the Contractor shall ensure all required security procedures are being implemented and maintained.

5.8 Hours of Operation.

5.8.1 Normal Hours of Operation. The contractor shall perform the services required under this contract during the following hours: Mon - Fri, 0800-1700, except federal holidays.

5.8.2 Recognized Holidays. The contractor is not required to provide services on the following days:

New Year’s Day Labor Day Dr. Martin Luther King’s Birthday Columbus Day Presidents’ Day Veterans Day Memorial Day Thanksgiving Day Juneteenth Independence Day Christmas Day

5.8.3 If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a

Sunday, it is observed on Monday.

5.9 Records.

The contractor shall create, maintain and dispose of only those Government required records that are specifically cited in this PWS or required by the provisions of a mandatory directive listed in Appendix C, Applicable Publications & Instructions. If requested by the Government, the contractor shall provide the original record, or a reproducible copy of any such record within five

(5) workdays of receipt of the request.

5.10 Contractor Manpower Data Reporting.

5.10.1 Effective FY2020, the Department of Defense will no longer require contractors to report into the Enterprise-wide Contractor Reporting Application (eCMRA). For FY 2020, contractors shall begin reporting manpower data relating to the performance services contracts into the System for Award Management (www.sam.gov).

5.10.2 The following contracts are subject to Service Contract Reporting (SCR): Any purchase of services by a military department or Defense Agency, in excess of $3 Million, for services in the following Service Acquisition Portfolios:

5.10.2.1 Logistics management services;

5.10.2.2 Equipment related services;

5.10.2.3 Knowledge-based services;

5.10.2.4 Electronics & comms services.

5.10.3 SAM receives contract information from FPDS-NG. It will only enable reporting for entities with contracts that meet the above stated SCR thresholds.

5.10.4 Contractor shall be an entity registered in SAM, an individual SAM user account with the Entity Administrator, Entity Registration Representative, or Reporter role for that entity, and one or more contracts awarded to that entity which meet the SCR reporting thresholds.

5.10.5 Steps for Submitting a Service Contract Report (SCR).

5.10.5.1 Go to www.sam.gov and log in.

5.10.5.2 Select Entity Registrations and then select Service Contract Reporting.

5.10.5.3 SAM displays your entities which have service contracts and meet the reporting criteria.

Select View by entity to see the service contracts for each entity.

5.10.5.4 Next, select Add for the service contract against which you want to create a Service

Contract Report. Each service contract which meets the FAR Subpart 4.1703 reporting thresholds is displayed.

5.10.5.5 Next, the Complete Service Contract Report page will be displayed. SAM displays the contract details and allows you to report. Contractor is required to enter the following information:

5.10.5.5.1 Total Amount Invoiced: Total dollar amount invoiced for services performed during the previous Government fiscal year under the contract (this amount should include the prime and any subcontract amount).

5.10.5.5.2 Prime Contractor Hours Expended: Prime contractor direct labor hours expended on the services performed during the previous Government fiscal year. The amount you enter is automatically divided by 2,080 hours to calculate a Full Time Employee (FTE) equivalent, displayed under the Prime Contractor Hours Expended as Prime Contractor FTEs.

http://www.sam.gov/

5.10.5.6 Report any required Tier 1 subcontractor information by selecting the Add Tier 1 Subcontract Information button.

5.10.5.7 When you are ready to submit the report, select Submit. This saves your report and returns you to the Select Service Contract page where you can create other SCRs or edit an existing SCR.

5.10.6 Annual Reporting. Reporting inputs will be for the direct labor executed during the period of performance (PoP) for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor shall provide reporting inputs for the final PoP of this contract no later than 30 calendar days after contract expiration. The contractor may direct technical questions about the SAM Service Contract Reporting tool to the Federal Service Desk FSD at https://www.fsd.gov/fsd-gov/home.do

5.11 Safety Requirements.

In performing work under this contract, the Contractor shall:

5.11.1 Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

5.11.2 Take such additional immediate precautions as the CO may reasonably require for safety and mishap prevention purposes.

5.11.3 Record and report promptly (within one hour) to the CO or COR, all available facts relating to each instance of damage to Government property or injury to either contractor or Government personnel.

5.11.4 In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the CO.

5.11.5 If the Government elects to conduct an investigation of the accident/mishap, the Contractor shall cooperate fully and support Government personnel conducting the investigation.

5.12 Contractor Personnel Training.

The Government will provide all training required for access to AFTAC and for use of its networks. The Government will provide informal training to illustrate the functions and features of Trackman and LIMS, DASSLE, Workflow, EXDIS, and any new software tools and applications developed on this contract.

https://www.fsd.gov/fsd-gov/home.do

5.13 Special Training, Certifications and Qualifications.

5.13.1 Contractor personnel requiring access to a DoD Information System shall receive initial…