DRAFT Global Operations Support PWS_RM_v2.pdf

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

SOURCE SELECTION INFORMATION – SEE FAR 2.101 AND 3.104

DEPARTMENT OF DEFENSE EDUCATION ACTIVITY (DoDEA)

PERFORMANCE WORK STATEMENT (PWS)

FOR

DoDEA - IT Global Operations

1.0 Introduction – Section

This Performance Work Statement is written in broad terms (scope) to meet current and future DoDEA

Information Technology requirements as directed through the DoD-CIO or Executive Order(s).

1.1 Background - Subsection

The Department of Defense Education Activity (DoDEA), one of only two federally operated school systems, is responsible for planning, directing, coordinating, and managing pre-kindergarten through

12th-grade educational programs for the Department of Defense (DoD). Globally positioned, DoDEA operates 160 accredited schools in 9districts located in 11 foreign countries, 7 states, Guam, and Puerto

Rico, employing approximately 11,828 staff members to serve over 69,000 children of active-duty military and DoD civilian families.

DoDEA is dedicated to providing a world-class education that prepares school-aged children of military families for post-secondary education and/or career success, and for being active contributors in a 21st-century global society. DoDEA operates as a field activity of the Office of the Secretary of Defense

(Personnel and Readiness), overseen by a Director at DoDEA headquarters in Alexandria, Virginia.

Schools are organized into three geographic areas: Europe, the Pacific, and the Americas.

1.2 Scope - Subsection

Contractors shall provide comprehensive Information Technology Support Services (ITSS) to sustain and enhance DoDEA’s global IT and cybersecurity operations. This includes but is not limited to delivering hardware, software, and services that enable implementation, monitoring, management, and ongoing technical support for enterprise cybersecurity, application development, device management, network operations, cloud administration, agile project management, requirements analysis, and technical documentation. Solutions shall incorporate advanced capabilities such as Artificial Intelligence and

Machine Learning for predictive analytics and automation, Zero Trust Architecture for robust security, and emerging technologies including Secure Access Service Edge (SASE), DevSecOps practices, and advanced data analytics to ensure resilience, scalability, and modernization across all environments.

Contractors shall deliver solutions that ensure compliance with federal and Department of Defense cybersecurity requirements, including DoD Zero Trust, DoDI 8510.01, NIST 800-53, and DoDEA-specific mandates. Services shall support accelerated timelines and evolving mission needs, providing centralized visibility, proactive defense, and operational resilience across all DoDEA information systems and environments. The approach must enable continuous improvement, adaptability to emerging threats, and alignment with DoD enterprise security strategies to safeguard mission-critical operations globally.

The contractor’s responsibilities include, but are not limited to:

• Sustaining 24x7 Security Operations Center (SOC) support for continuous monitoring, detection, and response to cyber threats.

• Delivering full lifecycle application development and DevSecOps, ensuring secure, scalable, and compliant solutions.

• Managing endpoint, mobile, and IoT devices to maintain enterprise configuration baselines and device integrity.

• Operating and optimizing network infrastructure, including SD-WAN, LAN, wireless, firewall, and cloud networking.

• Administering cloud services and identity management for Google Workspace and Microsoft

Azure environments.

• Coordinating Agile project management, business case development, requirements analysis, and technical writing to support DoDEA’s mission objectives.

All services shall be delivered using a performance-based approach, with measurable standards and quality levels defined in the Performance Requirements Summary (PRS) and Quality Assurance

Surveillance Plan (QASP).

2.0 Requirement Objectives - Section

(Objective #1) 2.1 Security Operations Center (SOC) Support

Performance Outcome: DoDEA achieves an integrated, enterprise cybersecurity capability that sustains and enhances global operations, scales to mission and surge demands, and provides continuous, centralized visibility into risk, threats, events, and incidents. The capability must enable leadership to make informed, priority-based decisions and maintain maturity consistent with DoD Zero Trust, DoDI

8510.01 (RMF), and other applicable DoD frameworks, resulting in proactive defense through threat hunting, vulnerability management, and advanced analytics across all DoDEA information systems.

Supporting Tasks for Requirement Objective 1:

The contractor shall deliver the following supporting tasks that are outcome focused.

24x7 SOC Operations (Tier 1-3):

• Maintain uninterrupted SOC coverage to monitor, detect, investigate, and respond to security incidents across endpoints, networks, cloud platforms, and OT/IoT devices.

• Ensure surge capacity during high-volume event periods without degradation of service.

Tier 1 Monitoring & Triage:

• Use Microsoft Sentinel dashboards, analytics rules, and workbooks to identify and triage potential security events.

• Leverage Microsoft Defender dashboards and Azure Data Explorer for enrichment.

• Classify alerts by severity and mission impact; escalate incidents per SOPs.

• Log all events in the enterprise case management system and execute basic containment actions

(e.g., account lockouts, IP blocking, endpoint isolation).

Tier 2 Investigation & Threat Hunting:

• Conduct deeper investigations using Microsoft Sentinel hunting queries (KQL) and endpoint telemetry.

• Perform proactive threat hunting using DoD, DISA, and CISA threat intelligence feeds.

• Analyze vulnerabilities for exploitation risk and coordinate advanced containment measures

(e.g., quarantine infected hosts, disabling compromised accounts).

• Collect forensic data per DoD evidence handling standards.

Tier 3 Advanced Response:

• Execute advanced incident response, including root cause analysis, full forensic investigations, malware reverse engineering, and hypothesis-driven threat hunting based on emerging TTPs

• Integrate threat intelligence sources into detection engineering and investigations.

Detection Engineering & Continuous Improvement:

• Develop and implement custom Microsoft Sentinel Analytics rules, hunting queries, and EDR detection policies.

• Continuously improve detection and response capabilities based on lessons learned and threat trends.

Exercise & Readiness Validation:

• Lead and participate in purple team and tabletop exercises to validate SOC readiness and enhance detection capabilities.

• Coordinate with NOC, engineering, operations, and development teams.

Reporting & Dashboards:

• Develop and maintain dashboards showing SOC KPIs and metrics, including:

o Incidents opened and closed o Mean Time to Detect (MTTD) o Mean Time to Respond (MTTR) o False positive rate

Performance Standards & Acceptable Quality Levels (AQLs)

Performance Area Metric Standard AQL

SOC Availability Uptime of monitoring capability

≥99.9% monthly

99.9%

Alert Triage Timeliness Mean Time to Triage

(MTTT) critical alerts

≤15 minutes

95%

Incident Report

Mean Time to Contain

(MTTC) critical incidents

≤ 2 hours

Detection Accuracy False positive rate for critical alerts

≤5% 95%

Threat Hunting

Cadence

Targeted hunts per week

≥ 2 hunts/week 95%

Reporting

Completeness

KPI dashboard updates 100% monthly 100%

Deliverables

• SOC Operations Plan (within 30 days): Roles, escalation paths, tool integration, surge plan

• Monthly SOC Performance Report: Metrics (MTTD, MTTR, uptime, false positive rate), incident summaries.

• Incident Reports: Detailed documentation for Priority ½ incidents.

• Threat Hunting Reports: Biweekly finding and detection improvements.

• Detection Engineering Updates: Monthly list of new/updated Sentinel rules and EDR policies.

• Exercise Reports: After-action reports for purple team and tabletop exercises.

• Dashboards: Real-time SOC KPIs accessible to DoDEA leadership.

(Objective #2) 2.2 DevSecOps and Cloud-Native Application Development:

Performance Outcome: Deliver secure, reliable, scalable applications that meet DoDEA mission needs through disciplined, modern SDLC practices (requirements, design, development, testing, deployment, testing, development, maintenance, and enhancement), while ensuring all deliverables comply with

DoD/DoDEA security requirements and are fully owned by DoDEA IT.

Supporting Tasks for Requirement (Objective #2):

The contractor shall deliver the following supporting tasks that are outcome focused.

Requirements & Design

• Elicit, analyze, and document functional and non-functional requirements (security, performance, availability, usability, interoperability).

• Produce architecture/design artifacts and address security-by-design (e.g., least privilege, secure coding, data, protection, threat modeling) and scalability (horizontal/vertical scaling, capacity planning).

• Maintain traceability from requirements → design → test cases → deliverables.

• Produce architecture/design artifacts that address security-by-design, including Zero Trust principles such as least privilege, micro-segmentation, and continuous authentication.

Development

• Implement features using supported technologies (including but not limited to AngularJS, .NET, SQL, HTML, CSS, JavaScript, C#) and approved frameworks/libraries.

• Adhere to secure coding standards (e.g., input validation, output encoding, authentication/authorization, logging/monitoring.

• Ensure application components integrate with Zero Trust identity and access management (IAM) solutions.

• Integrate automated builds, unit tests, SAST/DAST scans, and code quality checks in a CI/CD pipeline.

Testing & Quality Assurance

• Execute a comprehensive test strategy that includes verification of Zero Trust controls such as identity validation, session integrity, and access restrictions (unit, integration, system, performance, security, accessibility, and user acceptance testing).

• Maintain test coverage thresholds and defect management (severity-based SLAs).

• Validate against DoD/DoDEA security controls and applicable STIGs for the technology stack.

Deployment & Operations

• Package and deploy applications via automated pipelines, with rollback strategies and environment parity (dev/test/stage/prod).

• Apply Zero Trust principles to deployment pipelines and runtime environments.

• Instrument applications with telemetry, logging, and application performance monitoring (APM) for operational visibility.

Maintenance & Enhancements

• Provide sustainment (bug fixes, security patches, minor/major enhancements) with defined SLAs and release cadence.

• Manage technical debt with backlog hygiene, refactoring plans and periodic architecture reviews’.

• Ensure all enhancements preserve Zero Trust principles, including re-validation of access controls and continuous monitoring.

Security & Compliance

• Embed DevSecOps and Zero Trust practices across the SDLC, aligning to DoD/DODEA policies, relevant STIGs, and secure development requirements.

• Remediate vulnerabilities within defined timelines based on severity and mission impact.

Property & Rights

• All software, source code, documentation, test assets, scripts, pipelines, and related artifacts created under this task order are the sole property of DoDEA IT. The contractor shall deliver complete, buildable sources and supporting artifacts to DoDEA repositories.

Performance Standards & Acceptable Quality Levels (AQLs)

Performance Area Metric Standard AQL

Requirements

Traceability

% of features/test cases mapped to requirements

100% traceability

98% monthly

Security-by-Design

Artifacts

Releases with security artifacts

100% of releases touching sensitive data/identity

≥ 95%

Static Code Quality

% of code passing quality gates

95% of code passes configured gates

95% per release

Automated Test

Coverage

Unit/integration coverage for critical services

≥ 80% unit; ≥ 70% integration

Monthly adherence

Build Success Rate

Successful builds on main branch

≥ 98%

Vulnerability

Remediation

Critical vulnerabilities fixed within SLA

≤ 30 calendar days

≥ 90% compliance

Defect Density

Critical/high defects in

UAT

≤ 1 per 1,000 LOC or ≤ agreed threshold

Change Failure Rate

Releases requiring emergency rollback/hotfix

≤ 10%

Quarterly adherence

Deployment Frequency

Release cadence for active products

≥ biweekly (unless mission constraints)

Lead Time Changes

Median time from commit to production

≤ 7 days standard; ≤ 24 hrs emergency

Service Availability

Uptime for mission-critical apps

≥ 99.9% monthly

Deliverable

Completeness

Code, build scripts, configs, guides, reports

100% complete and approved prior to release

100% per release

Deliverables

• SDLC Management Plan (within 30 days): Governance roles, environments, CI/CD, quality gates, security controls, branching/release strategy

• Requirements Artifacts: BRDs/PRDs, user stories, acceptance criteria, traceability matrix

• Design & Architecture Artifacts: Diagrams, threat models, APIs, data models, integration contracts, scalability/capacity plans.

• Source Code & Build Assets: Full source, build scripts, dependency manifests, container/IaC definitions, CI/CD pipelines.

• Test Assets & Reports: Automated test suites, coverage reports, SAST/DAST results, performance/accessibility findings. UAT sign off.

• Release Packages & Deployment Guides: Versioned releases with rollback procedures and change tickets.

• Operational Docs: Runbooks, playbooks, monitoring/alerting configs, on-call rotations.

• Security & Compliance Evidence: STIG checklists (as applicable), vulnerability remediation logs, risk acceptance records, control implementation evidence.

• Maintenance & Enhancement Plan: Backlog, release roadmap, SLA commitments, technical debt remediation plan.

• IP Transfer & Repository Confirmation: Written confirmation that all artifacts are delivered to and owned by DoDEA IT, with access to DoDEA-controlled repositories.

(Objective #3) 2.3 Enterprise Device Management Support

Performance Outcome: Deliver an integrated enterprise device management capability to support the full lifecycle of endpoint, mobile, and IoT devices across its global environment. This approach must align with DoD Zero Trust Strategy, DoDI 8510.01, NIST 800-53, and DoD STIG requirements to ensure centralized visibility, continuous verification, and operational resilience. The contractor will implement, sustain, and optimize modern endpoint management technologies (e.g., Microsoft Intune, Entra ID, Apple

School Manager, ChromeOS, and IoT platforms) to achieve a unified device management architecture.

Services shall enforce Zero Trust principles by validating every device, user, and application interaction, applying least privilege access, and maintaining dynamic policy enforcement. The objective is to provide continuous assurance of device integrity, enforce enterprise configuration baselines, reduce vulnerabilities, and ensure seamless user experience for DoDEA’s global workforce and student population.

The contractor shall deliver the following supporting tasks that are outcome focused.

Supporting Tasks for Requirement (Objective #3):

• Microsoft Intune Administration:

Configure and administer Intune for Windows endpoints, enforcing Zero Trust posture through compliance policies, conditional access, and continuous device health validation.

Noncompliant endpoints must be quarantined or remediated within defined timelines.

• Application Packaging & Deployment:

Package and deploy applications using approved formats with automation scripts.

Validate application integrity and enforce Zero Trust by requiring signed packages and verifying identity before installation.

• Device Enrollment & Policy Enforcement:

Manage enrollment through Intune, Entra ID, and Autopilot with Zero Trust controls, ensuring identity verification, secure boot, and policy application before granting network access.

• ChromeOS Management:

Apply Zero Trust principles by enforcing device compliance checks, secure configurations, and continuous monitoring for ChromeOS endpoints supporting assessment platforms.

• Apple Device Management:

Administer Apple School Manager and MDM platforms with Zero Trust enforcement, including certificate-based authentication, STIG compliance, and dynamic policy updates for iOS devices.

• OS & Office Updates:

Manage updates via WUfB and C2R with Zero Trust validation, ensuring only trusted sources and verified identities initiate updates. Monitor compliance and block outdated or vulnerable versions.

• Reporting & Analytics:

Generate compliance and security posture reports that reflect Zero Trust metrics (e.g., device trust scores, conditional access enforcement) and deliver dashboards for leadership visibility.

• Tier 2 Escalation Support:

Resolve endpoint issues while maintaining Zero Trust principles, ensuring remediation actions do not bypass identity or compliance checks.

• IoT Device Management:

Apply Zero Trust to IoT by enforcing device identity verification, firmware integrity checks, and segmentation to prevent lateral movement within the network.

• Security Baseline Enforcement:

Continuously enforce Zero Trust standards through STIGs, Intune policies, and conditional access, including certificate management, vulnerability monitoring, and least privilege enforcement.

Requirements Traceability

% of features mapped to approved requirements

100% traceability

≥98% Secure Coding Compliance % of code passing security scans

(SAST/DAST)

100% before release

≥95% CI/CD Pipeline Reliability Build success rate ≥98% of successful builds ≥98%

Test Coverage

Unit/integration coverage

≥80% unit; ≥70% integration

95%≥

Vulnerability Remediation

Critical vulnerabilities fixed within SLA

≤ 15 days

95%≥ Deployment Frequency Release cadence ≥ biweekly for active products

≥90%

Documentation

Completeness Deliverables approved prior to

100%

Microsoft Intune

Administration

% of endpoints compliant with Zero

Trust posture

100% of managed endpoints meet compliance policies; noncompliant devices compliance;

remediation within 48 hrs

Application Packaging

Successful deployment of signed application packages

100% of applications deployed using approved formats with identity verification and Zero Trust validation

98% success rate; failures resolved within 24 hrs

Device Enrollment & Policy

Enforcement

Enrollment success rate and policy application

100% of devices enrolled with secure boot and policy enforcement before network access

97% enrollment success;

remediation

ChromeOS Management

Compliance checks and secure configuration enforcement

All ChromeOS devices meet

DoDEA security baselines and Zero Trust controls within 48 hrs

Apple Device Management

STIG compliance and certificate-based authentication

100% of iOS devices enrolled with STIG enforcement and dynamic policy updates within 48 hrs

OS & Office Updates

Compliance checks and secure configuration enforcement

100% of updates applied from trusted sources; outdated versions blocked

98% success rate;

Reporting & Analytics

Timeliness and accuracy of compliance/security posture reports

Reports delivered monthly with accurate Zero Trust metrics (device trust scores, conditional access enforcement)

100% on-time delivery;

≤2% data error margin

• Detailed implementation roadmap aligning with DoD Zero Trust principles, DoDI

8510.01, NIST 800-53, and DoD STIG requirements.

• Intune configuration profiles, compliance policies, security baselines, and firewall rule set

• Packaged enterprise and instructional applications (XML, LOB, MSI) with automation scripts and version control documentation.

• Documentation of device enrollment success rates, policy application status, and remediation actions.

• Upgrade approval logs, MAC whitelisting records, and compatibility validation reports for assessment platforms.

• ASM workflows, provisioning scripts, app assignment records, and STIG compliance checklists.

• Reports on OS and Office update rollout schedules, patch compliance metrics, and troubleshooting logs.

• Dashboards and/or Excel reports showing device compliance, Zero Trust posture, enrollment trends, and update status.

• Incident resolution documentation, Intune log analysis reports, and recurring issue mitigation plans.

• Firmware update logs, provisioning documentation, monitoring alerts, and SIEM integration reports.

• Certificates management records, vulnerability scan results, and conditional access enforcement reports.

• User guides, technical manuals, security specifications, privacy policies, and operational procedures for all managed platforms.

(Objective #4) 2.4 Enterprise Network Operations Center (NOC) Support

Performance Outcome: Provide comprehensive Enterprise NOC support that ensures the reliability, performance, security, and resilience of DoDEA’s global network infrastructure, covering SD-WAN, campus LAN, wireless, firewall cloud networking, and IoT/OT systems. The capability will deliver advanced diagnostics, proactive monitoring, and lifecycle management aligned with DoD cybersecurity and operational standards (e.g., DoD Zerto Trust, DoDI 8510.01/RMF, NIST SP 800-53, and DoD

STIGs), enabling uninterrupted mission-critical services for DoDEA’s worldwide user base.

Supporting Tasks for Requirement (Objective #4):

The contractor shall deliver the following supporting tasks that are outcome focused.

SD-WAN Management

• Maintain resilient connectivity between global sites through optimized SD-WAN policies, link health monitoring, traffic engineering, and integrated security services.

• Ensure automated failover and policy compliance across all SD-WAN nodes.

LAN Lifecycle Management

• Provide secure, reliable campus and data center connectivity with advanced switch configuration, VLAN segmentation, and Zero Trust enforcement.

• Maintain QoS prioritization for mission-critical applications and voice/video traffic.

• Perform continuous patching and firmware updates validated against DoD baselines

Wireless Network Optimization

• Administer Aruba WLAN infrastructure with RF tuning, dynamic segmentation, and strong authentication (ClearPass, PKI, CAC)

• Monitor and optimize WLAN performance using Aruba Air Wave/Central Telemetry

Firewall Management

• Enforce Zero Trust security with optimized rule bases, advanced threat prevention, SSL/TLS decryption, and HA clustering.

• Maintain compliance with STIG/NIST controls and integrate telemetry with SIEM

Cloud Networking

• Implement secure routing, encrypted tunnels, and micro-segmentation across public, private, and hybrid environments.

• Integrate IAM with conditional access and enforce continuous verification.

• Deploy WAF, DDoS protection, and cloud firewalls for resilience.

Fabric Operations

• Operate and troubleshoot underlay/overlay fabrics, enforce segmentation policies, and perform deep service assurance using telemetry and path analytics.

Performance Monitoring & Optimization

• Continuously monitor network health, capacity, and SLA adherence using real-time telemetry

• Proactively optimize QoS, routing, and scaling to prevent service degradation

Change Management & Automation

• Coordinate enterprise-wide changes with automation pipelines and rollback validation.

• Deliver post-incident RCA reports with corrective actions.

Performance Standards and Acceptable Quality Levels

Network Availability

Uptime of core network services

≥99.9%

SD-WAN Management

Automated failover and policy compliance

100% of switches patched within 5 business days of

LAN Lifecycle

LAN Lifecycle

95% P1 resolved ≤ 4 hours;

avg ≤ 2 hrs

95% / ≤ 2

Wireless Optimization

WLAN performance

(telemetry, authentication)

≥ 98% successful authentications; ≤ 2% dropped connection

98% / ≤2

Firewall Management

Compliance with

STIG/NIST controls

100% of firewalls meet compliance; zero critical findings >30 days

100% / 0

Incident Response

Mean Time to

Restore (MTTR) for

P1 incidents

95% P1 resolved ≤ 4 hours;

average ≤ 2 hours

95% / ≤2

Change Management

Successful change execution rate

≥ 98% successful changes;

<2% emergency changes

98% / <2%

Documentation Accuracy

Updates after network changes

100% of diagrams/configs updated within 5 business days

• Monthly performance and compliance reports.

• Incident RCA reports within 10 business days.

• Updated topology diagrams and configuration baselines.

• Quarterly capacity forecasts and optimization recommendations.

(Objective #5) 2.5 CloudOps Support

Performance Outcome: The Contractor shall provide comprehensive Cloud Operations support for DoDEA’s Google Workspace and Microsoft Azure environments, ensuring secure, compliant, and efficient administration. Services shall align with DoD, DISA, and NIST guidelines and enable uninterrupted collaboration and mission -critical operations.

Supporting Tasks for Requirement (Objective #5):

The contractor shall deliver the following supporting tasks that are outcome focused.

Secure and Compliant Cloud Administration

• Maintain compliance with DoD cybersecurity standards, DISA STIGs. NIST SP 800-53, and

FedRamp where applicable

• Enforce Zero Trust principles across identity, access, and data protection.

Reliable and High-Performing Services

• Ensure availability and performance of Google Workspace and Microsoft Azure services to meet defined SLAs.

• Optimize configurations for collaboration tools, identity services, and infrastructure components.

Lifecycle Management

• Perform proactive patching, updates, and configuration hardening for all cloud services.

• Maintain accurate documentation of configurations, policies, and architecture diagrams.

Monitoring and Incident Response

• Implement continuous monitoring for performance, security, and compliance.

• Detect and resolve incidents within defined response times.

Service Availability

Uptime for Google

Workspace/Azure

99.9%

Identity Provisioning

Timeliness of provisioning/deprovision

95% within 1 business day; ≤24 hrs

Configuration Compliance

Quarterly config review completion

100% reviews; zero critical misconfigs >7 days

100% / 0

Monitoring Coverage

Integration of cloud services with monitoring

100% of services monitored

Incident Response

Critical incident resolution time

95% resolved within 2 hours; high priority within 4 hours

95% / 4 hrs

Documentation Accuracy

Updates after cloud changes

100% of docs updated within 5 business days

• Monthly cloud performance and compliance reports.

• Incident RCA reports within 10 business days.

• Updated architecture diagrams and configuration baselines.

• Quarterly optimization and modernization recommendations.

(Objective #6) 2.6 Agile Project Management

Performance Outcome: The Contractor shall provide Agile Project Management services to effectively coordinate, track, and deliver all assigned technical tasks under this contract. Agile principles shall be applied to ensure iterative planning, prioritization, execution, and review of workstreams spanning Security Operations Center (SOC), Tier III Network Operations Center

(NOC) support, DevSecOps, Cloud-Native Application Development, and other IT modernization initiatives. The Contractor shall maintain transparency, manage dependencies, and track performance metrics to ensure alignment with DoDEA mission objectives and compliance with DoD standards.

Supporting Tasks for Requirement (Objective #6):

The contractor shall deliver the following supporting tasks that are outcome focused.

Agile Planning and Execution

• Deliver iterative project planning and execution using Agile frameworks to ensure timely delivery of prioritized tasks across SOC, NOC, and application development workstreams.

Backlog Management

• Maintain and refine product and project backlogs, ensuring user stories have clear, measurable acceptance criteria aligned with DoDEA objectives.

Agile Ceremonies

• Facilitate sprint planning, daily stand-ups, sprint reviews, and retrospectives to foster collaboration among technical teams, security personnel, and stakeholders.

Cross-Team Coordination

• Manage dependencies across SOC, NOC, and DevSecOps workstreams, mitigate resource constraints, and address risks impacting delivery timelines or quality.

Performance Metrics

• Track and analyze delivery metrics (velocity, cycle time, lead time, burn-down chars, defect density) to identity bottlenecks and improve throughput.

Compliance and Governance

• Ensure Agile teams adhere to DoD and DoDEA governance, compliance, and change control standards while maintaining flexibility for evolving priorities.

Risk Management

• Proactively identify and mitigate risks and impediments, escalating blockers to leadership as needed.

Documentation

• Maintain comprehensive project documentation (roadmaps, release plans, sprint backlogs, architecture diagrams, change logs) to ensure continuity and audit readiness.

Reporting

• Provide timely accurate reporting on progress, milestones, risks, and dependencies across all technical areas.

Continuous Improvement

• Establish a framework for continuous improvement by incorporating lessons learned, stakeholder feedback, and best practices across all workstreams.

Performance Standards & Acceptable Quality Levels

Milestone Completion

On-time completion rate

≥ 95% of committed sprint tasks completed on time

Backlog Management

User stories with measurable acceptance criteria

100% of stories have criteria

Agile Ceremonies

Timeliness of sprint reports

100% delivered within agreed timelines

Risk Management

Timeliness of risk mitigation

≥ 90% mitigated within planned timeframes

90%

Stakeholder Satisfaction

Satisfaction rating on

Agile coordination/reporting

≥ 90% satisfaction

Reporting Timeliness

Timely delivery of required reports

100% delivered within agreed timelines

Deliverables:

• Agile governance plan and backlog management strategy.

• Sprint reports and KPI dashboards (weekly/bi-weekly).

• Risk register and mitigation plans.

• Quarterly modernization progress reports.

• Continuous improvement action plans.

(Objective #7) 2.7 Business Case and Requirement Analysis

Performance Outcome: The Contractor shall provide business case development services to ensure all technical solutions under this contract are strategically justified, operationally feasible, and aligned with

DoDEA’s mission priorities and DoD directives. The contractor shall deliver validated, traceable requirements and actionable business cases that enable informed decision-making and guide downstream activities across SOC operations, NOC support, DevSecOps, cloud-native development, and IT modernization initiatives.

Supporting Tasks for Requirement (Objective #7):

The contractor shall deliver the following supporting tasks that are outcome focused.

Stakeholder Engagement

• Engage DoDEA stakeholders, SMEs, and technical teams to elicit mission needs, operational challenges, and capability gaps through interviews, workshops, surveys, and document reviews.

Requirements Definition

• Gather, document, and validate functional and non-functional requirements (performance, security, privacy, availability, usability, scalability) using standardized artifacts such as BPMN diagrams, use cases, user stories, acceptance criteria, and system context diagrams.

Traceability

• Establish and maintain a Requirements Traceability Matrix (RTM) linking mission objectives to test cases and deployed capabilities for end-to-end traceability and audit readiness.

Alternatives Analysis

• Perform alternatives analysis (COTS/GOTS/custom/low code) considering technical feasibility, interoperability, schedule, staffing, licensing, and sustainment, and recommend the optimal approach.

Measurable Outcomes

• Define KPIs and service levels (SLA/SLO/SLI) tied to mission impact (e.g., cycle-time reduction, reliability, MTTR, user satisfaction) and embed them as acceptance criteria.

Requirements Packages

• Produce and baseline requirements packages including CONOPS, operational scenarios, solution outlines, and preliminary architecture views (DoDEA-aligned where applicable).

Governance Coordination

• Coordinate requirements and business cases through governance boards, prepare briefing materials, present findings, capture decisions, and obtain approvals/signoffs.

Backlog Translation

• Translate approved requirements into prioritized backlogs (Azure DevOps/ServiceNow), define

Definition of Ready/Done, and support ongoing backlog refinement.

Status Reporting

• Provide recurring status updates and decision memos summarizing progress, risks, assumptions, dependencies, and recommended corrective actions.

Performance Standards & Acceptable Quality Levels

Requirements

Completeness

% validated and traceable to mission objectives

≥ 95%

Business Case Accuracy

Inclusion of cost, risk, compliance, performance

100% of cases include all elements

Stakeholder Approval

Satisfaction rating on clarity/completeness

≥ 90% satisfaction

Timeliness Deliverables submitted within agreed timelines

100% on time

Traceability

Requirements linked to test cases/deployed capabilities

100% in RTM

Governance Coordination

Packages presented on schedule

95% within agreed cycles; 100% decisions recorded

95% /

Backlog Hygiene

Items with acceptance criteria/reviewed

100% with criteria; ≥

90% reviewed monthly

100% /

• Business case documents for all proposed solutions.

• Requirements traceability matrix.

• Prioritized product and project backlogs.

• Status updates and decision memos.

(Objective #8) 2.8 Technical Writing

Performance Outcome: The Contractor shall develop, maintain, and deliver high-quality technical documentation that supports DoDEA’s operational, security, and compliance objectives. Documentation shall adhere to Federal, DoD, and DoDEA policies and industry best practices for clarity, accuracy, and accessibility. All materials shall serve as authoritative references for IT service delivery, system operations, cybersecurity, and project execution, enabling stakeholders at all levels to effectively manage and govern DoDEA’s systems and services.

Supporting Tasks for Requirement (Objective #8):

The contractor shall deliver the following supporting tasks that are outcome focused.

Policy & Standards-Aligned Documentation

• Outcome: Documentation (manuals, policies, process guides) consistently adheres to applicable Federal, DoD, DODEA policies, industry best practices, and DoD Plain Language standards.

o Task: Develop, update, and maintain documentation libraries covering network, security, cloud, operations, and governance topics.

Precision Process & Configuration Documentation

• Outcome: IT service processes, workflows, and technical configurations are captured with precise, clear, and technically accurate content.

• Task: Produce narrative and visual artifacts (e.g., diagrams, flowcharts, data flows, topology maps) that accurately represent current state and approved baselines.

Stakeholder Coordination & Approval

• Outcome: Documentation accuracy is validated through SME engagement and formal approvals.

• Task: Coordinate with SMEs, engineers, PMs, and leadership to gather inputs, perform verification, and secure formal signoffs prior to publication.

Formal Routing & Governance

• Outcome: Strategic plans, policies, procedures, and governance documents are touted and tracked through proper review channels per DoDEA procedures.

• Task: Maintain review logs, comment resolution records, and approval artifacts for audit readiness.

Standardization of Format & Style

• Outcome: All deliverables adhere to standardized templates, style guides, and formatting rules to ensure consistency and readability.

• Task: Create, baseline, and maintain templates and editorial standards; enforce uniform structure and metadata.

Continuous Improvement & Accessibility

• Outcome: Documentation clarity, usability, and accessibility demonstrably improve over time

• Task: Conduct stakeholder feedback cycles and usability testing; apply advanced documentation tools; remediate accessibility findings.

Authoritative Storage & Retrieval

• Outcome: Final, approved deliverables are stored in DoDEA, authorized repositories, properly tagged and indexed for swift retrieval and audits.

• Task: Implement metadata, taxonomy, versioning, and search optimization practices; ensure records management compliance.

Performance Standards & Acceptable Quality Levels

Documentation Delivery

On-time delivery rate

95% delivered by due dates

Accuracy & Technical

Fidelity Error-free rate

≥ 98% of documents free of errors

98%

Compliance with

Standards

Conformance to policy/plain language

100% of documents conform

Approval Prior to

Publication

SME validation and signoff

100% approved before

Template & Style

Conformance

Adherence to templates/style guides

≥ 99%

99%

Accessibility & Usability

Accessibility pass rate; issue reduction

≥ 95% pass; ≥ 10% quarterly reduction

95% /

10%

Repository Management

Storage/tagging/retrievability

100% stored/tagged; ≤ 2 min retrieval

100% / ≤2 min

• Documentation Library: Manuals, policies, SOP’s runbooks, process guides, configuration baselines, and operational playbooks.

• Visual Artifacts: Architecture diagrams, topology maps, BPMN workflows, flowcharts, system context diagrams.

• Templates & Style Guides: Standardized document templates, editorial style guide, metadata/taxonomy standards.

• Routing & Approval Records: Review logs, comment matrices, approval/signoff artifacts per DoDEA procedures.

• Accessibility/Usability Reports: Finding, remediation actions, and trend metrics.

• Monthly Status Reports: Documentation production/maintenance status, PS8/AQL8, risks, corrective actions.

• Repository Index Exports: Periodic index/tags reports and retrieval test results.

3.0 Constraints - Section

• Contractors are required to comply with SISM, FedRamp (for cloud) and evolving threat protections.

• Contractors must limit network access, maintain privileged user logs, and enforce strict identity verification.

• The contractor is required to follow the FAR and agency-specific regulations.

• Where required, contractors must complete the Government Product Accessibility

Template (GPAT) must be completed when submitted under individual task orders

• Where required, contractors are required to complete the Terms of Use for applicable licenses

• Contractors shall ensure there are no organizational conflicts of interest

• Contractors may be required to provide support for outdated, customized, or mission-critical systems

• Contractors may be required to comply with specific architectures

3.1 Security Clearance Requirements

All personnel assigned to this contract shall have the necessary security clearances required to access DoD networks and systems. The contractor is responsible for verifying that each staff member has the appropriate clearance level prior to beginning work. This includes, but is not limited to, background checks and any other requirements set forth by DoD regulations available at https://www.esd.whs.mil/DD/DoD-Issuances/. Personnel without the requisite security clearance will not be permitted to access any DoDEA facilities or systems, thereby ensuring compliance with federal security mandates.

3.2 Installation/Building Access

The contractor shall coordinate all installation/building access requirements with DoDEA security personnel to facilitate the proper entry of its staff into DoDEA facilities. This coordination is essential to ensure compliance with established security protocols and to maintain the safety of all personnel. The contractor shall provide advance notice for any personnel requiring building access, including relevant identification and security clearance documentation.

Additionally, all contractor personnel must adhere to applicable security measures, including those related to badge issuance, visitor logs, and any other entry protocols mandated by DoDEA.

3.3 Work Hours and Federal Holidays

The contractor will have access to DoDEA facilities during specified work hours only. Access is restricted to normal operating hours, defined as Monday through Friday from 0700 to 1700

Eastern Standard Time, excluding federal holidays. The contractor must plan its activities, accordingly, ensuring that all work is performed within these designated hours to maintain compliance with DoDEA’s operational guidelines. The Government will provide the contractor a list of Government Points of Contact. Requests for access outside of these hours must be submitted in advance and will be subject to approval by DoDEA management.

4.0 Government-Furnished Resources

Government Furnished Property/Equipment (GFP/GFE)

The contractor shall be furnished with the equipment necessary for performance as appropriate.

This GFP/GFE will be provided at the task order level. When GFP/GPE is issued to the contractor it shall be documented on using the GFP Use Decision Document, it shall be signed by the appropriate individual(s) and maintained in the official COR and contract files. The contractor receiving the equipment is required to sign a hand receipt for all GFP/GFE. Lost or damaged equipment shall be handled in accordance with the Government Report of Survey

Procedures.

5.0 Contract Data Deliverables – Deliverables outlined in each Objective

Objective 1 – See Deliverables Paragraph 2.1 Security Operations Center (SOC) Support

Objective 2 – See Deliverables Paragraph 2.2 DevSecOps and Cloud-Native Application Development

Objective 3 – See Deliverables Paragraph 2.3 Enterprise Device Management Support

Objective 4 – See Deliverables Paragraph 2.4 Enterprise Network Operation Center (NOC) Support

Objective 5 – See Deliverables Paragraph 2.5 CloudOps Support

Objective 6 – See Deliverables Paragraph 2.6 Agile Project Management

Objective 7 – See Deliverables Paragraph 2.7 Business Case and Requirement Analysis

Objective 8 – See Deliverables Paragraph 2.8 Technical Writing

6.0 Definitions - Section

Abbreviation Definition

AAR After Action Report

AQL Acceptable Quality Level

ASM Apple School Manager

BC Business Case

BRD Business Requirements Document

CAB Change Advisory Board

CAC Common Access Card

CI/CD Continuous Integration / Continuous

Deployment

CONOPS Concept of Operations

COR Contracting Officer Representative

COTS Commercial Off-The-Shelf

CUI Controlled Unclassified Information

DAST Dynamic Application Security Testing

DevSecOps Development, Security, and Operations

DISA Defense Information Systems Agency

DoD Department of Defense

DoDEA Department of Defense Education Activity

DoDI Department of Defense Instruction

EDR Endpoint Detection and Response

GFE/GFP Government Furnished Equipment / Property

GFI/GFM Government Furnished Information /

Materials

GOTS Government Off-The-Shelf

IAM Identity and Access Management

IoT Internet of Things

ISSM Information System Security Manager

IT Information Technology

ITSS Information Technology Support Services

KPI Key Performance Indicator

KQL Kusto Query Language

LAN Local Area Network

LOB Line of Business

LOC Lines of Code

MAC Media Access Control (address)

MDM Mobile Device Management

MTTD Mean Time to Detect

MTTR Mean Time to Restore/Respond

NIST National Institute of Standards and

Technology

NOC Network Operations Center

OT Operational Technology

P1/P2/P3 Priority 1 / 2 / 3 (incident severity levels)

PII Personally Identifiable Information

PKI Public Key Infrastructure

PM Project Manager

PMO Project Management Office

PRS Performance Requirement Summary

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

RF Radio Frequency

RMF Risk Management Framework

RTM Requirements Traceability Matrix

SDLC Software Development Life Cycle

SD-WAN Software Defined Wide Area Network

Sev Severity (used for incident classification)

SIEM Security Information and Event Management

SLA Service Level Agreement

SLO/SLI Service Level Objective / Indicator

SME Subject Matter Expert

SOP Standard Operating Procedure

STIG Security Technical Implementation Guide

UAT User Acceptance Testing

WAF Web Application Firewall

WG Working Group

WUfB Windows Update for Business

XML Extensible Markup Language

7.0 Performance Requirements Summary (PRS)

Table 1

Objective Performance Standard AQL Method of

Surveillance

Inspector

2.1 SOC PS1.1 – Provide continuous

24x7 monitoring and incident response for Priority 1–3 events.

AQL1.1 – 99% of P1 incidents responded within 15 minutes;

95% of P2 within 60 minutes.

SIEM

dashboards;

monthly SLA reports; ticket sampling.

COR/SOC Team

Lead

2.1 SOC PS1.2 – Meet MTTD/MTTR

targets for enterprise incidents.

AQL1.2 – MTTD ≤

10 minutes (P1);

MTTR ≤ 4 hours average monthly.

Automated monitoring;

incident review boards.

COR/SOC Team

Lead

2.1 SOC PS1.3 – Remediate

vulnerabilities per DoD timelines.

AQL1.3 – Critical ≤

7 days; High ≤ 21 days; 100% critical, 95% high.

Vulnerability scanner reports;

quarterly audits.

COR/SOC Team

Lead

2.1 SOC PS1.4 – Maintain SOC readiness

via exercises.

AQL1.4 – ≥ 1

purple/tabletop exercise per

Exercise records; AAR review.

COR/SOC Team

Lead

Objective Performance Standard AQL Method of

Surveillance

Inspector quarter; AAR within

5 business days.

2.2

DevSecOps

PS2.1 – All releases pass security reviews and quality gates.

AQL2.1 – 100% of releases with no critical vulns at go-live.

Code scans;

release approvals;

audit logs.

COR /DevOps&BA

Leads

2.2

DevSecOps

PS2.2 – CI/CD pipelines operate reliably.

AQL2.2 – ≥ 95%

pipeline success;

rollback rate < 3% monthly.

Pipeline telemetry;

deployment reports.

COR /DevOps&BA

Leads

2.2

DevSecOps

PS2.3 – Comprehensive testing completed pre-release.

AQL2.3 – 100%

required tests executed; ≥ 90% unit test coverage.

Test results;

change control boards.

COR /DevOps&BA

Leads

2.3 Device

Mgmt

PS3.1 – Maintain enterprise device compliance posture.

AQL3.1 – ≥ 95%

devices compliant with baselines at any time.

Compliance dashboards;

monthly posture reports.

COR/Devices Lead

2.3 Device

Mgmt

PS3.2 – Patch endpoints per

SLAs.

AQL3.2 – Critical ≤

7 days; High ≤ 21 days; 100% critical, 95% high.

WUfB/Intune reports;

quarterly audits.

COR/Devices Lead

2.3 Device

Mgmt.

PS3.3 – Ensure successful

Autopilot/Intune enrollments.

AQL3.3 – ≥ 98%

first-pass enrollment; failed enrollments remediated within 2 business days.

Enrollment logs; weekly sampling.

COR/Devices Lead

2.4 NOC PS4.1 – Maintain core

network/service availability.

AQL4.1 – ≥ 99.9%

uptime for core services monthly.

Automated monitoring;

uptime reports.

COR /NOC

Mgr&Lead

2.4 NOC PS4.2 – Execute changes with

minimal incidents.

AQL4.2 – ≥ 98%

successful changes;

< 2% emergency changes.

Change logs;

CAB minutes.

COR /NOC

Mgr&Lead

2.4 NOC PS4.3 – Restore service for P1

incidents rapidly.

AQL4.3 – 95% P1

resolved ≤ 4 hours;

average MTTR ≤ 2 hours.

Incident tickets;

monthly KPI dashboard.

COR /NOC

Mgr&Lead

Surveillance

Inspector

2.5 CloudOps PS5.1 – Timely identity

provisioning/deprovisioning.

AQL5.1 – 95%

provisioning within

1 business day;

deprovisioning ≤ 24 hours.

IAM logs;

monthly reports.

COR/Enterprise

Ops Lead

2.5 CloudOps PS5.2 – Enforce hardened

configurations and reviews.

AQL5.2 – Quarterly config reviews

100%; zero critical misconfigs > 7 days.

Config audit;

PowerSTIG evidence.

COR/Enterprise

Ops Lead

2.5 CloudOps PS5.3 – Maintain cloud service

availability.

AQL5.3 – ≥ 99.9%

monthly availability for collaboration & identity.

Cloud telemetry;

uptime reports.

COR/Enterprise

Ops Lead

2.6 Agile PM PS6.1 – Meet agreed milestones. AQL6.1 – ≥ 95% on-time; acceptable deviation ≥ 90% not more than twice/quarter.

Schedule reviews;

milestone trackers.

COR/PMO

2.6 Agile PM PS6.2 – Provide timely, accurate

status reporting.

AQL6.2 – 100%

monthly reports by

5th business day;

sprint artifacts current.

Report registry;

artifact checks.

COR/PMO

2.6 Agile PM PS6.3 – Manage and escalate

risks promptly.

AQL6.3 – 100% P1

risks escalated ≤ 24 hours; mitigation plans ≤ 5 business days.

Risk logs;

governance minutes.

COR/PMO

2.7 BC &

Requirements

Analysis

PS7.1 – Maintain full requirements traceability.

AQL7.1 – 100%

RTM coverage from objectives to tests & releases.

RTM audits;

sampling.

COR/PMO

2.7 BC &

Requirements

Analysis

PS7.2 – Move packages through governance on schedule.

AQL7.2 – 95%

presented within agreed cycles;

100% decisions recorded.

WG/Board minutes;

trackers.

COR / PMO

2.7 BC &

Requirements

Analysis

PS7.3 – Keep backlog hygiene current.

AQL7.3 – 100%

items with acceptance criteria;

Backlog reports;

sampling.

COR/PMO

Surveillance

Inspector

≥ 90% reviewed monthly.

2.8 Tech

Writing

PS8.1 – Deliver documentation on schedule.

AQL8.1 – 95% on-time delivery to agreed due dates.

Document trackers;

sampling.

COR/Requirements

Officials

2.8 Tech

Writing

PS8.2 – Meet quality/compliance standards.

AQL8.2 – 100%

conform to style guides; zero

PII/PHI breaches;

100% approvals.

Quality reviews:

approvals log.

COR/Requirements

Officials

2.8 Tech

Writing

PS8.3 – Store approved docs in authorized repositories with metadata.

AQL8.3 – 100%

stored with tags/indices;

retrievable on demand.

Repo audits;

monthly checks.

COR/Requirements

Officials

7.1 Quality Assurance Surveillance Plan (QASP) – Subsection

The Government will utilize a QASP to monitor contractor performance. The QASP may be updated unilaterally by the Government throughout the contract period.