Draft NGC2 IDIQ Performance Work Statement (PWS).docx

PERFORMANCE WORK STATEMENT

NEXT GENERATION COMMAND AND CONTROL (NGC2)

PROJECT MANAGER NGC2

U.S. ARMY PROGRAM EXECUTIVE OFFICE COMMAND, CONTROL, COMMUNICATIONS, AND NETWORK (PEO C3N)

Controlled by: PM NGC2 CUI Category:

Limited Dissemination Control:

POC:

TABLE OF CONTENTS

This Page Intentionally Left Blank

PM NGC2 13 JANUARY 2025

Performance Work Statement

OBJECTIVE

NGC2 is a clean-sheet, fundamentally different approach for an Army-wide, data-centric transformation that enables our commanders to make more, faster, and better decisions than the enemy. NGC2 modernization is driven by continuous iteration of flexible requirements, vendor teaming and competition throughout the life cycle, and governance by an AFC product owner and ASA(ALT) program manager working together to plan and rapidly execute capability drops. This approach enables continuous integration and continuous deliver (CI/CD) of a secure, high performing, and adaptive technology stack for data and network architecture for varying operations in environments spanning from enterprise connected and cloud-enabled through austere and communication degraded. Delivering NGC2 will require process innovation across requirements, resourcing, acquisition and contracting.

The Characteristics of Need are reflected in an open architecture organized as a set of independent layers that rely on government approved, non-proprietary APIs to interface and dialogue between them. Although independent, each layer is accessed by services that permit inter-layer functionality, such as orchestration that routes data differently in the transport layer depending on the availability of resources in the computer layer. The performance of each layer is improved through DevSecOps across the technology stack. The open interfacing between each layer provides continuous opportunity for technology insertion through competition and enables on-ramps and off-ramps for technology solution providers. At every echelon, the NGC2 ecosystem enables tactical edge survivability by allocating resources to optimize data orchestration and offer tailorability of commanders’ information needs.

Figure 1. Notional NGC2 Data-Centric Architecture

SCOPE

Overview The broad technical scope defined herein establishes the scope of work that may be implemented through specific delivery orders (DO) or task orders (TO) or issued from this indefinite-delivery, indefinite-quantity multiple award contract (IDIQ MAC).

This IDIQ will support potential projects that provide commanders and units at echelon an open and modular command and control ecosystem with access to a common and integrated data layer. Common platform services, a standardized data model, continuous iteration and integration of emerging technologies, and a modernized network that is intelligent, resilient, and secure comprise the NGC2 core capabilities.

Requirements may be fulfilled with commercial and Commercial-Off-The-Shelf (COTS) items not otherwise available through DoD sources of supply, Government-Off-The-Shelf (GOTS), non-developmental items (NDI), and/or modified COTS in accordance with the terms of individual TO/DOs that originate from this IDIQ.

Requirements for specific products and/or services and Contract Data Requirements Lists (CDRL) will be defined in the requirements documents included in each order. These orders may include all or a portion of the requirements within this General Requirements work statement. The services outlined in this General Requirements work statement may support all aspects of identified or potential military, national security-related, and dual-use applications of related technologies and methods, as well as the development of tools, processes, and techniques that enhance the mission of the DoD.

DOs/TOs resulting from this IDIQ General Requirements work statement may involve multi-year performance; may involve work for any DoD customer(s); may require performance at multiple worldwide locations, to include performance outside the United States of America; may require access to controlled locations and facilities; and may require personnel clearances up to Secret, Top Secret, Top Secret Sensitive Compartmented Information, and/or Special Access Programs.

The Government will not reimburse Contractors for bid and proposal costs associated with any request for proposal for orders awarded, order modification(s) or any cost settlements unless mutually agreed upon in writing.

ABILITY TO STATEMENTS

This IDIQ will enable DoD to accelerate decision advantage by partnering with digital capability providers that can meet some or all of the following “Ability To” statements to support requirements across a broad DoD-wide data management, analytics, and artificial intelligence ecosystem:

Systems Management, Architecture, And Engineering The Contractor shall provide comprehensive system management, architecture, and/or engineering services to conceive, plan, acquire, manage, architect, engineer, document, and/or maintain the system management, architecture, and engineering products, artifacts, and resources required for systems, platforms, and solutions, by performing and/or delivering:

Software Platforms And Systems The Contractor shall provide lifecycle software development to scope, plan, manage, design, develop, integrate, package, test, authorize, and/or deliver software platforms and systems for implementing and operating data, analytic, and/or artificial intelligence/machine learning (AI/ML) solutions.

· Agile Software Management

· DevSecOps

· Configuration Management

· Cloud Engineering

· Network Engineering

· Cross Domain Engineering

· Commercial/Open-Source Tool Integration

· Cloud Native Service Integration

· Robotic Process Automation (RPA)

· Software Design

· Software Development

· Software Integration

· Software Testing, Evaluation, and Validation

· Software Release and Deployment Management

· Platform Solutions

· System Solutions

Data Solutions The Contractor shall provide comprehensive data engineering to scope, plan, manage, design, develop, integrate, package, test, authorize, deliver, operate, and/or maintain enterprise data solutions and custom data solutions for individual customers, organizations, and/or communities, by performing and/or delivering:

· Data Architectures

· Metadata Standardization

· Data Acquisition

· Data Ingest

· Data Engineering

· Data Tagging

· Data Quality Assurance

· Data Security

· Data Governance

· Data Science

· Enterprise Data Solutions

· Enterprise Data Operations

· Custom Data Solutions

Analytic Solutions The Contractor shall provide comprehensive analytics services to scope, plan, manage, design, develop, integrate, package, test, authorize, deliver, operate, and/or maintain enterprise analytic solutions and custom analytic solutions for individual customers, organizations, and/or communities, by performing and/or delivering:

· Analytic Design

· Analytic Development

· Analytic Testing, Evaluation, and Validation

· Analytic Integration

· Analytic Operations

· Product Management

· Data Science

· Data Visualization

· Standardized Analytic Libraries and Templates

· Enterprise Analytic Solutions

· Custom Analytic Solutions

Artificial Intelligence/Machine Learning Solutions The Contractor shall provide comprehensive AI/ML engineering to scope, plan, manage, design, develop, train, validate, integrate, package, test, authorize, deliver, operate, and/or maintain enterprise AI/ML solutions and custom AI/ML solutions for individual customers, organizations, and/or communities, by performing and/or delivering:

· Data Science

· AI/ML Data Labeling

· AI/ML Design

· AI/ML Development

· AI/ML Training

· AI/ML Testing, Verification, and Validation

· AI/ML Integration

· AI/ML Operations

· Responsible and Ethical AI/ML

· Standardized AI/ML Libraries and Templates

· Enterprise AI/ML Solutions

· Custom AI/ML Solutions

Cybersecurity The Contractor shall provide cybersecurity engineering, risk management, and authorization support services to conceive, plan, build, validate, authorize, operate, and/or maintain the security controls, system authorizations, and runtime cyber defense processes for securing and protecting systems, platforms, and solutions, by performing and/or delivering:

· Cybersecurity Requirements

· Cybersecurity Architecture

· Cybersecurity Risk Assessment

· Cybersecurity Engineering

· Security Controls Design and Implementation

· Identity, Credential, and Access Management (ICAM)

· Zero Trust

· Cybersecurity Compliance Testing

· Cybersecurity Body-of-Evidence Generation

· Interim Authority to Test, Authorization to Operate, and Change Request Support

· Continuous Authorization to Operate

· Continuous Monitoring

· Security Incident Management and Response

· Penetration Testing

Managed Services The Contractor shall provide a full range of managed services to operate, defend, and/or maintain enterprise systems, platforms, and solutions, to include comprehensive customer and end user support to facilitate enterprise systems, platforms, and solutions access and effective use, by performing and/or delivering:

· Integration of solutions

· Managed Service Process Engineering

· Service Desk Operations

· Service Portfolio Management

· Service Level Agreements

· Customer Resource Utilization Tracking and Billing

· User Management

· Access Management

· System and Data Back Ups

· Continuity of Operations

· Incident Management and Response.

· Event Management

· Problem Management

· Knowledge Management

· Training Materials

Digital Transformation The Contractor shall provide a full range of services to assist enterprise stakeholders, customers, users, and communities to become highly proficient data management, analytics, and/or AI practitioners, and to evolve, align, and optimize operations and practices to improve mission outcomes, by performing and/or delivering:

· Operational Concepts

· Best Practices

· Standard Operating Procedures

· Strategic Communications

· Stakeholder Engagement

· Customer Relationship Management

· Demand Management

· Use Case Intake Operations

· Workspace Operations

· Community Solutions

· Portfolio Solutions

Network and Transport The Contractor shall provide a full range of services to enable integrated and unified network activities in all operational environments and operations, including enterprise and edge cases, with consideration for network degradation.

· Robust, Resilient, Diverse Transport

· Adaptable Services

· Automated and Intelligent Network Orchestration

REQUIRED COMPETENCIES

Other than CDRL A001, Small Business Subcontractor Report, all required deliverables, milestones, and/or CDRLs will be tailored to and thoroughly identified in DOs/TOs issued under this IDIQ contract. Tasks outline in DOs/TOs issued from this IDIQ are required and may vary from contract to contract as they are wholly dependent upon the technologies and/or products being acquired at that time.

Agile Program Management Agile Program Management activities will be included in each order. This includes managing and overseeing all activities performed by Contractor personnel, including subcontractors, to satisfy the requirements of the contract.

The Agile Program Management objective is to define, manage, and execute processes and planned activities within cost, schedule, and performance parameters in rapid and incremental manner. This Task is for the entire NGC2 program, and each Contractor will provide updates to the overarching programmatic tasks and deliverables within their awarded orders.

The Contractor shall collect software development and release metrics and furnish them at program reviews or upon request, in accordance with ASA(ALT)’s Software Metrics and Management Policy dated 26 April 2024, and when further defined in individual orders.

User-Centered Design As part of User Centered Design, the Contractor shall support the execution of the Government’s NGC2 Human Systems Integration (HSI) Program planning activities, as required in the respective order(s). During the User Centered Design process, the Contractor shall leverage existing personas representing the users or create new ones if none exist. A persona is a user archetype used to help guide decisions about product features, navigation, interactions, and even visual design.

DevSecOps Software Engineering The Contractor shall provide DevSecOps Solutions and Services as required for automating all the software/system lifecycle of all systems, platforms, and solutions developed under this IDIQ. DevSecOps Solutions and Services tasks include, but are not limited to:

· Designing and implementing enterprise DevSecOps solutions for data, analytic, and AI systems, platforms, and solutions.

· Designing and implementing automated DevSecOps pipelines to support NGC2 data, analytic, and AI software lifecycles.

· Identifying, recommending, and incorporating Government approved tools into automated DevSecOps pipelines.

· Designing, implementing, and operating DevSecOps solutions to support NGC2 data, analytic, and AI software lifecycles.

· Designing, implementing, and operating DevSecOps processes to support NGC2 data, analytic, and AI software lifecycles.

· Aligning and operating DevSecOps processes and operations with NGC2 governance activities.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Systems Engineering The Contractor shall perform Systems Engineering activities required for scoping, designing, implementing, and securing systems, platforms, and solutions developed under this IDIQ. Systems Engineering task include, but are not limited to:

· Collecting, organizing, and maintaining requirements.

· Designing, preparing, and documenting systems engineering products.

· Designing, implementing, and operating system engineering processes and decision boards.

· Preparing and maintaining engineering roadmaps and schedules.

· Developing and preparing Systems Engineering alternatives and courses of action (COAs) to support major leadership decisions.

· Preparing cost, schedule, and risk estimates for change requests to NGC2 system, platform, or solutions.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Cybersecurity Engineering The Contractor shall perform Cybersecurity activities as required for risk management, authorizing, securing, and defending systems, platforms, and solutions developed under this IDIQ. Cybersecurity tasks include, but are not limited to:

· Performing cybersecurity architecture and engineering.

· Providing personnel that are qualified to perform the functions of DoD Information System Security Managers (ISSMs) and that have all DoD mandated qualifications and certifications for performing ISSM functions.

· Defining, designing, implementing, testing, authorizing, and maintaining appropriate NIST security controls for NGC2 systems, platforms, and solutions.

· Designing, developing, and continuously improving Zero Trust architectures and security controls for NGC2 systems, platforms, and solutions.

· Generating, preparing, and maintaining IATT, ATO, and Change Request (CR) engineering artifacts and documents for NGC2 systems, platforms, and solutions using the DoD Risk Management Process (RMF).

· Defining, developing, and integrating automated cybersecurity test procedures into DevSecOps testing pipelines for NGC2 systems, platforms, and solutions.

· Preparing, implementing, and maintaining Cybersecurity Continuous Monitoring Plans and conducting cybersecurity continuous monitoring and defense operations for NGC2 systems, platforms, and solutions.

· Preparing, implementing, and maintaining Security Incident Management Plans and conducting Security Incident Management operations for NGC2 systems, platforms, and solutions in accordance with all DoD and Government cybersecurity regulations.

· Preparing and maintaining System Penetration Test Plans and conducting penetration testing on NGC2 systems, platforms, and solutions.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Software Development and Integration The Contractor shall perform Software Development and Integration activities as required for designing, coding, and implementing systems, platforms, and solutions developed under this IDIQ. Software Development and Integration tasks include, but are not limited to:

· Designing, implement, and operate modern agile software processes in support of NGC2 system, platform, and solution implementation.

· Designing, building, securing, and testing software to implement NGC2 system and platform user stories and requirements using Agile sprint cycles.

· Constructing user stories to guide the development of software for NGC2 platforms, systems, and solutions.

· Integrating and securing commercial and open-source tools into NGC2 systems and platforms as directed by the Government.

· Hardening and securing Virtual Machine Images and software containers in accordance with DoD cybersecurity standards.

· Designing, building, and testing software application program interfaces (API) for supporting machine-to-machine interactions with NGC2 systems, platforms, and solution services.

· Designing, building, and testing user interface software for supporting user facing interactions with NGC2 systems, platforms, and solutions.

· Designing, developing, and testing Infrastructure-as-Code (IaC) and Configuration-as-Code (CaC) for provisioning and configuring and NGC2 platforms and systems.

· Participating and supporting NGC2 software-related processes including DevSecOps and CCB/ECB processes.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Operations and Maintenance The Contractor shall perform Operations and Maintenance activities as required for deploying, operating, administering, and maintaining systems, platforms, and solutions developed under this IDIQ. System Operations and Maintenance tasks include, but are not limited to:

· Preparing, implementing, and maintaining System Operation Plans and Incident Management Plans and conducting the full Operations and Maintenance (O&M) lifecycle for NGC2 systems, platforms, and solutions.

· Performing system administration and maintenance activities on NGC2 systems, platforms, and solutions as required to keep them operational.

· Managing and maintaining cloud environments via Cloud Service Provider (CSP) provided cloud service management consoles.

· Continuously monitoring the NGC2 systems, platforms, and solutions for Virtual Machine or Container failures and restarting and restoring them to normal operations when necessary.

· Collecting, analyzing, and reporting ongoing system operations and maintenance issues so that they may be corrected in future releases.

· Installing, configuring, and operating Government-specified automated tools to track network configuration; monitor status and performance; detect, diagnose, and resolve network problems; and project future capacity requirements.

· Preparing, implementing, and maintaining Backup and Recovery Plans and providing failure recovery support for NGC2 systems, platforms, and solutions to ensure the ability to restore platform service when needed.

· Notifying users of system outages and establish/maintain a business process to ensure any system outages, scheduled or not, are known and conveyed to users in a timely manner.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Enterprise Data Engineering and Operations The Contractor shall perform Enterprise Data Engineering and Operations activities as required for acquiring, ingesting, aligning, cleaning, tagging, advertising, and sharing enterprise data for all DoD data sources addressed under this IDIQ. Enterprise Data Engineering and Operations tasks include, but are not limited to:

· Designing, implementing, and maintaining Enterprise Data Engineering and Operations Plans and processes.

· Defining, documenting, and maintaining technical standards and best practices for Enterprise Data Engineering and Operations.

· Negotiating and establishing data sharing agreements between DoD data providers and NGC2 systems and platforms.

· Designing, implementing, testing, authorizing, and operating data ingest pipelines for continually importing DoD enterprise data into NGC2 systems and platforms.

· Conducting DoD Enterprise Data Engineering and Operations to import DoD enterprise data into NGC2 systems and platforms.

· Designing, implementing, testing, authorizing, and operating enterprise data tagging capabilities for enterprise data imported into NGC2 systems and platforms.

· Designing, implementing, testing, authorizing, and operating enterprise data cleaning and quality control capabilities for enterprise data imported into NGC2 systems and platforms.

· Implementing and operating enterprise data ingest monitoring mechanisms to proactively address any issues that may arise over time.

· Designing, implementing, testing, authorizing, and operating enterprise data discovery and sharing services/APIs to enable machine-to-machine capabilities.

· Designing, implementing, testing, authorizing, and operating data governance mechanisms that enable users to rapidly discover and access enterprise data using attribute-based access control.

· Developing and maintaining training and certification programs for data connection engineers that grants access and enables data sharing across NGC2 and DoD systems and platforms.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Product Management The Contractor shall perform Product Management activities as required for products designed, developed, and/or deployed under this IDIQ. Product Management tasks include, but are not limited to:

· Conduct and execute a product operating model for the data products, analytic applications, and custom software from beginning of lifecycle to end. Identify the vision of a product(s), directs updates, and ensures the product(s) are filling customer needs until the product(s) are retired.

· Define key metrics for product success and build mechanisms to report those metrics to customers.

· Conduct continuous discovery and delivery of each product using modern product management principles and operating models.

· Work with cross-functional teams and stakeholders (e.g., engineering, design) to develop and pursue product strategy.

· Find ways to improve products through analysis, user adoption and use feedback.

· Monitor and measure product performance.

· Test and monitor new product features using modern GitOps pipelines where feasible and maintain agile practices in the discovery and delivery of such products.

· Monitor alternate products through market analysis and research.

· Maintain engineering, product management, and product design staff that are current on industry best practices and translate those into NGC2 and DoD tools and capabilities where applicable.

· Design and staff a community support team to address intake, dedicated account manager(s), and requisite program management support and oversight for a continuum of individual builders all the way up to large functional activities.

Customer Support and Service Desk The Contractor shall perform Customer Support and Service Desk activities as required for assisting customers and users that utilize systems, platforms, and solutions developed under this IDIQ. Customer Support and Service Desk tasks include, but are not limited to:

· Developing, building, and maintaining Service Desk Operations Plans and associated processes.

· Designing, implementing, and operating Service Desk(s) for providing Tier 0, 1, 2, and/or 3 customer/user support for NGC2 systems, platforms, and solutions.

· Supporting rapid service requests for Very Important Persons (VIPs) including General Officers, Flag Officers, Senior Executives (SESs), and certain senior level political appointees.

· Performing account maintenance and setup activities, including creating, modifying, and/or deleting user accounts in support of account maintenance policies and Standard Operating Procedures (SOPs).

· Preparing and maintaining Service Desk performance metrics.

· Designing, building, and maintaining Service Desk Queue Management plans and associated processes.

· Reviewing and evaluating Service Desk process performance and conducting root cause analysis to identify, address, and remedy Service Desk performance issues and resolve negative trends.

· Conducting regular communications with customers/users to keep them informed of System issues, outages – both planned and unplanned.

· Designing, preparing, validating, and promulgating Service Desk training materials and documentation that assist customer and users in accessing and using NGC2 systems, platforms, and solutions.

· Implementing and maintaining Service Desk SOPs and Service Desk Playbook for Tier 1 and Tier 2 to address common procedures and problems.

· Collecting, archiving, and maintaining Service Desk logs and operations data required to support NGC2 and DoD system audits.

· Conducting and reviewing customer/user feedback to continually improve quality and breadth of Service Desk offerings.

· Performing additional tasks as defined in individual TO/DOs executed from this IDIQ.

Artificial Intelligence/Machine Learning The Contractor shall assist customers in defining, scoping, planning, implementing, testing, authorizing, and delivering Artificial Intelligence and Machine Learning Solutions developed under this IDIQ.

TRAVEL

The Contractor may be required to travel in support of the IDIQ DO/TOs. For example, the Government may require the Contractor to travel, either domestic or foreign, to seminars, conferences, workshops, meetings, events, commercial vendor sites, test facilities, military installations, and/or specialized to perform the objectives of an awarded DO/TO. When necessary, travel requirements will be outlined in each DO/TO.

PROPERTY, EQUIPMENT, FACILITIES, AND INFORMATION

Government furnished property, equipment, facilities, and/or information may be provided under certain projects and will be specified at the DO/TO level, as appropriate.

SMALL BUSINESS SUBCONTRACTOR REPORTING

IAW basic contract CDRL A001 – Small Business Subcontractor Report, the Contractor shall routinely report small business subcontracting activity for DO/TOs awarded.

SECURITY

The Contractor personnel may be required to access a federal government/military facility on a temporary basis to deliver and/or maintenance equipment. Access to federal facilities may require the Contractor personnel to submit to a criminal background check which may include an FBI fingerprint check. The Contractor shall comply with any additional local requirements specific to the facility location of access.

For Contractor personnel whom will require military installation access and/or privilege access to DoD information technology systems: the Contractor shall ensure all personnel, who are authorized users of an information technology system, hold a favorably completed Tier-3 (T3) investigation, or National Agency Check with law and credit (NACLC), or Access National Agency Check and Inquiries (ANACI) with collateral level access and receive a current periodic reinvestigation in accordance with DCSA guideline for access levels. The Contractor shall ensure applicable Contractor personnel have security clearances at the appropriate level for proper accomplishment of contract/order requirements.

Security Management The Contractor shall comply with the security requirements specified in each DO/TO issued from this IDIQ. The Contractor shall flow down the security requirements to subcontractors as applicable. All resources (e.g., publication/instructions) provided by the Government to assist the Contractor in the performance of their contract shall be surrendered at the end of contract performance or upon Government request.

Operations Security The Contractor shall ensure operations security (OPSEC) is incorporated into the appropriate area of the contract IAW DoD Directive 5205.02M, DoD Operations Security Program Manual. The Contractor shall flow down all OPSEC requirements to subcontractors that handle Critical Information (CI). CI is defined as specific facts (or evidence) about friendly intentions, capabilities, and activities needed by adversaries to plan and act effectively against friendly mission accomplishments.

Controlled Unclassified Information The Contractor shall ensure all personnel who are authorized users of an information technology system with "no privileged access" (IT Level III) duties hold a favorably completed Tier 1 investigation; IT Level II ("privileged access") duties hold a favorably completed Tier 3 investigation; and IT Level I ("privileged access") duties hold a favorably completed Tier 5 investigation and receive a periodic reinvestigation every 5 years.

Additionally, the Contractor shall comply with DoD standards for storing, processing, marking, and handling unclassified and/or Controlled Unclassified Information (CUI) and systems pursuant to FAR 52.204-21 and DFARS 252.204-7012. The Contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

PERSONNEL SECURITY

The Contractor shall ensure applicable contractor personnel have security clearances at the appropriate level for proper accomplishment of DO/TO requirements. The security clearance shall be obtained in accordance with the DO/TO. Contractor personnel whose clearances have been suspended or revoked shall immediately be denied access to classified information and/or CUI and classified items.

Security Incidents and Violations In compliance with DFARS 252.204-7012, the Contractor shall provide adequate security and rapidly report cyber incidents to the DOD that involve defense information. In addition to complying with DFARS reporting requirements on cyber incidents, the Contractor shall also notify the contracting officer, COR and government security manager in writing for any incident under this clause within forty-eight (48) hours of identification.

PERFORMANCE MANAGEMENT

Contractor Performance Assessment report (CPAR) The Government does not intend to evaluate the basic IDIQ contracts within the Contractor Performance Assessment Reporting System (CPARS). When a placed DO/TO exceeds the threshold specified in FAR Subpart 42.15, the Assessing Official at the contracting or requiring activity for that DO/TO is responsible to complete a separate evaluation in CPARS.

CUI

image2.png image1.jpeg