Draft Performance Work Statement PWS Parts 1 and 5.docx

Department of Defense Defense Health Agency Performance Work Statement

Operations and Sustainment Information Technology (IT) Services

Deputy Assistant Director Information Operations (DAD IO) (J6)

Infrastructure and Operations Division (I&O), Domain and Directory Services Branch (DDSB)

Solicitation Number:

Version: 1 Date: XX April 2024

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide operations and sustainment information technology (IT) services. The Government shall not exercise supervision or control over the Contractor’s employees performing the services herein. The Contractor’s employees shall be accountable solely to the Contractor, who, in turn, is responsible to the Government.

1.2 Description of services/introduction: The contractor shall provide non-personal services necessary to perform information technology (IT) operations, engineering, architecture, and sustainment support services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished equipment (GFE) and services. The contractor shall perform to the standards in this performance work statement.

1.3 Background:

1.3.1 The Defense Health Agency (DHA) is a joint, integrated Combat Support Agency enabling the Army, Navy, and Air Force Medical Departments to provide a medically ready force and a ready medical force to Combatant Commands in both peacetime and wartime. The DHA administers the TRICARE Health Plan providing worldwide medical, dental, and pharmacy programs to more than 9.4 million uniformed Service members, retirees, and their families. The DHA also manages the Military Health System (MHS), a global, comprehensive, integrated system that includes combat medical services, peacetime health care delivery, public health services, medical education and training, and medical research and development. The MHS currently includes 55 military hospitals, 373 military medical clinics and 245 dental clinics.

1.3.1 The DHA, Infrastructure and Operations Division (I&O), Domain and Directory Services Branch (DDSB) is chartered to operate and sustain the IT footprint and environments for the medical activities, Other Lines of Business (for example, research), and some Veteran Administration (VA) activities. The customer base supported by DDSB extends to Army, Navy, and Air Force medical entities worldwide. The medical Joint Active Directory (mJAD) domain is the on-premise environment leveraging Identity and Access Management (IdAM) system. There is a cloud environment called MED365 for @health.mil applications and services which leverages Identity, Credential, and Access Management (ICAM). There are environments or areas for testing activities. These environments consist of approximately: 3,000 physical and virtual servers, 250 sites located around the world, 250,000 end user devices, and 200,000 users. Note that design elements, product lines, nomenclature, and tools are subject to modernization and change.

1.4 Objectives:

1.4.1 Provide IT Architectural, Engineering, and expert technical operations and sustainment support for IT systems and services.

1.4.2 Provide services required by the Government for 24-hour operational support. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. The Contractor shall provide services in accordance with its proposed approach / solution, including the staffing matrix and labor category qualifications, as awarded. If a Contractor employee is found unqualified for any reason or the employees submits their resignation, the employee shall be replaced with a qualified individual within 5 business days. The Contractor shall not invoice for vacancies that exceed 10 business days. In the event any position(s) cannot be filled with 10 business days, the Government shall be entitled to an appropriately pro-rated reduction in costs to the monthly invoice of any vacancy(ies).

1.4.3 Maintain high-availability, reliable and secure IT infrastructures environments. Ensure systems under DDSB’s areas of responsibility maintain compliance with DoD cybersecurity requirements and meet Risk Management Framework (RMF) requirements. DDSB Section Chiefs and their team leads serve as Task Managers ensuring appropriate priorities are assigned to tasks within their areas of responsibilities.

1.5 Scope: Provide IT Architectural, Engineering, and expert technical services to all DHA environments. The required services include:

· Providing security compliant, engineered solutions for standard application integration, application security, application delivery, desktop engineering, mobile device engineering, end user experience, and service monitoring functions;

· Architectural and technical designs for IT infrastructure systems;

· Providing broad support of DoD Zero Trust Strategy, DoD ICAM Strategy, DoD Digital Modernization Strategy and DoD Cybersecurity Reference Architecture

· Automation and scripting;

· Engineering whole disk encryption and data-at-rest protection capabilities;

· Standardized designs and solutions for directory services, Public Key Infrastructure (PKI), identity management, access management, and Public Key Enabling (PKE) activities;

· The establishment, management, and maintenance of enterprise user data/profile management and their associated resources;

· The preparation and deployment of policies, applications, and operating systems, to include applicable upgrades;

· Providing a common system and monitoring framework for centrally deploying, supporting, and monitoring applications and systems;

· Configuration Management to include Change Management, Knowledge Management, and technical documentation development for all technical and presentation requirements;

· Management, sustainment, and security of all enterprise servers, end user devices (EUDs), applications, and resources;

· Accreditation of the operational environment and execution of governance processes maintaining security requirements

1.5.1 Support shall consist of those activities required to maintain existing and future applications, functions, and services:

· Change Management, Knowledge Management to include technical writing, IT architectural documentation;

· Identity and access management and sustainment;

· Mobile Device management and sustainment;

· IT Service Monitoring and optimization;

· Desktop/Endpoint management and sustainment;

· Endpoint and identity Security;

· Application integration;

· Administration of Microsoft (MS) and non-MS operating systems;

· Policy implementation and management;

· Enterprise Management (EM), currently consisting of Microsoft Endpoint Configuration Management formerly known as MS System Center Configuration Manager (SCCM)), and emerging cloud technologies such as Azure Cloud and Intune or other Enterprise Management Tools;

· Monitoring and restoral tools (like MS System Center Operations Manager (SCOM));

· Information Assurance Vulnerability Management (IAVM);

· Accreditation support and documentation;

· Manage information and system security in accordance with (IAW) the Risk Management Framework (RMF), Risk Assessments, Security Technical Implementation Guides (STIG) management, and Information Assurance Vulnerability Alert (IAVA) reporting;

· Scanning and compliance such as Assured Compliance Assessment Solution (ACAS); Enterprise Mission Assurance Support Service (eMASS);

· operational security; and

· Data encryption services/ Data At Rest (DAR).

1.5.2 In accordance with their technical specialties, applicable support personnel must be fully knowledgeable in the following:

· Designing, planning, and implementing Unified Endpoint Management (UEM) solutions, at enterprise scale;

· Utilizing UEM technologies to administer and manage endpoint clients for a large enterprise;

· Developing, planning, and implementing disaster recovery and high availability for UEM infrastructures to mitigate and prevent the loss of UEM;

· Designing, planning, and implementing modern Endpoint Detection and Response (EDR) and eXtended Detection and Response (XDR) strategies that integrate seamlessly with deployed UEM solutions;

· Scripting and coding using PowerShell, VBScript, JavaScript, Python, or other languages, to automate and develop operational solutions related to enterprise services, solutions, and processes;

· Engineering, deploying, and administering productivity tools at scale, such as Microsoft 365 for Enterprise;

· Researching, analyzing, and implementing operational solutions across various technologies and operating systems to include but not limited to, Windows, Linux, iOS (iPhone/iPad) MacOS, ChromeOS and Android endpoints. Using on-premises Group Policy, cloud enabled policies, and Kiosk configurations;

· Multiple patch management tools (e.g., Microsoft technologies, Batch Patch, IBM Big Fix, WSUS, InTune, etc.);

· Designing and performing regular system management tasks such as policy configuration and setup, device enrollment prep and assistance, monitoring system status and performance, and other related system maintenance tasks;

· Integration of on-premises and Microsoft 365 ecosystems as it relates to managing and delivering services to enterprise users and devices;

· Design and use of Identity Assertion, Authentication, and Authorization Protocols, e.g., SAML, oAuth, Kerberos, OpenID;

· Engineering, architecting, and delivering Public Key Infrastructure, enablement thereof, and integration;

· Adherence and participation in Configuration Management procedures and processes (Change Management, and Knowledge Management to include technical writing, DevSecOps, and Agile);

· Authoring, proofing, and contributing to IT architectural, engineering, and support documentation to include drawings and other visual representations of data flows and designs;

· Engineering, deployment, integration, and sustainment of identity and access management products to include on-premises, cloud, and SaaS offerings;

· Engineering, deployment, and sustainment of mobile device management solutions to include Public Key Enablement, Authentication, Authorization, and device management;

· Desktop/Endpoint and End User Experience Engineering, deployment, and sustainment enhancing and supporting standardization and uniformity across device platforms;

· Versed and knowledgeable with regard to DoDI 8520.02, DoD Zero Trust Strategy, DoD ICAM Strategy, DoD Digital Modernization Strategy and DoD Cybersecurity Reference Architecture;

· DoD network security policies, and regulation execution;

· IT Service Monitoring;

· Engineering, research, deployment, and sustainment of Microsoft Active Directory Domain Services, Active Directory Certificate Services, Active Directory Lightweight Directory Services, Entra ID Connect, Entra ID (Azure Active Directory) Active Directory Federation Services and Microsoft Identity Manager;

· Commercial-off-the-shelf (COTS) and Government-off-the-shelf (GOTS)Application and software packaging, patching, management, configuration packages and deployment;

· Engineer, design, integrate, and troubleshoot for coexistence COTS, GOTS, Third-Party, and First-Party applications;

· Engineer, design, integrate, and troubleshoot device drivers, firmware, and middleware for packaging, deployment, management, and configuration control;

· Engineer, design, troubleshoot and develop deployment strategies for Microsoft Endpoint Configuration Manager (MECM) Operating System Deployment (OSD);

· Engineer, design, research, and deploy strategies within GCCH (Government Cloud Computing High) IL5 (Impact Level Five) environment using InTune for enrollment, policy distribution, device configuration, and device management;

· Provide, build, analyze, design, maintain reports, and analytics using PowerBI, Dataverse and other tools;

· Proficient in foundational concepts related to networking fundamentals Dynamic Host Configuration Protocol (DHCP), Windows Internet Naming Standard (WINS), Domain Name Service (DNS), IP Addressing, Transmission Control Protocol/Internet Protocol (TCP/IP);

· Lightweight Directory Access Protocol (LDAP) synchronization and authentication;

· Engineer, architect, troubleshoot, support, and configure endpoint security tools (like Trellix / Microsoft Defender Endpoint (MDE);

· Engineer, design, architect, deploy, sustain, and troubleshoot cybersecurity tools to include Sentinel, Microsoft Defender (XDR) Suite (MDI, MDO, MDCA, MDE, DLP, Entra ID Protect;

· Information assurance and security scanning and reporting (like ACAS);

· Diagnose, troubleshoot, repair, sustain and configure advanced endpoint configurations and misconfigurations via tools like Fiddler, Postman, Wireshark, Microsoft SysInternals that addresses performance and end user experience.

1.5.3 Technical Proficiency. Vendors shall be responsible to ensure their employees obtain and maintain proficiency, expertise, and appropriate certifications in current and approved new technologies to be incorporated into the DDSB IT infrastructures. Once a new and/or updated technology is approved for incorporation, the Government will be responsible to provide any required initial qualification training and appropriate certifications to current Vendor technicians. Vendor(s) shall be responsible to provide appropriate training and certification to new and/or replacement Engineers and technicians.

1.5.4 Increased workload requirements. Increases in workloads are expected when new customers are incorporated into the DHA environments, as well as when major operational and/or maintenance changes in the DHA environments, to include the ITC, occur. Depending on the nature of the effort, increased workload requirements are likely to involve the need for additional support of any and all specialties listed in this PWS and may require days to months of increased support.

1.6 Period of Performance (PoP): Performance period will begin no later than 16 September 2025 and will run continuously for the Base Year of 12 months with four (4) 12-month option years and an optional six-month extension.

1.6.1 Transition: To be determined.

1.6.1.1 Transition-in period: Full performance start date is, [Insert date]. Transition-in performance is defined as [Insert performance expectation here]. During the transition-in period, the contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date except cybersecurity requirements, which must be fully adhered during transition and full performance periods. The remaining incoming personnel shall be trained and qualified within [insert # of days]. (Another option would be to allow the contractor to provide the Government with a transition plan for phasing-in contractor performance. If this option is used, a transition plan Contract Data Requirement List (CDRL) will need to be added to the Technical Exhibit 1.)

1.6.1.1.1 The contractor shall comply with transition-in requirements of the DHA, as listed in paragraph 1.11.1, for contractors needing to be issued Common Access Card (CAC) identification, including Department of Defense (DoD) and DHA-directed training and forms submission, prior to network access.

1.6.1.2 Phase-out period. The transition-out plan shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the contract. See Part 7, Technical Exhibit 1. (If this option is used, a transition plan CDRL will need to be added to the Technical Exhibit 1.) (The Government should consider data rights (PWS Section 1.13) and data transfer as a part of the transition out plan.)

1.6.1.2.1 The contractor shall comply with transition-out requirements of the DHA for contractors who have been issued a CAC or who generate “records”, as defined by DoD (records manual), including DoD-directed disposition of records, and others displayed on the In/Out (I/O) Processing Portal.

1.7 Administrative specifications:

1.7.1 Place of performance: The work to be performed under this contract may be performed at any of the following locations: Army Public Health Center (APHC) San Antonio, 4270 Gorgas Circle, Bldg 1070, Joint Base San Antonio (JBSA)-Fort Sam Houston, TX 78234, DHA North Breach Pavilion, 2720 Howitzer Street, Bldg 2372, JBSA-Fort Sam Houston, TX 78234, or other Government owned/leased location(s) approved by Government Leadership. Vendor owned facilities may be utilized, at no additional expense to the Government, providing such facilities meet operational and Personal Health Information, Personal Identifiable Information, and Controlled Unclassified Information security requirements. Travel to other locations may be required by the mission.

1.7.2 Recognized Federal holidays. Contractors providing Tier 2 support services (paragraph 5.5) and Enterprise Management administration support (paragraph 5.2) will be required to perform services on the holidays listed below. For all other support services, the Contractor will not be required to perform services on the holidays listed:

Independence Day Presidentially Declared Federal Holidays As declared

1.7.3 Hours of operation: The contractor is responsible for conducting business between the hours of 0600 and 1800 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings.

1.7.3.1. Contractor employees shall not perform more than 40 hours of work per week per employee and the Government may not be billed for more than 40 hours of work per week per employee without prior written Contract Officer’s Representative (COR) authorization.

1.7.3.2 Contractor employees providing Tier 2 support services (paragraph 5.3) shall be required to perform their duties on a rotating shift basis to supplement in-place government and contractor workforce execution of a 24 hours a day, 365 days a year operational requirement. Contractors providing Enterprise Management (EM) administration support services (paragraph 5.2) may be required to perform their duties on a rotating shift basis to supplement in-place government and contractor workforce execution of a 24 hours a day, 365 days a year operational requirement.

1.7.3.3 Operational events may require support to perform work listed in Section 5 outside normal duty hours. The contractor may adjust schedules as necessary, with COR approval, to provide optimal support.

1.7.3.4 On-Call Support. With exception of Change Management, Knowledge Management, and IT architectural documentation support, the contractor shall provide after duty hours and weekend on-call support for services listed in Section 5. The actual hours of support provided shall be deducted from the number of hours the contractor employee works the following day. If an employee has already reached 40 hours of work for the week, then the actual hours of support provided will be deducted from the hours of the following week. On-Call support shall be in accordance with DDSB, DSS On-Call Policy, Document Number 2-18-006.

1.7.3.5 On-site/off-site work: Contractor employees may be authorized to telework/work remotely upon Government approval. Contractor employees will be required to be onsite to complete in-processing, government required training, identification, and equipment issue at the start of employment. At the discretion of Government leadership, contractor employees will be required to attend meetings or conduct work on-site. The Contractor shall be responsible for all costs related to performing off-site work under this contract. Travel to perform required duties will be in accordance with paragraph 1.8.

1.8 Contractor travel: Contractor employees may be required to travel to continental United States (CONUS) and outside the continental United States (OCONUS) locations in the performance of this contract. Contractors traveling to OCONUS locations must follow any Status of Forces Agreement (SOFA) requirements applicable to that location. The Contractor may be required to travel to off-site training locations and to ship training aids to these locations. Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. The Contract shall submit a detailed cost estimate to the Government before any required/requested travel is approved. All travel requires Government approval/authorization, by the COR, at least 5 business days prior to travel. However, for travel to OCONUS locations the contractor must seek COR approval with sufficient time to allow processing any required clearances. The contractor shall comply with requirements in the DoD Electronic Foreign Clearance Guide for all travel outside the United States. The contractor shall adhere to any specialized training requirements and country/theater clearance lead times as specified in the DoD Electronic Foreign Clearance Guide. In addition to the requirements in the DoD Electronic Foreign Clearance Guide, the Contractor shall comply with the requirements below. The contractor shall incorporate the substance of this requirement in all subcontracts awarded under this contract.

1.8.1 DHA Foreign Travel Requirements: Historically, less than three overseas travel ventures per year have been required; however, contractor employees who will be employed, assigned, or on temporary duty to locations outside of the United States shall complete a DHA Form 18 (Attachment 6), and provide the completed Form to the DHA Mission Assurance Branch no later than ten working days prior to travel. All prerequisites (vaccinations, passports, Visa, etc.) for foreign travel shall be done at the contractor’s expense. The DHA Form 18 is available through the DHA web page https://info.health.mil/SitePages/Home.aspx (CAC login required). Upon return from foreign travel, debriefings may be required based on the traveler’s encounter with any reportable situations. If the traveler has a situation to report, they must contact DHA security (dha.ftv@mail.mil) with the following information (notifications shall not contain any classified information):

· Date/time of incident

· Location of incident

· Level of information involved (if involved and/or known)

1.8.2 Performance in Germany: The contractor shall follow the German “fax-back” process for employees who will travel to Germany in performance of this contract. This process may only be used for employees who will remain in Germany for 90 days or less in a 12-month period. The fax-back process must be completed before the employee arrives or begins work in Germany (before the employees leaves the CONUS or other location for Germany). The contractor shall refer to Army in Europe Regulation 715-9, Contractor Personnel in Germany – Technical Expert, Troop Care, and Analytical Support Personnel, for additional guidance. As requirements are subject to change, the contractor shall refer to the DoD Electronic Foreign Clearance Guide and the DOCPER website (currently at http://www.eur.army.mil/g1/content/CPD/docper/docper_germanyLinks.html?tab=5&framepage=germanfaxback.html#top) for the latest information.

1.8.3 Performance in Japan: See Technical Exhibit 2.

1.8.4 Performance in Korea: See Technical Exhibit 4. Not later than 60 calendar days prior to any Contractor employee travelling to Korea, the Contractor shall provide the COR with a completed USFK Form 700-19A-R-E (Technical Exhibit 5), Applicant Questionnaire Memo (Technical Exhibit 6), and a copy of the first page, and all stamped pages, of their current passport (and any passport that may have expired within the last year). The COR will notify the Contractor when SOFA designation has been obtained for their employees. Contractor employees shall not travel to Korea prior to confirmation from the COR that the employee has been approved for SOFA designation. Additional information is available in USFK Regulation 700-19, The Invited Contractor and Technical Representative Program. The United States Forces Korea (USFK) Acquisition Management website (currently located at http://www.usfk.mil/Organization/AcquisitionManagement,FKAQ.aspx) also contains additional information and links to required forms.

1.8.5 Performance in Spain: All Contractor employees, regardless of their length of stay in Spain, supporting a DoD contract must obtain a Certificate of Civil Liability Insurance, in accordance with the requirements of the US-Spain Agreement on Defense Cooperation, issued in Spain. This insurance must be issued by a company authorized to conduct this type of business in Spain and may not contain any deductible or similar limitation. To obtain the certificate, Contractors must contact their insurance provider and instruct them to contact their affiliate in Spain, who in turn will issue the certificate and forward it to the Contractor, who will obtain a corporate signature. The signed certificate must be e-mailed along with a completed Country Clearance Request form, the Employee Certification, and a statement from the DoD contract administrator validating the visit to the point of contact at the unit being visited (for visits to Naval Station Rota, or Moron Air Base), who in turn will endorse the visit and forward the documents to the U.S. Embassy Office of Defense Cooperation (ODC) for processing through Spanish authorities. Contractors visiting any other location in Spain in support of a DoD contract must follow instructions identified above; however, the Certificate of Civil Liability Insurance, the Country Clearance Request form, the Employee Certification, and the statement from the DoD contract administrator validating the visit will be e-mailed directly to the ODC for processing through Spanish authorities. Additional information is available at the CNIC Naval Station Rota website (currently at http://www.cnic.navy.mil/regions/cnreurafswa/installations/ns_rota/about/gs-and-civilian-sponsorship.html). The current minimum required coverage insurance coverage for personal liability, property damage, and security deposit (Judiciary Bond to cover court expenses) must be met.

PART 5

5.0 SPECIFIC TASKS

5.1. Basic Services: In accordance with their specific skillsets, provide the following:

5.1.1. Support information and system security IAW DoD Risk Management Framework (RMF), the Certificate of Networthiness (CoN) and Risk Assessments. Scan assigned servers to determine vulnerability status and maintain documentation related to inspections. Create, update, and maintain plan of actions and milestones (POA&Ms) and POA&M deviation requests (waiver/exception). Assist Systems Administrators to conduct detailed analysis of missing patches, report findings to the Cyber Security Office on a weekly basis. Enforce security and ensure proper security and system access authorizations are granted. Provide documentation to achieve and maintain ATO according to applicable DoD, Army, MEDCOM, MHS, and DHA requirements. Provide architectural/boundary diagrams for accreditations and Risk Assessments.

5.1.2. Validate deployment plans for compliance with existing performance limitations of the enterprise servers’ software and report on any degradation of services that may occur as a result of deploying new solution(s).

5.1.3. Evaluate and provide a report on the impact of applying STIG and IAVA fixes and patches; make recommendations as needed to maintain functionality of assigned systems. Install and implement critical patch updates and configurations.

5.1.4. Coordinate and follow DHA processes such as Change Management Framework which includes test, validate, submit, and secure approval to implement and deploy changes within the production environment.

5.1.5. Create, update, employ and enforce the Change Management Framework and procedures IAW DHA J-6 CM Policy Letter, Enterprise Management Technical Working Group (EM TWG) and the Infrastructure Change Advisory Board(s)—to include the Infrastructure and Operations Technical Review Board (TRB) and other boards that result from organizational shifts.

5.1.6. Manage Information Technology Service Management (ITSM) ticket queues. Resolve customer issues, responding to specialized and/or high impact issues on a priority basis; document efforts in the ITSM system. Perform monthly trend analysis and run ticket queries as necessary to ensure Change Request assessments are completed no later than 24 hours prior to the scheduled Technical Review Board (TRB) meeting.

5.1.7. Weekly Activity Reports (WAR) These reports should be submitted in bullet format (cohesive bullet statements) to the responsible functional lead. The Contractor may use either a slide or document format containing the following sections:

· Accomplishments: Tasks and achievements accomplished during the previous week. List, the associated Remedy ticket number (if the task is received in such manner), percentage of completion if the effort is not yet complete, impact of accomplishment (i.e., service impact or improvement to a specific site or low number of end users, several sites and end users, or enterprise-wide impacting all sites and all users), and the associated project or system title.

· Planned: Planned task and initiatives, along with planned dates of execution (suspense dates).

· Executive-level/critical items of interest: These are risks, issues, or items of interest brought to the Government’s attention that may have an impact on DHA operations and initiatives.

5.1.8. As appropriate for skillset, utilizing appropriate standard operating procedures (SOPs) and other supporting documentation, maintain the enterprise infrastructure by conducting, at a minimum, health checks, connectivity troubleshooting, bandwidth and alert monitoring; configure and adjust tools and components for conditions as determined to impact performance and scalability; build, deploy, and configure servers, End User Devices (EUDs), and other related machines and components; work with hardware and software vendors to resolve complex issues. Create technical and procedural documentation, such as SOPs, checklists, guides, etc. for issues where no guidance exists and to maximize process efficiencies.

5.1.9. Analyze evolving business requirements and recommend appropriate actions involving Information Technology products, processes, and people. Proactively maintain and expand knowledge of trends, developments and new technologies related to the enterprise’s IT-supported hardware and software applications. Research, evaluate, and provide input on new software products; research, evaluate and recommend enhancements to current policies, procedures, and technologies. Participate in integrated project teams and task forces designed to streamline workflow and/or resolve issues in the deployment and/or operational phases.

5.1.10. Prepare and distribute Situational Report (SITREP), Executive Summary (EXSUM), and Unscheduled Downtime Report (UDR) and supporting documents for critical and/or unplanned service outages.

5.1.11. Support technical services; create and maintain a log of all operational events, alerts, and alarms; a resilience and fail-over testing schedule; a Secure Operational Document Library; and operational work schedules.

5.1.12. Communicate effectively both orally and written with customers, stakeholders, and technical specialists. As required, work directly with customers to resolve issues. Effectively lead detailed technical discussions and develop and present required briefing materials to ensure the customer’s needs are met in accordance with DoD, military Service branches, and DHA requirements. Participate in technical working groups strategizing for future requirements and propose architecture enhancements based on business needs.

5.1.13. Provide technical input in the design and documentation of applicable training programs. Provide best practices for user education/communication. Perform training sessions for Tier 2 and 3 support staff to include troubleshooting processes.

5.1.14. Review FAQs and provide additional Knowledge Base articles and lessons learned applicable to the environment.

5.1.15. Develop, provide, and maintain detailed descriptions, models, details, and diagrams of all interfaces, via customer modifiable Visio format, or other DHA-sanctioned toolset.

5.1.16. As applicable, create and/or update technical, procedural, and agreement documentation, such as SOPs, Memorandums For Record (MFRs), EXSUMs, Operating Level Agreements (OLAs), Memorandums Of Agreement (MOAs), Memorandums Of Understanding (MOUs), information papers, briefings, governance documentation, policies, and procedures.

5.1.17. As applicable to architecture, engineering design and support, provide technical documentation for technical forums to include Engineering IPT aligned engineering packages, guidance, and assistance with engineering or re-engineering. Use approved MHS/DHA documentation production standards and templates.

5.2. Tier 3 Level Enterprise Management (EM) Administration Support Services.

5.2.1. Manage DHA IT Infrastructures utilizing approved EM tools (currently Microsoft Endpoint Configuration Manger (MECM)).

5.2.2. Install, configure, and maintain the EM infrastructure at the proper approved release levels. Assist End Users in the deployment of the EM client management tool. Perform ongoing maintenance to ensure server health, including database and server maintenance.

5.2.3. Install, maintain, and administer the EM instance, to include granting access, managing permissions, setting up workflows and the proper 2-person integrity for actions and other required administrative actions.

5.2.4. Modify the EM configuration and Server Management System (SMS_DEF.MOF) to collect information from the registry and Windows Management Instrumentation (WMI) repository. Analyze EM log files and the current enterprise configuration.

5.2.5. Troubleshoot and help remediate sites experiencing EM issues.

5.2.6. Assist with migrating user files and settings using migration tools, such as Microsoft User State Migration Tool (USMT).

5.2.7. Monitor ongoing operations and sustainment activities for potential problems, improvements, staffing issues, and End User shortfalls.

5.2.8. Utilize default and ad-hoc reporting tools to provide asset, software, and hardware intelligence, software and hardware metering, and license management reports. Produce and update EM, and SQL reports for enterprise and customer needs. Utilize PowerShell, WQL and SQL to develop new reports and modify existing reports. Deliver reports on routine and as needed basis. Generate standard and dynamic reports in multiple formats such as web based, MS Excel, PDF, etc., per customer’s request. Manage and maintain EM Dashboards.

5.2.9. Provide patch management support and maintenance window operations. Validate deployment plans for compliance within existing performance limitations of the enterprise servers’ software. Provide a status report before and after updates and remediation actions are executed.

5.2.10. Create, update, deploy, troubleshoot, and remove objects in the EM environments, sites, distribution points (DPs), and clients based on provided guidelines. Create, update, and delete dynamic and static collections and groups, reports for installation, modification, and removal of applications.

5.2.11. Create custom test environments to provide proof of concept before implementing into production. Maintain disaster recovery capability and procedures for the EM environments. Maintain and update daily, weekly, monthly, and quarterly checklists for enterprise configuration management and preventative maintenance. Send notification to customers and groups prior to and after implemented requests or modifications.

5.2.12. Design and deliver applications and application packages using available enterprise management products and tools that provide scripting capabilities for MHS/DHA enterprise delivery. Manage application baselines and configurations and fully test integration. Leverage virtual device, design, and delivery models. Understand and integrate STIG settings into applications and packages for compliance. Provide IAVM compliance for applications and application packages. Thoroughly evaluate, validate, and execute application packages and validation cases, and ensure that packages provide detailed logs; document and provide evaluation results. As required, work with site administrators to troubleshoot package deployments, removals, and modifications

5.2.13. Create desktop, EUD, and server images utilizing technologies such as Business Desktop Deployment (BDD), Microsoft Deployment Toolkit (MDT), Windows Deployment Services (WDS), Windows Pre-installation Environment (WinPE), Windows Automated Installation Kit (WAIK), and Pre-Boot Execution Environment (PXE). Create, implement, and deploy images for enterprise workstations and servers; develop and document processes to deploy zero-touch images (ZTI) for an enterprise environment utilizing OSD. Maintain and update imaging documentation.

5.2.14. Create custom enterprise level OSD Task Sequences utilizing Microsoft scripting technologies and components, such as PowerShell, VBScript, WMI, .NET and XML for captured images; assess and validate non-standard hardware / software, to include new enterprise MECM OSD related products, to ensure operability in the enterprise; provide a report on results. Provide enterprise administrators with current drivers for assigned hardware within the OSD process. Ensure appropriate drivers are used for assigned hardware. Add, distribute, and install images.

5.2.15. Provide senior level technical support for troubleshooting of OSD related issues.

5.2.16. Send notification to customers and groups prior to and after implemented requests or modifications.

5.2.17. Manage and operate the ITC environment, ensuring system performance and availability requirements are met.

5.2.18. Develop ITC processes for establishing testing environments.

5.2.19. Ensure changes are not implemented in ITC environments without appropriate approvals and documentation.

5.2.20. Resolve ITC incidents and problems.

5.3. Tier 2 Level Systems Administration Support Services:

5.3.1. Support the Tier 2 (Continuous Operations) 24x7 operations mission. Maintain and troubleshoot enterprise level products and services, including hardware (servers and end-user devices) firmware, and software.

5.3.2. Triage, troubleshoot and resolve issues involving server patches and configurations, software issues, and scheduled maintenance events. Utilize Information Assurance tools to validate proper installation and function of deployed security patches and solutions.

5.3.3. Modify, create, and configure Active Directory (AD) User Accounts; recover and restore AD objects. Support mobile computing and end user devices to include resetting and configuring devices. Identify and troubleshoot EM issues related to patches and servers. Troubleshoot and resolve DAR issues.

5.3.4. Provide Site Administrator support and Enterprise monitoring for Group Policy Objects (GPO), initial troubleshooting of GPOs, adding Security Groups to group policies.

5.3.5. Perform system administration tasks on Enterprise server and end-user clients, extend scheduled lockout condition, initiate data recovery operations and unlock machines as required. Install, administer, and perform password management for Enterprise software.

5.3.6. As required to resolve issues, remotely access government equipment. If unable to resolve an issue, escalate to Enterprise Operations (Tier 3). Provide the de-escalation path back to the MTF or lower tier.

5.3.7. Monitor enterprise assets via SCOM, Quest Suite of Tools, and other related applications. Ensure core services are maintained at normal production levels with no unplanned service interruptions. Create and distribute Unscheduled Downtime Report (UDR), SITREPs, After Action Reports (AAR), Information Papers and EXSUM documents for critical service outages and/or unplanned interruptions. Document and update incident(s) (via Ticketing System) with information relevant to the incident and/or outage.

5.3.8. The contractor shall operate, maintain, and administer the MED365 tenancy IAW this PWS. This includes fulfilling the following roles in the DHA tenant, User Admin, License Admin, Teams Admin, SharePoint Admin, Security Admin, Authentication Admin, Global Admin, Exchange Admin, and Help Desk Admin

5.3.8..1. Perform administrative functions associated with Azure Information Protection/data labeling and control.

5.3.8..2. Manage user data retention policies, to include placing data in litigation hold.

5.3.8..3. Review licensing assignments and permissions related to eDiscovery.

5.3.8..4. Perform content searching as required. Responsible for conducting content searches related to various scenarios to include, but not limited to, Unauthorized Disclosure of Classified Information, Freedom of Information Act, Law Enforcement/Counterintelligence, Personally Identified Information, or malicious content and take appropriate action to remedy request by either deleting the content or exporting to an acceptable repository for additional analysis or export. Content searches will only be conducted when directed by government representative.

5.3.8..5. Ensure tenant federation with all other DoD tenants.

5.3.8..6. Follow all DoD Security requirements for tenant configurations including applicable STIG, DHA Tasking Orders, CYBERCOM Orders.

5.3.8..7. Interact with the DHA CSSP/DCO team on any cyber incidents or orders. Provide log to CSSP/DCO team in response to security requirements. Remove user access, specific files or content as directed by CSSP/DCO team.

5.3.8..8. Advise and coordinate with DHA PMO ISSM and implement any changes directed by ISSM.

5.3.8..9. Manage and review technical security events including malicious emails, files, and content.

5.3.8..10. Manage and scope spillage events to determine scope of issues and coordinate with technical POCs and Mission Partner POCs

5.3.8..11. Review security configuration and technical data to ensure a secure environment.

5.3.8..12. Follow Change Management practices to schedule and implement approved changes within the tenant. Follow change coordination practices to notify stakeholders of scheduled maintenance events and expected impact.

5.4. Tier 3 Level Systems Administration Support Services:

5.4.1. Analyze, validate, implement, maintain, and configure current services and tools (examples include Active Directory (AD), System Center Operations Manager, Quest, Dell Quest maintenance tools) to minimize negative impacts to performance and scalability; work with other organizations and MTFs to coordinate operations and support of directory services across the enterprise; sustain and provide advanced enterprise-level support for AD services and functions; document technical solutions as required. Utilize available tools, such as Quest Suite of Tools, to manage schema extensions, sites and services, domains and trusts, Group Policy Objects (GPO) administration and Organizational Unit (OU) administration.

5.4.2. Support and maintain Lightweight Directory Access Protocol (LDAP) architecture to provide authentication, synchronization, user provisioning, and authorization services for AD user accounts.

5.4.3. Validate data encryption services on desktops and laptops for adherence with DHA and DoD regulations and policies; support deployment and maintenance of new government approved data encryption solutions as they become available.

5.4.4. Manage and monitor Data Encryption services to ensure systems and all supported devices are updated; create, deploy, upgrade, and install data encryption client packages, files, and policies in accordance to maintenance window policies. Provide data encryption services status reports.

5.4.5. Collaborate and support future data encryption projects initiated by DHA and DoD.

5.4.5..1. Support the Tier 3 Enterprise Operations mission. Validate Microsoft Intune (Cloud) and Microsoft BitLocker (On-Prem) solutions on desktops and laptops for adherence with DHA and DoD regulations and policies; support deployment and maintenance of new government approved DAR data encryption solutions as they become available.

5.4.5..2. Manage and monitor Intune and BitLocker services to ensure systems and all supported devices are updated; create, deploy, upgrade, and install DAR data encryption client packages, files, and policies in accordance with maintenance window policies.

5.4.5..3. Provide direct troubleshooting for all clients regarding encryption, policy, compliance/reporting, and all recovery efforts for both cloud and on-prem BitLocker agents.

5.4.5..4. Collaborate and support future DAR data encryption projects initiated by DHA and DoD. Provide a report and/or briefing on efforts necessary to implement new solution and any degradation of services that may result.

5.4.6. Processes tickets received from the Tier II support desk to resolution. Escalation point from Tier II. Elevate appropriate tickets to Tier IV for resolution.

5.4.7. Design and test capability enhancements for use in MED365.

5.4.8. Work with the government Project Office/Lead to collect and prioritize enhanced or new features for use in MED365.

5.4.9. Configure the Cloud Service Offering (CSO) to support user data retention, documentation-marking, redactions, policies, controls, and deduplication of files IAW governance provided. Validate current processes and conduct testing / validation of implementation.

5.4.10. Support the resolution of and monitor tickets with product vendors in support of the MED365 capability.

5.4.11. Coordinate enhancement capability and schedule with government Project Office/Lead.

5.4.12. Develop plans and strategic communications for announcing capability enhancements and schedule that reflect Contractor planned releases to the capabilities being released into IL5.

5.4.13. Take actions to secure capability enhancement for government use.

5.4.14. Support the resolution of and monitor tickets with commercial product vendors in support of the MED365 capability.

5.4.15. Monitor planned future commercial product enhancements in support of MED365.

5.4.16. Advise on best practices to be followed within MED365.

5.4.17. Using MS SCOM, monitor system uptime availability and maintain the framework for new and existing applications, servers, and services that require monitoring at the enterprise level.

5.4.18. Analyze DHA current enterprise system monitoring implementation and provide a status report before and after remediation actions engineered and executed.

5.4.19. Customize enterprise monitoring rules, alerting, and reporting functions for applicable DHA applications and servers, and produce reports depicting the performance indicators for these applications and servers, such as “uptime” and “downtime.”

5.4.20. Maintain disaster recovery capability and procedures and ensure all enterprise monitoring servers are compliant to the latest appropriate DISA STIGs.

5.4.21. Implement digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling.” Manage, and maintain Public Key Encryption (PKE) and Public Key Infrastructure (PKI) in a Windows environment for compliance.

5.4.22. Support installation and maintenance of physical and virtual servers, enhance efficiency of critical systems, and ensure compliancy with applicable Army, DoD, and industry guidelines and policies.

5.4.23. Develop, validate, and document Disaster Recovery (DR) procedures for all supported device types within the enterprise.

5.4.24. Produce/update checklists, guides and/or standard operating procedures for enterprise monitoring and preventative maintenance.

5.4.25. As necessary, prepare After Action Reports for submitted SITREPs, EXSUMs and UDRs.

5.5. Information Assurance Security Admin Support Services:

5.5.1. Support the mission of the Information Systems Security Officer (ISSO) for all DHA managed systems under the ISSO’s responsibility. Ensure network resources are in compliance with DoD IA and security policies and vulnerability alerts, all IAVAs and any other technical advisories identified by the USCYBERCOM/DHA. Category 1, Category A, and other urgent rated vulnerabilities shall be fixed within 21 days. Most Category 2 and 3 rated vulnerabilities should be resolved during a routine maintenance window; however, some may require manual remediation(s), or a shorter timeframe.

5.5.2. Administer, record, and support the upkeep of all network resources and any implemented changes as reported by the Continuous Monitoring and Risk Scoring (CMRS)/ACAS/other scanning tools. Ensure all discovered discrepancies or security vulnerabilities, such as missing patches or perceived gaps in network security, are immediately resolved through the necessary DHA offices and service functions. Plan of Actions and Milestones (POA&Ms) shall be created, maintained, and followed through to resolution for issues requiring additional time for testing, solutions development, team collaboration, and deployment. POA&Ms will include detailed/applicable risk mitigation statements, and appropriate milestone dates.

5.5.3. Perform IA scans of network enterprise devices using tools such as, Security Content Automation Protocol (SCAP) Compliance Checker (SCC) Tool, manual checks, DISA STIG Viewer, ACAS Nessus Scanner, ACAS Security Center and MECM.