Draft PWS - CAX WMS.pdf

Performance Work Statement Naval Medical Readiness Logistics Command (NMRLC) Cheatham Annex (CAX) Warehouse Modernization

1. Background

The Naval Medical Readiness Logistics Command (NMRLC) is a vital command within the Bureau of Medicine and Surgery (BUMED) enterprise. NMRLC’s mission is to develop, acquire, produce, field, sustain, and provide enduring lifecycle support of medical materiel solutions to the Fleet, Fleet Marine Force, and Joint Forces in high-end competition, crisis, and combat. To achieve its mission, NMRLC must utilize modernized, agile, and secure systems to manage and distribute medical equipment, combat-support kits, and pharmaceutical inventories across both domestic and overseas locations.

A prototype Warehouse Management System (WMS) at Cheatham Annex (CAX) in Williamsburg, VA, incorporating Radio Frequency Identification (RFID), Robotic Process Automation (RPA), and Optical Character Recognition (OCR) systems has been designed and deployed which successfully proved the feasibility of digitalized warehousing operations. The prototype is built on Microsoft D365, which serves as the core Warehouse Management Application (WMA) and integrates RPA, RFID, and OCR functionalities into a single, cloud-native solution.

While the initial prototype, a robust, secure, and highly scalable follow-on modernization, enhancement, and sustainment program is required. This follow-on effort is critical to NMRLC’s mission success. Consequently, this contract will not fund any new discovery, requirements gathering, or initial design work.

2. Scope

NMRLC requires contractor support to modernize, enhance, and sustain the NMRLC WMS. This WMS will support total asset visibility and improve financial audit readiness standards. The Contractor shall transition the prototype WMS into a secure, operational cloud-native system.

This effort is focused on the NMRLC-designated warehouses at Cheatham Annex (CAX), Williamsburg, Virginia.

The Contractor must use the existing prototype, source code, and design documents as the starting point for this project. This contract will not fund any "from-scratch" discovery, user requirements gathering, or initial design work. All activities must focus on validating the existing system, identifying what is needed to move it to the new network, and making technical improvements. The software code, database structures, interface specifications, and architectural diagrams developed for the prototype will be provided as Government-Furnished Information

(GFI).

Key activities within this scope include:

• Agile Program and Delivery Management: Implement iterative project, risk, and program management methodologies for software delivery and reporting.

• System Modernization and Enhancement: Update, upgrade, and secure existing WMS configurations through major and minor software releases to resolve bugs and deploy user-valued functional improvements.

• Warehouse Operations Improvement: Improve operations at Cheatham Annex (CAX) by optimizing system workflows and integrating mobile, automated data capture, and process automation technologies (RFID, OCR, and RPA).

• Comprehensive Sustainment: Manage WMS hardware, software, licenses, and cloud infrastructure to minimize operational downtime.

• Cybersecurity and ATO Certification: Resolve outstanding security conditions to transition the system from an Authority to Operate with Conditions (ATO-C) to a full ATO on the DHA Medical Community of Interest (MedCOI).

• Documentation and Training: Develop and maintain system documentation, user manuals, and training materials for end-users and administrators.

3. Tasks

Throughout performance of this requirement, the Contractor shall manage the system updates, maintenance, and operational transformation of the CAX warehousing environment.

3.1. System Baseline Validation & Planning. The contractor shall

3.1.1. Conduct a Delta Assessment of the existing WMS prototype architecture, infrastructure, data health, and security posture for migration to the DHA MedCOI network and submit a System Baseline Validation & Execution Plan within 14 days of contract award.

3.1.2. Participate in recurring status reviews with NMRLC stakeholders to report on technical progress, system metrics, schedule alignment, and risk mitigation. The Contractor shall develop and submit a Monthly Status Report (MSR) by the 10th of each month.

3.1.3. Utilize a modern software delivery methodology that ensures rapid, transparent, and continuous delivery of value. The Contractor shall facilitate regular alignment sessions and reviews with the NMRLC Product Owner to ensure full transparency regarding project capacity, delivery velocity, and backlog prioritization.

3.1.4. Maintain a Project Management Plan (PMP) with an Integrated Master Schedule (IMS) and a dedicated Risk Management Plan.

3.2. System Design Refinement & Security Planning.

The Contractor shall provide software engineering, data integration, and cybersecurity services that ensure the WMS remains a highly available, secure, and fully integrated cloud-native solution. The contractor shall:

3.2.1. Develop a System Design Refinement and Target Operating Model by ingesting, validating, and updating the existing GFI design artifacts to reflect the final cloud-native target environment (DoDAF v2.0 compliant).

3.2.2. Manage and mature an enterprise data strategy within the approved cloud environment (Azure).

3.2.3. Deploy software enhancements and bug fixes without degrading existing system stability or core functionalities. Ensure the WMS environments remain secure, stable, and current with the latest updates via continuous integration and continuous deployment (CI/CD).

Provide a tiered triage of operational Help Desk to effectively resolve CAX user issues.

3.2.4. Maintain real-time ledger accuracy within the WMS to fully support the APSR through periodic physical inventory cycle audits, ensuring that the WMS, RPA script configuration, or system data quality does not restrict, delay, or hinder audit, physical materiel handling, warehousing, or storage operations.

3.2.5. Proactively and rapidly manage, apply and remediate the system’s security posture, verified via ACAS vulnerability scanning reports.

GOVERNMENT REVIEW & CRITICAL PAUSES: The Contractor’s delivery schedules and performance metrics regarding ATO achievement shall account for standard Government review periods. In the event of a “critical pause” or delay caused exclusively by external Government actions or dependencies, the Contractor shall formally notify the Contracting Officer’s Representative (COR) and Information System Security Manager (ISSM) in writing. Time elapsed during these formal periods will result in a “stop-the-clock” status.

3.3. System Modernization, Hardware Staging & BOM

3.3.1. Provide end-to-end sustainment and lifecycle management for all WMS system components (Cloud Architecture & Software Management, Hardware Lifecycle & Service Contracts, Bill of Materials).

3.4. Validation, Training, & UAT Preparation

3.4.1. Maintain and update System User Manuals (SUMs), Quick Reference Guides (QRGs), and desk guides, and provide on-site and virtual training sessions.

3.5. Final Deployment, ATO, & Transition-Out

3.5.1. Ensure system readiness by facilitating comprehensive User Acceptance Testing (UAT) with local stakeholders.

3.5.2. Execute the on-site system roll-out and provide dedicated, on-site “hyper-care” support until the facility achieves the Acceptable Quality Level (AQL) of zero (0) severity-1 defects.

3.5.3. Successfully transition the system from its current ATO-C to a full ATO. Resolve existing ATO-C conditions to achieve full ATO on MedCOI, and maintain RMF compliance.

3.5.4. Detailed execution plan ensuring zero operational degradation during vendor turnover

4. Deliverables

PWS

Ref

Deliverable Description Frequency / Due Date Required Outcome / Format

Standard

Entire

PWS

Monthly Status Report

(MSR)

Monthly, by the 10th calendar day

Digitally accessible; must provide actionable visibility into risks, financial burn rates, and technical progress.

3.1.1 System Baseline Validation & Execution Plan

Within 14 days of award

Comprehensive digital strategy detailing technical debt, gaps, and the forward operational roadmap.

Must prove 100% utilization of

GFI.

3.1.4 Project Management

Plan (PMP) & IMS

Within 30 days of award; updated quarterly

Editable digital scheduling format that allows for critical path analysis and dependency tracking.

3.2.1

System Design Refinement Documentation (DoDAF charts)

Within 60 days of award; updated annually

Digital architecture format ensuring DoDAF v2.0 compliance and validation of existing baseline models.

3.2.2

Initial Data Synchronization Report (DMLSS to

WMS)

Within 90 days of award

Sortable data file demonstrating initial ledger match rates between legacy DMLSS and the modern

WMS.

3.2.6 ATO-C Remediation

Plan

Draft within 30 days of award; Final within 45 days of award

Actionable roadmap documenting exact steps to resolve all ATO conditions.

3.2.6 Security Traceability Matrix (SRTM) &

POA&M

Updated continuously;

submitted monthly

Actionable data format compatible with continuous vulnerability tracking (e.g., raw ACAS outputs).

3.3.1 Comprehensive Bill of Materials (BOM) & License Registry

Initial within 30 days of award; Updated continuously and submitted quarterly

Searchable, sortable, and filterable digital format providing real-time visibility into asset lifecycles and expirations.

3.4.1 Training Material Updates (SUMs/QRGs)

Within 15 days of any major software release

Easily distributable and readable formats for end-users on the warehouse floor.

3.5.1 UAT Plan Due 30 days prior to

UAT execution

Comprehensive testing script and protocol aligned with Cheatham Annex standard operating procedures.

3.5.2 Final Site Acceptance

Report

Due at conclusion of on-site Hyper-Care

Formal, signable documentation validating that the system meets all site-specific operational requirements with zero severity-1 defects.

3.5.3 Complete ATO

Package

Submitted NLT 60 days prior to the expiration of the current ATO-C

Secure, consolidated package meeting all RMF artifact requirements for Authorizing Official (AO) review.

3.5.4 Transition-Out Plan 100 days prior to

contract expiration

Detailed execution plan ensuring zero operational degradation during vendor turnover.

5. Other Pertinent Information

5.1. Place of Performance

The primary place of performance shall be at the Contractor’s facility. On-site operational tasks, training, and integrations will occur at NMRLC Williamsburg, VA (Cheatham Annex).

5.2. Government Furnished Equipment/Property/Information (GFE/GFP/GFI)

The Government will provide the Contractor with Common Access Cards (CACs), remote virtual private network (VPN) access accounts, and authorized Government-furnished laptops.

The Government will also provide relevant documentation, technical interfaces, and existing legacy system source repositories as GFI.

6. Acronyms

Acronym Definition ACAS Assured Compliance Assessment Solution APSR Accountable Property System of Record ATO Authority to Operate BUMED Bureau of Medicine and Surgery CAX Cheatham Annex CCB Change Control Board CI/CD Continuous Integration/Continuous Deployment DMLSS Defense Medical Logistics Standard Support DoDAF Department of Defense Architecture Framework IMS Integrated Master Schedule ISSM Information System Security Manager MSR Monthly Status Report NMRLC Naval Medical Readiness Logistics Command OCR Optical Character Recognition PMP Project Management Plan POA&M Plan of Action and Milestones PWS Performance Work Statement QASP Quality Assurance Surveillance Plan QRG Quick Reference Guide RFID Radio Frequency Identification RPA Robotic Process Automation SUM System User Manual UAT User Acceptance Testing WMA Warehouse Management Application

WMS Warehouse Management System

7. Quality Assurance Surveillance Plan (QASP)

Purpose: To ensure that the Government has an effective and systematic method of surveillance for the services in the PWS. The QASP will be used primarily as a tool to verify that the contractor is performing all services required by the PWS in a timely, accurate and complete fashion.

1. Critical performance processes and requirements. Critical to the performance of CAX

Warehouse Modernization is the timely, accurate and thorough completion of all contract/task order requirements.

2. Performance Standards

a. Schedule - The due dates for deliverables and the actual accomplishment of the schedule will be assessed against original due dates and milestones established for the contract or task order(s).

b. Deliverables – The deliverables required to be submitted will be assessed against the specifications for the deliverables detailed in the contract/task order(s) and the Quality Control Plan (QCP), if required by the contract, for the required content, quality, timeliness, and accuracy.

c. Past Performance - In addition to any schedule, deliverables, and cost aspects of performance discussed above, pursuant to FAR 42.15, the Government will assess the contractor’s record of conforming to contract requirements and to standards of good workmanship, the contractor’s adherence to contract schedules including the administrative aspects of performance, the contractor’s history of reasonable and cooperative behavior and commitment to customer satisfaction, and the contractor’s business-like concern for the interest of the customer.

3. Surveillance methods: The primary methods of surveillance used to monitor performance of this contract will include, but not be limited to, random or planned sampling, periodic or inspection, and validated customer complaints.

4. Performance Measurement: Performance will be measured in accordance with the following table:

Performance

Element Performance Requirement

Surveillance Method Frequency Acceptable Quality

Level

Contract Deliverables

Contract deliverables furnished as prescribed in the PWS, attachments, Inspection by the COR

100% inspection of all contract deliverables.

>95% of deliverables submitted timely and without rework required.

CDRLs, Task Orders, etc., as applicable.

Overall Contract Performance

Overall contract performance of sufficient quality to earn a Satisfactory (or higher) rating in the COR’s annual report on Contractor Performance

Assessment by the COR Annual

All performance elements rated Satisfactory (or higher)

Invoicing

Monthly invoices per contract procedures are timely and accurate.

Review & acceptance of the invoice

Monthly 100% accuracy

System Baseline Validation (Task 3.1.1)

Rapid establishment of an accurate technical baseline and execution strategy.

TPOC review and approval of the submitted plan.

One time Comprehensive Assessment and Execution Plan submitted on or before day 14 of the Period of Performance.

Release Quality and Stability (Task 3.2.3)

Deploy software enhancements and bug fixes without degrading existing system stability or core functionalities.

Release logs and Help Desk ticket analysis post-deployment. Monthly

< 5% of deployed releases result in critical roll-backs or emergency hotfixes within 48 hours of deployment.

SLA

Resolution (Task 3.2.3)

Triage and resolve Help Desk tickets based on severity.

Help Desk ticketing platform metrics. Monthly

Severity 1: <= 4 hours; Severity 2:

<= 24 hours.

Audit Readiness (Task 3.2.4)

Maintain ledger accuracy in WMS to support APSR.

Periodic physical inventory cycle audits of 100 records Quarterly

Record-to-physical inventory and materiel quality data reconciliation match rate of >= 98%.

Security Patching (Task 3.2.5)

Rapidly apply cybersecurity patches and critical upgrades.

Verification via

ACAS

vulnerability scanning reports. Monthly

100% of critical patches applied within 48 hours of release.

Asset and License Management (Task 3.3.1)

Proactively manage all software licenses, cloud service contracts, and hardware warranties to prevent lapses.

Periodic review of the submitted BOM and License Registry.

Quarterly Zero (0) days of lapsed support, expired warranties, or expired software licenses for active system components.

ATO

Achievement and Sustainment (Task 3.5.3)

Resolve existing ATO-C conditions to achieve full ATO on MedCOI, and maintain RMF compliance.

ISSM review of ATO Package, POA&M, and final Authorizing Official (AO) signature. One time

100% of ATO-C conditions resolved by Remediation Plan deadline. Zero

(0) days of lapsed ATO status.

Fully Operating System Deployment Success (Task 3.5)

CAX Full transition to the

WMS

Final system acceptance sign-off by COR, and Help Desk ticket analysis.

One time

100% of designated warehouses deployed. Zero (0) critical system rollbacks required, and zero (0) severity-1 defects upon exiting hyper-care.

If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

INCENTIVES, DISINCENTIVES, AND FINANCIAL DEDUCTIONS

The Government will incentivize the Contractor to provide quality products and services in a timely manner. This section outlines the remedies and financial deductions the Government may apply in cases of substandard performance or missed milestones. These remedies are not mutually exclusive and may be applied in combination.

A. Performance Incentives & Correction of Work In accordance with the inspection of services provisions of this contract, the Government may require the Contractor, at no additional cost, to replace, re-perform, or correct any work that fails to meet the requirements specified in the Performance Work Statement (PWS) and the Quality Assurance Surveillance Plan (QASP).

B. Financial Deductions for Substandard Performance

If the Contractor fails to meet the Acceptable Quality Level (AQL) for any performance element identified in the QASP's Performance Measurement table, the Government reserves the right to apply a financial deduction from the monthly invoice corresponding to the period of deficient performance. The deduction will be calculated as a percentage of the total monthly invoice value, as specified below:

1. Security Patching (Task 3.2.5): Failure to apply 100% of critical patches within 48 hours will result in a 5% deduction from the monthly invoice.

2. Asset and License Management (Task 3.3.1): Any lapse in support, warranties, or licenses for active system components will result in a 5% deduction from the monthly invoice for each month the lapse persists.

3. Release Quality and Stability (Task 3.2.3): If more than one of deployed releases result in critical roll-backs, it will result in a 10% deduction from the monthly invoice.

C. Financial Deductions for Missed Milestones

The timely delivery of all items specified in the Deliverables table is critical to mission success.

For each calendar day that a deliverable remains unsubmitted past its required due date (excepting excusable delays approved in writing by the Contracting Officer), the Government shall assess a liquidated financial deduction of $500.00 per day, per deliverable. This deduction will be capped at 10% of the total contract value. The assessment of this deduction does not constitute a waiver of the delivery requirement.

D. Administrative Remedies

1. Contract Discrepancy Report (CDR): For each item that does not meet acceptable levels, the Government may issue a CDR. The contractor must reply in writing within five (5) calendar days of receipt, identifying the root cause and a corrective action plan to prevent recurrence. The Contracting Officer will review the response to determine if further action is required.

2. Annual Performance Reporting (CPARS): The COR will prepare an annual Contractor Performance Assessment Report (CPARS). Failure to achieve satisfactory performance, as documented in this report, may result in the termination of the contract and will be used to assess the contractor's eligibility for future Government contracts.