Draft_PWS_CMATS.docx

PERFORMANCE WORK STATEMENT (PWS)

HC1028-23-F-0003 – Continuous Monitoring Risk Scoring (CMRS) Development and Sustainment HC1028-25-F-0166 – Device Attribution Tagging Tool (DATT) / Tagging, Reporting and Attribution Configuration Suite (TRACS) Maintenance and Implementation Support

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact (POC)

b. Alternate COR (ACOR). See DITCO Additional Text G1 - POC

c. Property Administrator (PA) See DITCO Additional Text G1 - POC

2. Contract Title. Continuous Monitoring Analytical Tool Set (CMATS) Development and Sustainment

3. Background. The Department of Defense (DoD) implements a multi-tiered cybersecurity risk management process to protect United States (U.S.) interests, spanning from the enterprise level DoD to individual Information Systems (IS). This process is guided by DoD Instruction (DoDI) 8500.1, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39, and the Cybersecurity Risk Management Construct (CSRMC), previously the Risk Management Framework (RMF) established in DoDI 8510.01.

CMATS Is a suite of Government off-the-shelf (GOTS) software that provides data which contributes to global and organizational views of inventory, compliance, vulnerability, and risk. CMATS enables near-real-time cybersecurity visualization by integrating data from various DoD Enterprise Cyber Security applications, and it supports automated processes used in support of cyber blue force tracking, risk management, near-real time awareness of devices and software inventory and configuration compliance. CMATS enables the Information Security Continuous Monitoring (ISCM) strategy as part of the DoD Continuous Monitoring Strategy, and it provides DoD decision makers with device attribution data required for mission systems to enable ISCM. The attribution data provides Situational Awareness (SA) and Command and Control (C2) at all levels of the DoD such that system property custodians, users, and administrators can visualize data for endpoints under their purview and maintain attribution information meaningful to them, but that same data can be used to build SA and C2 capabilities at all higher echelons, up to the Secretary of Defense (SECDEF).

The tools within the CMATS suite are:

· The Continuous Monitoring Risk Scoring (CMRS) system which aggregates, correlates and normalizes the vulnerability and configuration state of DoD Information Technology (IT) systems by providing measures of security control deployments and compliance including Security Technical Implementation Guide (STIG), patch compliance and deployed configuration settings. The current CMRS system is a Microsoft (MS) Structure Query Language (SQL) / Internet Information Server (IIS) application. The plan is to migrate the application to Platform as a Service (PaaS) in a Joint Warfighter Cloud Capability (JWCC) Azure Cloud environment.

· The Cyber Operational Attribute Management System (COAMS) contains a central repository of a dynamically maintained hierarchies of names used in reporting of cyber data which are dynamically exposed in Application Program Interfaces (APIs) as updates are made. COAMS currently contains hierarchies of organization, location, system, and other names. The current COAMS system is an MS SQL Server / IIS application. The plan is to migrate the application to PaaS in a JWCC Azure Cloud environment.

· The Enterprise User Management (EUM) system is a central permission store register that manages user and non-user COAMS-based permissions for CMATS portfolio applications. EUM maintains the last login time, per user, as well as providing account lockout status and enabling account resets. The EUM system is an MS application that creates and manages user attributes and permissions. The plan is to migrate the application to PaaS in a JWCC Azure Cloud environment.

· The Information Assurance Vulnerability Management (IAVM) system is a capability used by analysts in DoD Cyber Defense Command (DCDC) and its components to analyze, filter, prioritize, and disseminate US Cyber Command directives (“IAVMs”) that require DoD agencies to apply certain patches to remediate high-risk vulnerabilities. The title and business logic currently implemented by the IAVM system will change in the coming years and both the name and the functionality of the IAVM system will need to change to address the changes. The current IAVM system uses an IIS application back end. The plan is to migrate the application to PaaS in a JWCC Azure Cloud environment.

· DATT is an endpoint application that brands and maintains C2 (C2 metadata, selected from COAMS hierarchies on individual DoD devices where it is exposed to enterprise sensors.

· Central Attribution Management Portal (CAMP) will allow users to centrally manage asset attribution data across multiple enterprise reporting systems and endpoint management solutions. CAMP will aggregate and standardize tag data from multiple DoD enterprise systems, to include DATT endpoint attributes and provide users with tools to fill gaps in missing attribution data, resolve tag discrepancies, automate and simplify tagging of endpoints, map existing datapoints to accurate tag values, and report on existing endpoints. In future iterations CAMP will integrate with endpoint management tools to synchronize with DATT endpoint attributes. The CAMP application is a PaaS SQL/IIS.

· Data Analytics Test Lab is primarily used in support of Configuration Management (CM) and concept development/validation for the production systems within the Program Acquisition Executive( PAE) -Cyber, Cyber Analytics Division (ID6) portfolio of capabilities. The ID6 lab also supports research, development, testing, and evaluation of technologies in the Cyber Analytics space, interoperability between current and possible future solutions, and advanced troubleshooting of production representative system baselines in support of resolving operational issues. The Data Analytics lab hosts on-premises and a JWCC Azure Cloud presence.

· The Endpoint Patch Management Service (EPMS) receives automated updates from the software vendors (Original Equipment Manufacturers) via a patch-packaging vendor solution from the Internet onto the Non-Secure Internet Protocol Router Network (NIPRNET) and then utilizing Defense Information Systems Agency (DISA) supplied infrastructure to move these patches to Secret Internet Protocol Router Network (SIPRNET) for availability to DoD for all DoD Information Network (DoDIN) customers. Patch content will include a list of DISA-approved, MS and non-native, third-party application content. All patch content will be available for download from a secure DISA-hosted Patch Repository or similar Enterprise Repository. This program does not fall under the CMATS portfolio of analytic tools.

This PWS outlines the requirements for continued development, sustainment, support and modernization for the CMATS portfolio, ensuring robust endpoint attribution tag management, policy management, and continuous monitoring across the DoD.

4. Objectives: This contract is to acquire the resources necessary for continued development, sustainment, support and modernization of the systems and applications in the CMATS portfolio. This includes the sustainment and modernization of CMATS capabilities via software releases throughout the base and option periods (OPs) of this contract based on requirements identified by the Government and Stakeholders to meet operational needs and to maintain those updates in the DoD network.

The primary objectives of this PWS are:

· Develop, sustain, modernize, and integrate the operational capabilities of all the products in the CMATS portfolio

· Develop, sustain, integrate, and modernize new capabilities for the CMATS portfolio.

· Implement new analytics, data, and platform component alignment with operational requirements and maximize capabilities.

· Modernize the CMATS platform to take full advantage of an Azure Cloud Hosting environment.

5. Scope. The scope of the CMATS portfolio development and sustainment effort is to provide the DISA CMATS Program Management Office (PMO) with comprehensive systems engineering, software development, and technical assistance to drive the continued development and deployment of robust capabilities. This includes providing infrastructure support for the Data Analytics' JWCC Azure Cloud and on-premises lab to support PAE Cyber-related systems and initiatives, as well as Assessment & Authorization (A&A) and testing support for the EPMS application. Support specific to the CMATS portfolio includes:

· Requirements analysis

· Prototyping

· Custom code development and maintenance

· Beta testing and oversight

· Cybersecurity analysis, artifact generation and scanning to provide full scope A&A support

· Integration of Commercial off the Shelf (COTS), Open-Source Software (OSS) and GOTS products and services

· Quality assurance/system evaluation

· Developmental testing

· Installation/Deployment support

· Documentation

· System performance analysis to improve, enhance, and expand the CMATS capabilities

· Lab Administration & Networking Support

· CM process implementation, tracking, and reporting

· Modernizing the portfolio to take advantage of JWCC Azure Cloud hosting services

· Evaluating new and existing data to develop new or improve existing sources of data

· Tier 3 help desk support and application administration on deployment, NIPR/IL5 and SIPR/IL6 installed baselines

All GOTS software developed under this contract will become the sole property of the Government and any software, binaries, or documentation that has not been delivered by the end of the contract shall be turned over to the Government PMO.

The contractor shall provide the necessary support in each of the Task Areas listed below, providing the services, capabilities, and deliverables of this PWS. Efforts shall provide benefits to extend system life, reduce life cycle costs (or provide the best return on investment), leverage technology advancements, and improve the capacity, reliability and robustness to meet program life requirements.

The scope includes the following technical areas:

Task Area 1 – Contract Management Support Task Area 2 - Software Engineering and Development Task Area 3 - Cyber and CM Task Area 4 - Tier III Support Task Area 5 - Product Subject Matter Expert (SME) Support

The contractor shall meet stakeholder development requirements and adapt to any technological evolution, industry standard changes and DoD regulatory requirements. There is a requirements’ backlog for each of the applications under the CMATS portfolio of varying scope and complexity to develop towards. Four development teams comprised of one lead developer per team, two to three mid/junior supporting developers and a tester will provide four software releases to the Government for the base and each OP to satisfy the prioritized backlogged requirements. Supporting team members shall include a technical writer, Database Administrator (DBA), training and help desk support are shared across the development teams and systems as needed. While the composition of the team will remain consistent, the number of requirements per system and their development complexity will vary. The contractor shall assess stakeholder requirements and determine how many can be developed within a given year based on the velocity of one major and at most six minor releases for the base year and each of the OPs. The teams shall work with the Government to determine which application or functional component each subsequent release will focus on, based on customer needs, prioritized requirements.

The Government may require surge support during the base or any OP, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 25% of the contractor’s total proposed cost/price for the base and all OPs, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

6. Performance Requirements.

6.1 Task 1 – Contract Management Support. The contractor shall manage and provide program status as documented in the deliverables to proactively manage the contract.

6.1.1 Subtask 1 – Administrative Requirements.

The contractor shall perform all technical, functional, and program management tasks delineated in this PWS. The contractor shall provide and manage a complete, comprehensive team of highly qualified personnel who are able to accomplish the tasks specified herein. The contractor shall provide all materials, services, personnel, planning, direction, coordination, and control necessary to provide the services and license maintenance required by this contract. To ensure the successful administration, operation, and maintenance of services, the contractor shall establish a project organization/staff structure that facilitates effective overall program management of the work.

Monthly Status Reports (MSR)s, Management Plan, Briefing Materials, and all other reports shall be performed to the standards identified in PWS Section 7. This standard applies to all sub-tasks within Section 6. The contractor shall provide centralized administrative, clerical, documentation, and related functions to meet the contract requirements. The contractor shall provide the technical and functional activities for effective and efficient program management of tasks within this PWS. Development activities shall rigidly adhere to Agile SCRUM development processes as directed by DISA policy, to include backlog maintenance, story point development, release planning, sprint kickoff meetings, end of sprint demonstrations, and appropriate artifact generation. The Government may waive all or some of these activities, but only by request.

The contractor shall use a portal specified by the Government to store draft and final versions of contract artifacts and deliverables. This includes deliverables outlined in the PWS, briefings, requirements, design documents, source code, test cases, CM artifacts, and other program and contract-level documentation

6.1.2 Subtask 2 – Personnel Requirements

All personnel assigned to this contract at any tier, including any substitute or replacement personnel, shall be technically proficient and have a thorough knowledge of their respective area(s) of expertise to ensure successful operation, maintenance, and management of the CMATS portfolio. Personnel provided shall be sufficient to fully staff a SCRUM-based agile development team while simultaneously providing Tier 3 helpdesk support, training, implementation planning, requirements management and testing resources.

The contractor shall designate a dedicated Program Manager (PM) to manage the work and personnel defined int this contract. Other key personnel will be responsible for assisting the contractor PM with schedule and technical performance under this contract. The contractor shall provide adequate management and resources to support the technical requirements of the contract and ability to function as a viable and productive partner with the Government. The contractor shall provide processes and procedures to ensure key personnel roles are consistently filled by personnel with sufficient expertise to prevent loss of corporate subject matter expertise in the specific tools and business logic of the CMATS portfolio. The contractor PM and the staff members responsible for key project components, such as service management, engineering, testing, implementation, and scheduling, shall participate in planning and status meetings conducted at either contractor or Government facilities, at no direct charge to the contract.

The contractor personnel designated below shall serve as the primary POCs for status and resolution of all contract management, implementation, and technical matters.

CMATS complex business logic and data manipulation capabilities create a steep learning curve. Consequently, personnel turnover results in significant development delays of ten weeks or more and introduces the risk of delivering flawed business logic. To mitigate these issues, the Government believes that maintaining stability by limiting turnover among development team leads is critically important. Consequently, development team leads shall be considered key personnel and will be subject to personnel retention and qualification review consistent with key personnel designations. The Government shall be notified in writing of a key personnel turnover at least 10 business days in advance and the plans to mitigate the risk of a key personnel member leaving the contract.

Staffing levels shall be reported to the Government in a quarterly staffing report, which shall provide the expected versus expended man hours per development team due to expected ramp-up and shut down periods. The contractor may propose reduced manning levels during order startup and shutdown. The contractor shall limit turnover in key personnel to 25% or less.

The contractor is required to provide technically proficient personnel for the complete, end-to-end engineering, design, installation, testing, integration, administration, operation, maintenance, and management of the CMATS program. All contractor personnel, other than those designated as key personnel (or their substitutes), shall meet this standard.. The contractor may provide additional appropriately cleared personnel to receive on-the-job training for any function for which personnel substitution may be anticipated, but in no case shall such training interfere with performance of any service or cause a hazard to the network.

6.1.3 Subtask 3 – Program Reporting

6.1.3.1 Contract Management Plan (CMP)

The contractor shall prepare a CMP upon award and present the CMP as part of the contract kick-off. The CMP, at a minimum, shall address or include the following: organization, resources, personnel management, management structure/control (ie; lines of responsibility, authority, communication), execution plan, labor execution plan, quality assurance/control plan, contract management plan, implementation plan, risk management, and SME support to be employed to meet the performance and schedule requirements throughout task order execution. The contractor shall identify and document, in the CMP, opportunities to implement cost containment, cost reduction, and cost avoidance strategies to include building upon work previously accomplished by the Government, the contractor, or other contractors to the fullest extent practical. Proposed key personnel (including qualifications) matrix will be maintained as part of the CMP.

The CMP shall also include a Transition Implementation Plan (TIP), outlining activities, and the timeline required for the contractor to transition support services identified in this PWS to a new contractor. The CMP shall be updated throughout the performance of this task to reflect changes and to further define program criteria and milestones. All modifications to the CMP shall be submitted at least annually, but any time there is a change to program criteria or milestones, to the Government for approval before execution. In addition, the CMP shall detail the coordinated interaction between system development and integration activities as well as the maintenance and security compliance of existing and developing capabilities.

As part of the CMP, the contractor shall establish a comprehensive risk management process that includes identification, evaluation, and mitigation of risks associated with schedule, technical, and performance.

Additionally, the team shall develop a risk matrix to track project risks (such as schedule, cost, program/performance, and engineering) that may be revealed during the project and will decide upon initial action and communication plans that will help ensure successful issue resolution and project execution. The risk matrix will be maintained and delivered to the Government as part of the weekly Integrated Program Team (IPT) meeting. The contractor shall tailor their risk assessments in accordance with (IAW) the DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition Program where applicable.

The contractor shall provide risk tracking. This shall include:

· Establishing and maintaining a program specific risk management tool. The tool shall list all open and historical risks associated with the effort.

· Gathering and documenting mitigation strategies and approaches for each risk in the system.

· Identifying, documenting and monitoring program management risks, as well as coordinating with business and technical representatives to gather and capture those risks in the risk management system; and creating reports that outline program risks.

6.1.3.2 Kick Off Meeting

A Kick-off meeting shall be conducted no later than (NLT) five business days after the contract award, and after execution of subsequent OPs. This meeting will be between the Government and the contractor and will be the venue to facilitate a successful execution of this contract, including transition activities. The contractor shall prepare presentations that provide updates to the technical and management approach including schedule, and performance data. The kick-off meeting agenda shall include the following:

· Introducing the management and technical teams

· Presenting the Draft CMP and Engineering Plans

· Common understanding of contract and the associated development, management, and sustainment teams and leads

· Common understanding of technical direction

· Presentation of all contract deliverables to include proposed formats, reporting methods and proposed bundling strategies

· The transition of the current activities being performed for CMATS and ongoing sustainment and modernization recommendations

Other relevant items may be introduced at this meeting.

6.1.3.3 Program Reviews

Program reviews will be conducted quarterly at the primary Government location. In addition, the contractor shall prepare a presentation that provides updates to the technical and management approach, and changes to the current and projected schedule and performance data. The quarterly program review agenda shall include the following:

· Plans and Accomplishments

· Issues, Risks, and Mitigation Strategies

· Contractor metrics to be tracked and reported in monthly and quarterly reports

· Action Item Review

· Updated Project Plan and Schedule

Other relevant items may be introduced at the discretion of the contractor. The contractor shall produce minutes of all Program Reviews, including a synopsis of all technical and management discussions and a list of open/closed action items. All on-going projects and/or program development efforts shall be covered in the Program Reviews.

6.1.3.4 Technical Exchange Meeting (TEM).

The contractor shall conduct TEMs on a weekly basis at the primary Government location or virtually, where approved by the Government. The contractor shall prepare a presentation that provides updates to the technical approach including current and projected schedule and performance data.

During the TEM the contractor shall review program strategies and brainstorming sessions. The contractor shall document alternative strategies and approaches for addressing program/project technical, financial, and schedule risks. The contractor shall conduct research regarding various aspects of proposed strategies and alternatives, providing summaries of findings. Where applicable, as defined by the PM and/or the COR, the contractor shall identify and apply a variety of process analysis approaches to determine impact of complex issues. When alternative strategies and approaches are required, the contractor shall provide a composite list of all alternatives considered, and a detailed summary of cost, schedule, and performance risks and benefits of each. Following COR approval of selected strategies, the contractor shall document, track, and promulgate outcomes.

The contractor shall develop draft mission and vision statements, subsequent goal delineation and provide recommendations to the CMATS PMO for building operational plans that specify measurable outcomes to include capital outlay planning efforts in a consolidated strategic planning process which enables the Government to prioritize project initiatives.

The contractor shall review requests for information received from senior leadership and other related programs and projects as well as requirements to present program status at the TEM. The contractor shall gather data, conduct research, and create draft responses to these requests. This data may include technical, business, requirements, financial, schedule, or strategic data or concepts. The contractor shall ensure that thorough records are retained of all requests and responses, whether written or oral.

The TEM agenda shall include, at a minimum, the following:

· Attendees

· Status of current projects

· Recommendations for upcoming and pending projects / program strategies

· Updated 120-day calendar day schedule showing planned milestones and deliveries completed in the last 30 calendar days and projected for the next 90 calendar days, updated as part of minutes delivery

· When applicable an Analysis of Alternatives (AoA) for various technical approaches to specific challenges

· Issues, Risks and Mitigation Strategies

· Action Item Review

· Other relevant items may be introduced at the discretion of the contractor and/or the Government

The contractor shall produce minutes of all TEM meetings, including a synopsis of the technical discussion and a list of open/closed action items, to the PMO within two business days of the TEM being conducted.

6.1.3.5 Integrated Master Schedule (IMS)

The contractor shall provide the Government with an event driven IMSs. The contractor shall use MS Project or similar software designated by the Government for developing and maintaining the schedule. The contractor shall review and identify any dependencies or interrelationships between the contract and other program efforts and significant dates. The contractor shall prepare and maintain an IMS for the overall contract to include schedules for each subtask and the level of effort (LOE) for task completion. The IMS shall address dependencies, risks, key milestone events, critical path activities, and delivery dates. The schedule shall also outline all resources assigned to individual tasks and the LOE for each task’s completion. The contractor shall coordinate with the appropriate Government Functional Lead(s) and assess the risks identified in the schedule and recommendation for program resolution. The schedules shall be developed and baselined in collaboration with the Government.

The baseline schedule shall not be modified without the Government PM approval. The schedule shall be coupled with the weekly IPT to ensure all organizations and activities underway are coordinated and support the objectives of the overall program. The contractor shall submit an updated IMS to the Government PM and upload to an agreed upon deliverables portal on a weekly basis.

6.1.3.6 MSR

The contractor shall submit MSRs that include financial, performance, schedule status including proposed changes and deviations from the planned schedule, technical accomplishments, issues and risks, and planned activities for the next reporting period. Any issues requiring Government response or action shall be identified to the Government immediately and status captured in the MSR. An inventory of all program assets (Government Furnished Property (GFP)/Government Furnished Information (GFI)) shall also be included in the MSR to include servers, laptops, network equipment, external hard drives, server certificates with expiration dates, and hardware and software licenses with expiration dates.

The MSR will contain notifications of key personnel changes, to include changes in assignment or status of key personnel. The MSR will provide status of personnel to include clearance, access granted, Government Furnished Equipment (GFE) provided, and any changes.

The initial MSR shall include the projected deliverables planned by month, grouped by work categories (e.g., development, testing, Tier III, A&A, etc.) for the Base and each OP. In each subsequent report, the contractor shall show the original planned projections by month, actual work performed (deliverable) the location of the deliverable, the date due versus date delivered, and an updated projection of the remaining deliveries across the Period of Performance (PoP). Each deliverable shall include a report cover that will identify the contract number, the COR and ACOR, the URL for the deliverable and any differences between the projection for the deliverable and actual delivery date. The cover report shall explain how the difference between the projected and actual delivery date affects the projection for work yet to be accomplished.

The MSR shall include monthly performance system and user metrics, as agreed upon with the Government CMATS PMO. The metrics shall be reported as part of the MSR.

6.1.3.7 Integrated Product Team (IPT) / Weekly Status Reports The contractor shall host a weekly IPT meeting with the objective of synchronizing and de-conflicting the activities with representatives from appropriate functional disciplines (both in and outside of the CMATS program), to meet CMATS objectives, identify and resolve issues, and make sound and timely recommendations to facilitate decision making. The meeting shall cover A&A status, change requests (CRs) that are currently pending action, Tier III ticket counts, development team status per program, testing status per program, outstanding operational issues at a minimum, action items and current risks. The contractor shall capture the outcomes of the weekly IPT and provide the minutes to all participants within two business days of the meeting. The minutes shall include a high-level review of the baseline schedules for each program to ensure the Joint Interoperability Testing Command (JITC) team, the development team and the engineering team are aware of upcoming activities that will impact them.

The contractor shall submit the Weekly Status Report outlining the progress of current and future tasks with completion status, as well as identifying any issues and risks, dependencies, and engineering updates that require Government interaction for resolution and/or impact agreed upon delivery. At a minimum, the update shall outline what work has been performed, what problems have been encountered that may impact schedule, potential solutions for any problems, and projected tasks for the next week. The update shall also include metrics on the program’s performance about capabilities provided to the customer and the outcome from those capabilities. The Weekly Status Report shall include identified risks and mitigations, and any other program updates applicable to Cyber Directorate management.

6.1.3.8 Meetings

The contractor shall coordinate meetings with Government representatives and their stakeholders to discuss the status of the project. The contractor shall conduct meetings weekly, bi-weekly, and monthly to support the program. The contractor shall prepare and distribute the meeting agenda, briefing materials, meeting minutes, and action items. Meeting locations may vary. If hosting at the contractor’s facility, the contractor shall provide appropriate meeting audio/visual and audio teleconferencing capabilities. If hosting at the Governments facility, the contractor shall leverage MS Teams or other Government-approved delivery media for remote presentation, electronic white board, and chat. The contractor shall produce meeting agendas, briefing materials, minutes of all meetings, including synopsis of technical discussions, and track the status of all action items. Minutes shall be provided within two business days of the scheduled meeting time. Agendas and briefing materials shall be provided two business days before the meeting.

The contractor shall obtain approval from the CMATS PMO before hosting any meeting outside of DISA. Meeting materials for meetings hosted outside of DISA must be approved by the CMATS PMO prior to sharing materials with attendees and at least two business days prior to the scheduled meeting. The contractor shall capture, and compose minutes, or provide annotations to official minutes, if they are provided by other entities, for all meetings where CMATS is represented involving organizations outside the CMATS PMO e.g., meetings with DoD Chief Information Office (CIO), USCYBERCOM, DCDC, Combatant Commands, Services, Field Agencies (C/C/S/FAs) and/or DISA Operations (Ops). The minutes shall be distributed by email to the CMATS PMO and saved to a Government designated portal.

6.1.3.9 CMATS Monthly Working Group

The contractor shall host a Monthly Working Group Meeting to engage the CMATS user community and discuss all CMATS related Topics (e.g., General Announcements, Operational Status and Issues, Orders Related to CMATS and/or trends, upcoming enhancements, resources, access control, training on new functionality and/or user questions). The CMATS Monthly Working Group shall take place every month at an agreed upon time with the Government. The meeting agenda and briefing material drafts will be due three business days prior to meeting and finalized one business day prior. The CMATS Monthly Working Group meetings are to be recorded and uploaded to the CMATS Knowledge Management (KM) page (along with the associated slide deck) to the CMATS Working Group TEAMS chat within two business days of the meeting’s conclusion.

6.1.3.10 Transition Plans

The contractor shall work with the incumbent contractor to create and execute a TIP to transfer, in coordination with the incumbents. The transition plans will be included as part of the CMP and reviewed at the program kick-off meeting. All transition actions shall be completed 45 calendar days after award:

· The TIP shall include a description and catalog of GFP, GFI, (i.e., all configuration items (CI)s), source code, system architectures, system access controls, build scripts and plans, test scripts and other program artifacts

· Roles and responsibilities in any Government-managed forum currently supported by the incumbents

· “Left seat – right seat” functional/knowledge transition to minimize impact to the program

· The contractor shall assist the Government to build and ensure the full end-to-end production representative set of systems and software delivered under this contract is built in the specified Government lab.

· The contractor shall provide a build-from-scratch guide to build the current systems deployed in a production environment.

· The contractor shall deliver complete source code for all products delivered during the Base and OPs in the contractor’s native code repository or in an alternative repository as negotiated with the Government. The contractor shall also deliver functioning build plans and build automation for all product versions that are supported at the end of the PoP.

The Government will facilitate the execution of the TIP to ensure continuity of all current activities supported by the incumbent. 120 calendar days prior to the end of the contract, the contractor shall update the TIP to support the transition to a follow-on team for review by the Government IAW FAR 52.237-3—Continuity of Services. The contractor shall provide all reasonable programmatic assistance needed to ensure a smooth transition of the tasks required herein to the successor service provider. During the phase-out transition period, the contractor shall be fully responsible for the continued operation of all services required by this PWS. The Government reserves the right to conduct site visits in all areas of the DISA facility occupied by the contractor for the purpose of performing on this contract, in conjunction with the solicitation of offers for any successor contract.

If a follow-on contract is not awarded to the incumbent:

· The contractor shall cooperate to the extent required to enable an orderly and complete changeover to the successor service provider.

· As required above, the contractor shall conduct a joint inventory of all GFE, GFP, and GFI with Government personnel. The contractor shall deliver to the Government PM and COR a final inventory on or prior to the last day of contract performance.

· The contractor shall deliver complete source code for all products delivered during the PoP in the contractor’s native code repository or in an alternative repository as negotiated with the Government. The contractor shall also deliver functioning build plans and build automation for all product versions that are supported at the end of the PoP.

6.1.3.11 Policy Review and Update

The contractor shall provide technical and programmatic reviews of existing DoD processes, policies, doctrine, directives, regulations, and implementation of instructions, to include Concept of Operations (CONOPS) and Tactics, Techniques, and Procedures (TTPs). The contractor shall record specific policy updates and implementation recommendations. The contractor shall ensure the document addresses how the capability will perform, how the capability will be used by Ops and sustainment personnel, the maintenance and management of the system, the ability to provide timely reporting of operational outages, and any major performance issues that may affect end users. The CONOPS will use the standard DISA CONOPS document format and content description.

Deliverables:

6.2 Task 2 – Software Engineering and Development

The contractor shall provide Software Engineering, Design and Development in support of the CMATS Portfolio. The contractor shall work collaboratively with the Government and other support contractors in designing capabilities and services. The contractor shall provide support to the CMATS portfolio to address the following areas in four concurrent development teams: One for CMRS, one for EUM & COAMs, one for IAVM and one for DATT/CAMP.

6.2.1 Subtask 1 Architecture

The contractor shall manage and document any changes to the current and to-be architecture for CMATS architecture(s) or, at the contractor’s option and the Government’s approval, amend or replace the architecture, reflecting any new or enhanced capabilities which shall include the security components to address current and future threats along with any additional hardware or software components. The architecture shall continue to represent a single, unified, and highly secure environment. The architecture shall: leverage existing DoD solutions to minimize expense:

· Standardize data interface specifications for machine-to-machine information sharing that are based on industry and Government standards, where available

· Encompass a common, secure infrastructure for access control, collaboration, and information sharing across Unclassified to Classified domains

· Support scalability and resiliency

· Be approved by the Configuration Control Board (CCB) and Executive CCB (ECCB) where available The contractor shall design, implement, and maintain the CMATS capabilities as an open, modular framework to facilitate component reuse and ease of capability integration. The contractor shall select technical solutions that leverage or adapt industry standards, open-source, or broadly established public or DoD interfaces when available, and develop new protocols or specifications when necessary. New and adapted specifications shall be developed in partnership with industry, DoD, and DISA engineering organizations. Historically, any new and adapted specifications utilize a development team comprised of one lead developer, two mid/junior supporting developers, a tester, a tech writer, and DBA support.

CMATS documentation shall follow the latest DoD Architecture Framework (DoDAF), currently v2.x compliant, representing the current CMATS portfolio. Documentation shall be editable in a Government approved architecture tool and be in a format that promotes agile updates to the architecture as the portfolio changes. Architecture documentation shall include at least the DISA minimum required DoDAF Reference Models, listed in the table below, to organize the Enterprise Architecture and Systems Architecture into complimentary and consistent views.

Minimum Set of Architecture Views for DISA Projects:

The contractor shall provide graphic artist support and technical writing expertise for development and review of PowerPoint slides and DoDAF artifacts.

6.2.2 Subtask 2 – Analysis

The contractor shall assist in identifying interdependencies among existing and planned capabilities and facilitating coordination among the responsible product managers to ensure that capabilities are designed as integrated capabilities. The contractor shall analyze existing IA technologies and review source code and other existing design documentation of existing IA and Defensive Cyber Ops and related tools. This information shall be provided in an Analysis Report as needed.

6.2.2.1 Policy, Requirements Gathering, Analysis, and Management The contractor shall work with the Government to engage stakeholders, including the operational community, for determination and delineation of the overall DoD operational requirements. The contractor shall implement a requirement’s process to address operational requirements, performance requirements and/or performance standards, security requirements, and facilities requirements detailed in the scope of this contract. Requirements shall be baselined and managed throughout the entire system lifecycle.

This task shall include:

· The establishment of a contractor requirements manager to manage all CMATS requirements from start to delivery. Requirements management phases include capturing requirements, decomposition of requirements, developing supporting documentation, technical analysis, LOE determinations and cost estimates, preparing requirements for Government review, approval and prioritization, and scheduling the requirements for sprint development.

· The contractor shall provide functional analysis to identify, document and manage operational, functional, and technical requirements. The contractor shall capture discrete aspects of functionality for integration in systems, applications, and tools to be applied in Ops.

· The contractor shall establish, monitor, and update the Requirements Traceability and Verification Matrix (RTVM) of all requirements for each CMATS system, tracking the source of the requirement, the date the requirement was identified, the system application/module assigned, and test status. The matrix shall also track security requirements, related to open STIG or IA Vulnerability Alerts (IAVAs). The contractor shall decompose requirements to task level detail and be able to prioritize and sufficiently decompose requirements to facilitate software engineering. Unmet requirements will be referred to and documented in the "requirements backlog" and shall be a part of the overall requirements traceability matrix (RTM) but delivered as a separate document to support release planning and the Test Readiness Review (TRR) milestone.

· The contractor shall coordinate with other entities selected by the Government to provide stakeholders to derive documents and provide requirements for CMATS or other system interoperability and compatibility-including data transfer methodologies, data formats for transmission and storage, business logic requirements, latencies, bandwidth limitations, web service and other interface definitions, and other relevant aspects of interoperability and compatibility.

· Develop technical, LOE, and cost analyses for each submitted requirement to be presented at the Change Advisory Board (CAB) meetings held monthly.

· Manage and participate in the CAB requirements approval and prioritization sessions. Support for this meeting shall include a requirement decision briefing to support the meeting. An agenda shall be included as part of the briefing. Following the meeting, the contractor shall provide meeting notes/minutes to the Government within two business days and support the CAB requests for additional information.

· Manage the backlog of requirements for each of the programs supported by CMATS. The backlog shall be updated on a monthly basis and presented as part of the CAB to ensure prioritization of all requirements is reviewed on a consistent basis.

· The contractor shall provide stakeholders visibility to continuously validate and refine user requirements. User requirements range from 10-20 requirements per release depending on the complexity of developing the requirement and the LOE required for each requirement.

Requirements will be housed in a Government approved repository. If this repository is not available on a Government site, the contractor shall be required to provide a repository for the requirements backlog that the Government has access to so requirements can be viewed as necessary.

6.2.2.2 Trending Reports

The contractor shall provide support for consolidated and improved user interfaces (UI)s across all CMATS instances and for additional Scorecard reports, UIs and APIs required by the SECDEF, DoD CIO, DCDC and others. Historically, one trending report has been developed per quarter that includes each of the following metrics:

· Consolidated Historical Trending Report

· Patching Scorecard trending report

· Configuration Scorecard trending report

· Operating System (OS) trending report

· Hardware (asset inventory) trending report

· Software inventory trending report

· Patching status trending report

· Configuration status trending report

· Vulnerability History Report

· Publishers/Publication Trending Report Additional trending reports of the availability of data for users to create their own trending reports will be captured as requirements, placed in the backlog, and prioritized as part of the monthly CAB process.

6.2.2.3 Policy Creation and Risk Scoring Content Development

The contractor shall provide support for a persistent capability to build policies that can be run in CMATS tools as needed, to evaluate topics such as: Endpoint Readiness, anti-malware deployment, disc encryption, firewall compliance, POCs, etc. The vendor shall provide maintenance capacity for all policies already in CMATS. The contractor shall also create custom policies on demand (approximately 100/year) and maintain policies, such as the “Standard Operating Environment” policies on a quarterly basis (approximately 50 policies). The following competencies are required to meet this requirement:

· Creating schema-compliant Extensible Markup Language (XML) documents using commonly available XML editors (e.g., Oxygen, XMLSpy)

· Experience writing and understanding of Security Content Automation Protocol (SCAP) and SCAP-like policies in Extensible Configuration Checklist Description Format and Common Platform Enumeration (CPE) Language.

· Experience using common DoD networking operational concepts, A&A controls, and vocabularies

· The contractor shall host a monthly policy review with the Government to review existing policies and introduce new policies for approval before releasing the production.

· The contractor shall maintain a Master List of all the policies in the production environment and shall maintain that Master List when new policies are approved for release to the production environment. This process will be automated where applicable and upon approval of the Government.

6.2.2.4 Data Interoperability

The contractor shall ensure that CMATS is interoperable with the multiple systems that feed data or query data from CMATS. The following data sources, languages, encoding methods, or processes are currently used by CMATS:

· MS Suite of Tools

· MS Defender for Endpoint (MDE)

· MS Endpoint Configuration Manager

· Intune

· PowerBI/PowerAutomate, other Power tools

· Endpoint Scanning tools and Endpoint Protection Product management consoles

· Endpoint Security and comparable tools

· Policy Auditor

· Tychon

· Tanium

· Assured Compliance Assessment Solution (ACAS) / Tenable

· Forescout

· Cisco Identity Services Engine

· Crowdstrike

· Other new tools that meet reporting requirements

· ePolicy Orchestrator

· Operational Attribute Module (OAM)

· Application Publishing Service

· CMRS

· XML

· DPMS

· STIG

· COAMS

· Attribution tags value enumerations

· IAVM System

· IAVM Patch-Common Vulnerabilities and Exposures lookups and metadata

· MDE vulnerability check to IAVM correlations

· EUM

· Permissions assigned based on COAMS Roles and Attribution sets

· Windows Server Update Services

· Enterprise Identity Credential Management

· National Vulnerability…