Draft PWS.pdf

Enclosure 4a, PWS Page 1 of 21 Pages

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Draft 5 June 2025

Contract Number: TBD Task Order Number: TBD Contractor Name TBD Tracking Number: TBD Follow-on to Previous Contract and Task Order Number:

HC1047-24-F-4001

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title.

Joint Planning & Execution Services (JPES) and Joint Capabilities Requirements Manager (JCRM) Sustainment.

3. Background.

4. Objectives:

The objective of this PWS is to provide maintenance and sustainment support to the DISA Global Force Management (GFM) Program Management Office (PMO) that supports system availability, stability, and interoperability of JPES and JCRM. The GFM PMO requirement is for sustainment, maintenance, project management, and lab support services. This consists of configuration management, cybersecurity, information assurance, software development, sustainment & integration, tier 3 helpdesk support, and system administration.

5. Scope.

• Task Area 1 – Project Management

• Task Area 2 – JPES & JCRM Development & Sustainment

• Task Area 3 – Infrastructure Support

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

6.1 Task 1 – Project Management

The contractor shall fill all Key Personnel positions identified in PWS Section 13.g. and DITCO Instruction H3 within 15 business days of Task Order (TO) Period of Performance (PoP) start date and within 15 business days for any future vacancy.

6.1.1 Subtask 1 - Meetings

Page 2 of 21 Pages

The contractor shall provide meeting support to include all necessary planning, execution, and documentation to conduct meetings for this TO. Meetings include Technical Exchange Meetings (TEMs), Weekly Status Reports, Information Assurance Meetings, Monthly Contractor Performance Report (CPR) Meetings, End of Sprint Reviews (EOSRs), and other ad hoc meetings as requested by the Government.

When requested by the Government, the contractor shall develop and deliver meeting minutes in accordance with the Contract Data Requirements List (CDRL) A001.

Deliverables:

A001 - Meeting Minutes

6.1.2 Subtask 2 – TO Management

The contractor shall prepare a Task Order Management Plan (TOMP) in accordance with CDRL A002, describing the technical approach, organizational resources, communication strategy, and management controls to be employed to meet the cost, performance and schedule requirements throughout TO execution.

The contractor shall develop and deliver a monthly Contractor Performance Report (CPR) in accordance with CDRL A003.

The contractor shall develop and deliver an End of Sprint Report (EOSR) in accordance with CDRL A004. The EOSR shall, at a minimum, include the following information:

• Description of Progress, Action Items, Story Point Planned, Story Points Completed, Bugs, Backlog, Sprint Burndown, Velocity, and Technical Debt.

Deliverables:

CDRL A002 - TOMP

CDRL A003 - CPR

CDRL A004 - EOSR

6.1.3 Subtask 3 – Risk Management

The contractor shall plan, conduct, and document risk management for this TO. The contractor shall develop and deliver a Risk Management Plan (RMP) in accordance with CDRL A005 to identify how risks will be recorded, reported, and mitigated. The plan shall identify how Cost, Schedule, and Performance consequences and likelihood levels are defined.

The contractor shall develop and deliver a Risk Management Log (RML) to address, identify, assess, and prioritize risks in accordance with CDRL A006. The RML shall include the full range of risks that could impact the project including, but not limited to, resources, access, physical and cyber security, and unplanned events. The RML shall identify high risk factors and develop a mitigation plan to reduce or eliminate the risk. Upon Government approval, the contractor shall implement and monitor the selected mitigations.

Deliverables:

A005 - RMP

A006 - RML

6.1.4 Subtask 4 – Quality Management

The contractor shall develop and deliver a Quality Management Plan (QMP) in accordance with CDRL A007 to ensure that all development efforts and products related to the TO satisfy validated requirements, meet user expectations, are easy to use / augment / modify / maintain, and are in compliance with DoD specifications and standards. The contractor shall ensure that any deficiencies in the process or the development standards are identified and addressed as part of the risk management program so that the process or standards may be improved. The contractor shall conduct audits, reviews, assessments, and inspections for products and processes and retain the documented results.

Deliverables:

A007 - QMP

Page 3 of 21 Pages

6.1.5 Subtask 5 – Schedule

The contractor shall develop and deliver a schedule in accordance with CDRL A008 Microsoft Project and remain fully functional with all logic, dates, and functionality available to the Government. Once the schedule has been baselined, the contractor shall obtain Government concurrence for all schedule changes prior to implementation.

Proposed schedule changes shall identify impact factors and recommend recovery mechanisms.

Deliverables:

A008 - Schedule

6.1.6 Subtask 6 – Software Release Plan

The contractor shall develop and deliver a Software Release Plan (SRP) in accordance with CDRL A009, that is in concert with the schedule (PWS 6.1.5) and product roadmap (PWS 6.1.7). The SRP shall compliment the schedule and product roadmap in describing how each Release will be accomplished. It shall document the planned number of iterations, metrics used to achieve the capability of each iteration (i.e., story points), and frequency of the releases and release schedule. The SRP shall describe the plan for the development, test, and deployment of successive software releases. The SRP shall describe the agile process, deployments to the first look environment, and test and evaluation milestones. The SRP shall be updated to reflect any changes.

The contractor shall develop, update, and deliver Software Release Documentation (SRD) in accordance with CDRL A010. The specific documentation required for each release will be determined in coordination with the Government Product Owner or designated representative. Each software release may contain the following as determined by the Government Product Owner or designated representative:

• Delivery Transmittal Letter

• Delivery Checklist

• Installation Software

• Source Code

• Installation Procedures (IP)

• Version Description Document (VDD)

• Software Administration Manual (SAM)

• Software Design Document (SDD)

• Interface Design Document (IDD)

• Scripts

• System Security Plan (SSP)

• Software Requirements Specification (SRS)

• Web Services Description Document (WSDD)

• Virtual Machine Installation Procedures (VMIP)

• Functional User Manual

• Test Cases , Test Plans, & Test Reports

• Requirements Traceability Matrix (RTM)

• Release Notes (RN)

• Functional Manager SOP

• Department of Defense Architecture Framework (DoDAF)

• Vulnerability Management Plan

• Information Assurance Self-Assessment Plan (IASAP)

• Trusted Facility Manual

• Security Configuration Management Compliance Document (SCMC)

• Functional User’s Manual

• Database Maintenance Manual (DBMM)

• Full Self-Assessment Results

• Continuity of Operations (COOP) Plan

• Incident Response Plan

Page 4 of 21 Pages

• Disaster Recovery Plan

• Threat Model

• eMASS Packages

• Integration Document

• User Document

• Functional Design Document (FDD)

• Programmer's Document (PD)

• Letter of Instruction

Deliverables:

A009 - SRP

A010 - SRD

6.1.7 Subtask 7 – Product Roadmap

The contractor shall develop and deliver an agile Product Roadmap in accordance with CDRL A011 that provides a prioritized, value-driven view of work to be performed. The roadmap shall depict the capabilities and/or features to be developed over time while avoiding overly prescriptive plans. It shall not be task or activity oriented, but outcome/goal oriented, so that it leaves room for the team to innovate and learn along the way.

The contractor shall use the roadmap to organize the backlog, prioritize work, and ensure that the appropriate capabilities/features are delivered at the right time. The roadmap can be adjusted, in consultation with the Government Product Owner prior to each sprint planning event.

The contractor shall, in consultation with the Government Product Owner, allocate backlog items to Sprints that align to the roadmap.

Deliverables:

A011 - Product Roadmap

6.1.8 Subtask 8 – Configuration and Release Management

The contractor shall establish and maintain a configuration and release management program to ensure the integrity, consistency, and traceability of all deliverables, systems, and associated documentation through the performance period.

The contractor shall develop and deliver a Configuration & Release Management Plan (C&RMP) in accordance with CDRL A012, using commercial best practices and IAW the Joint Command and Control (JC2) capabilities Systems Engineering and Integration (SE&I) plan, Change Control Board (CCB), and software Version Description Document

(VDD).

Deliverables:

A012 - C&RMP

6.2 Task 2. – System Development and Sustainment

The contractor shall plan, design, develop, support, and deliver software in an Agile development and Continuous Integration / Continuous Development (CI/CD) pipeline process. The work effort will be based on the Product Roadmap and Product Backlog priorities set by the Government Product Owner for JPES & JCRM.

The contractor shall build, deploy, and maintain an Unclassified First Look Site (FLS) in an environment approved by the Government. This environment may be on-premises hardware located at the contractor’s facility, hosted in a cloud environment, or some hybrid combination.

The Government uses severity levels to define issues. The Government defines these severity levels as follows:

Severity 1: Unable to perform required operational capability (e.g., total system failure, total failure of a critical application, unable to install or load a critical application); identifies a vulnerability.

Page 5 of 21 Pages

Severity 2: Required operational capability is seriously degraded and no acceptable workaround is available (e.g., vital software does not work and there is no acceptable workaround); identifies security vulnerability.

Severity 3: Required operational capability is seriously degraded but an acceptable workaround is available (e.g., vital software does not work and there is an acceptable workaround); identifies a potential for the administrator (or other users) to put the system unintentionally and unknowingly into a non-secure state; identifies the existence of services that are useful to a malicious user.

Severity 4: Operator or user inconvenience; compliance and documentation issues that affect users or administrators.

6.2.1 Subtask 1 – Product Backlog

The contractor shall develop and deliver an agile Product Backlog that is organized in a hierarchy where Epics are decomposed into Features and Features are decomposed into User Stories with bi-directional traceability between each level.

The contractor shall collaborate with key stakeholders, including the Government Product Owner to elicit, document, refine, and prioritize backlog items. Backlog items shall contain, at a minimum, the requisite information:

• Title

• Description

• Level of Effort (e.g., story points, hours, etc.)

• Definition of Done / Acceptance Criteria

• Dependencies

• Other attributes that characterize the story

Stories shall fall into one of four states:

• Proposed: The story is complete (contains the required attributes) but has not been approved by the

Government Product Owner.

• Approved: The story has been approved, and work can begin.

• In-Progress: The story is approved, assigned to a team, and is currently under development.

• Done: The story has been completed (meeting the definition of done and all acceptance criteria) and is accepted by the Government Product Owner.

The contractor shall employ agile backlog grooming practices, including backlog refinement sessions, to continuously review, update, and reprioritize items based on stakeholder feedback, technical feasibility, and business value. The backlog shall be maintained in an agile project management tool designated by the Government.

The backlog shall be validated and approved by the Government Product Owner or designated representative. The backlog shall be continuously updated and available for review in real-time throughout the contract period.

The contractor shall, prior to executing any work, develop (in conjunction with Stakeholders) a user story and obtain approval. It is assumed the creation of stories will require participation from multiple stakeholders. The Contractor is responsible for the coordination of all activities required to complete each story. The Contractor is responsible for tracking and decomposing each story down to the working level. The Contractor shall clearly show traceability and dependencies between stories. At the request of the Government Product Owner or COR, the Contractor shall develop milestones and a detailed schedule for more complex stories.

Deliverables:

A013 - Product Backlog

6.2.2 Subtask 2 – Software Development & Sustainment

The contractor shall provide agile team(s) that will support all application sustainment and operations activities defined in this task order. Capability of a team will be monitored and measured using velocity/story points and technical debt to ensure optimal productivity.

Page 6 of 21 Pages

The contractor shall:

a) Provide the full range of software development lifecycle activities to include requirements, analysis, design, development, test, security and deployment.

b) Coordinate all activities (analysis, design, development, testing, and deployment) required to complete each story as defined in the Acceptance Criteria and Definition of Done.

c) Work with the Product Owner or designated representative to decompose each story down to the level that is achievable within a sprint and identify the acceptance criteria for each story and define the sprint definition of done.

d) Identify all tasks required to successfully complete each story.

e) Show traceability and dependencies between requirements (Epics, Features, and Stories).

f) Effectively facilitate agile events or ceremonies (i.e., Sprint Planning, Daily Stand-Up, Sprint Review, Sprint Retrospective).

g) Provide the required SRD to the Government IAW the SRP.

h) Test, implement, and assess the impact of software/hardware patches, upgrades, fixes, and enhancements.

i) Prepare and manage releases IAW the schedule and product roadmap.

j) Provide software that is free of Severity 1 and 2 defects prior to the start of Government Acceptance Testing

(GAT).

6.2.3 Subtask 3 – Metrics

The Contractor shall utilize a combination of metrics demonstrating value delivered against program goals/objectives, commitment to Agility, and team performance. The Contractor shall automate metrics, data collection and analysis to the greatest extent possible using the government-directed Agile software development management tool. The contractor shall automatically generate data, metrics, and dashboards in real-time that are accessible to the team and decision-makers.

6.2.3.1 Subtask 3 – Agile Metrics

Agile metrics related to the efficiency of development and delivery processes. These metrics identify the speed of value delivery, where inefficiencies may exist in the software development process, and support decisions related to how/when/where to change the process. These metrics enable continual process improvement. These Metrics include but are not limited to story points, velocity, velocity variance, cycle time, lead time, lead time for change.

6.2.3.2 Subtask 3 – Software Quality Metrics

Software quality metrics are related to the quality of the work delivered. These metrics identify where in the overall system software quality has been achieved and where it may be degraded. It supports identification of specific software architecture/components or team specific challenges that contribute to degraded quality. Examples of Software quality metrics: Acceptance Rate, Recidivism Rate, First-Time Pass Rate, Change Fail Rate, Mean Time to Recover/Restore, Escaped Defects, Code Coverage Rate, Automated Test Coverage.

6.2.4 Subtask 4 – Tier 3 Help Desk

The contractor shall provide, maintain, and conduct Tier 3 help desk support. The Government defines a Tier 3 help desk as the specialized skills and support over and above the skills and experience of Tier 2 support. Tier 3 support deals with complex system and software issues that require in-depth technical, architectural, and developmental knowledge to solve a problem which may require a workaround, or modification to the system and/or software.

The contractor shall provide Help Desk Trouble Ticket Status Reports (TTSR). At a minimum, these reports shall include a status of problem resolution ongoing for open help desk trouble tickets, the number of tickets open during that week, applicable ticket numbers, location of issue, number of tickets created that week, number of tickets resolved, number of tickets closed, and an unclassified summary of problems addressed by those tickets. If applicable, at the request of the Government, a detailed classified summary of the resolution shall be provided.

Page 7 of 21 Pages

a) Provide initial triage and response IAW section 7 performance standards.

b) Provide Tier 3 help desk support 24 hours a day, seven days a week, and 365 days per year.

Deliverables:

A014 - TTSR

6.2.5 Subtask 5 – Test & Evaluation

The contractor shall conduct software test and evaluation. The Government defines software testing as a process of executing a program or application with the intent of finding the software bugs and verifying that a software program or application meets requirements and operates as intended. Testing is comprised of testing at the contractor’s facility, Contractor Integration Testing (CIT) at the Government’s facility in the SIPR environment and support for Government Acceptance Testing (GAT), which may consist of one or more of the following test events based on complexity of the change: (System Acceptance Testing, Operational Testing (OT), Limited User Assessment (LUA), Risk Reduction Test Event (RRTE), Interoperability (IOP), and Cybersecurity Testing).

a) Test external Commercial Off The Shelf (COTS) patches or internal (contractor developed) patches in an unclassified and SIPR environment. Testing shall be employed to ensure that the patch applied did not introduce any new defects and the software operates as intended. This shall be documented and delivered in a Patch Test Report.

b) For CIT, the software shall be fully tested by the contractor in the Government SIPR environment to ensure that the software is free of Priority 1 and Priority 2 defects prior to the start of GAT. This shall be documented and delivered as part of the CIT Test Report.

c) Provide any releases, patches, or re-deliveries to resolve issues in software already operationally fielded free of any new defects.

d) Ensure all test incidents identified in GAT are addressed by generating the analysis and resolution for the identified incident(s) and captured in the Defect GAT Report.

e) Provide a test plan and test cases prior to the start of CIT for all releases.

Deliverables:

A015 - Patch Test Report A016 - CIT Test Report A017 - Defect GAT Report

6.2.6 Subtask 6 – Risk Management Framework (RMF)

The contractor shall execute Information Assurance (IA) processes throughout the lifecycle of this TO. This includes following the DoD RMF process IAW DoDI 8500.01, GFM PMO Standard Operating Procedure (SOP), and maintaining compliance with DoD and DISA Policies, Processes, Instructions, Controls and Tasking Orders.

The place of performance for executing RMF shall be at DISA Headquarters, 6910 Cooper Ave, Ft. Meade, MD 20755-7088, Monday-Friday. Alternate work sites will need to be approved by the COR 48 hours in advance.

The contractor shall assess, analyze, plan, implement, and support cybersecurity and IA. For this procurement the Government defines cybersecurity and IA as follows:

Page 8 of 21 Pages

Cybersecurity - Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.

IA - Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and nonrepudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

The contractor shall:

a) Implement RMF accordance with National Institute of Science & Technology (NIST) 800-37 and shall assess the system IAW NIST 800-53A.

b) Create and keep updated in Enterprise Mission Assurance Support Service (eMASS), POA&Ms for each non-compliant control that cannot be remediated.

c) Document the security control implementation including status and artifacts in the RMF version of eMASS.

d) Register any deviation from STIG Compliance in eMASS as non-compliant security control. If the contractor cannot correct the non-compliance within the timeframe set by the Government’s Vulnerability Management Policy, the Contractor shall submit a POA&M for correcting the non-compliant security control in eMASS, or the contractor shall submit an Authorizing Official (AO) risk acceptance request within eMASS for non-compliant security controls that the Government agrees cannot be remediated within reasonable costs and time.

e) Use the most up-to-date, relevant, and agreed upon Security Technical Implementation Guides (STIGs), conduct a full self-assessment at least twice a calendar year, and perform incremental self-assessments continuously.

f) Submit a Self-Assessment Plan. Approval from the Government Information System Security Manager (ISSM) and Security Control Assessor Representative must be attained prior to implementation. The plan shall include the STIGs that will be used, STIG version number, accreditation boundary, system software and hardware, any security software that will be used (i.e., Fortify, Assured Compliance Assessment Solution.

g) Deliver a full Self-Assessment Report to the Government, which includes, all information from the Self- Assessment plan in addition to the number of CAT I, CAT II, and CAT II STIG and IAVM finding for each system component.

h) Deliver Self-Assessment Results in the form of STIG Viewer checklist files. Within the checklist files, the Contractor shall document the compliance status for all STIG checks and an explanation for how and why the STIG check is compliant, non- compliant, or not applicable. For code related findings, the Self-Assessment Results shall indicate where in the code the issue was discovered.

i) Provide a prioritized list of POA&Ms with recommended milestones, mitigations, and comments to the Government.

Deliverables:

A018 - Self-Assessment Plan A019 - Self-Assessment Report A020 - Self-Assessment Results A021 - POA&M List

6.2.7 Subtask 7 – Demonstrations, Conferences, and Exercise Support The Contractor shall perform classified and unclassified demonstrations of JPES to the Government on a per sprint basis showing progress towards achievement of the Release Management Plan. This shall include preparing briefing slides, drafting demonstration scripts, and conducting the demonstrations as the subject matter expert of JPES.

Demonstrations shall be tailored to the intended demonstration audience. Additional demonstration service may be required at the JPEC Actions Group (JAG) hosted by the Joint Staff at Norfolk, Virginia, minimally three times annually, or virtually at other times or during the bi-weekly JPES development Integrated Product Team (IPT) meetings hosted by the Joint Staff and DISA JPES PMO. With each demonstration, the Contractor shall provide the Government with a script to allow Government personnel to try out the functionality on the Contractor’s maintained

Page 9 of 21 Pages

First Look Site. Feedback from the users shall be collected by the Contractor. The Government will provide guidance on prioritization of the user feedback. The Contractor shall document Lessons Learned.

The Contractor shall provide briefing slides, familiarization training, system maintenance, software troubleshooting and service, and JPES subject matter expertise to military exercises. The Contractor shall provide both classified and unclassified functional / familiarization training that is specifically tailored to the intended exercise audience.

6.3 Task 3 – Infrastructure Support

The contractor shall provide services to support, maintain, and operate the JPES & JCRM infrastructure and environments for sustainment, development, and production.

The contractor shall provide system administration, integration, maintenance, and sustainment of JPES and JCRM software and hardware within the DISA Headquarters Laboratory spaces.

The system support and integration of the JPES & JCRM environments comprises of the installation and configuration of network devices and software systems, including databases. The contractor will be responsible for performing day-to-day activities, including but not limited to, access control via VPN, Virtual Desktop Infrastructure (VDI) and Remote Desktop Provisioning (RDP) accounts to servers, Windows and Unix-based management, system design and implementation, system deployments, architectural design and layout, system maintenance, installation of developer tools, and facilitating access from developers, from initial request for access to final grant of access.

6.3.1 Subtask 1 – Lab Environment

The contractor shall provide support to install, configure, maintain, and sustain assets such as networking equipment, virtual machines, containers, servers, or other hardware assets supporting JPES & JCRM Programs both in the physical laboratory and virtualized environments as appropriate. The contractor shall follow installation procedures when available and research, apply and document procedures not yet documented. Hardware can range from Domain controllers, IBM DataPower, CISCO or other Switches/Routers/Firewalls, Network Analysis equipment, KVM Switches, to Dell/HP or Sun/Oracle/Solaris Servers and Workstations. Software ranges from CISCO IOS, VMWare ESXi, RHEL, Windows, Solaris, and Oracle custom software. The contractor shall install and/or maintain Oracle, PostgreSQL and other Database Software as well as provide DBA support to import/export and manipulate Databases.

The contractor shall install and/or maintain Weblogic, Java, and other middleware Software (Adobe Flash, etc.) to include various open-source Apache Application and Webservers such as Tomcat, etc. The contractor shall secure JPES & JCRM systems and provide support obtaining connection approvals through the Government (ATO) process.

The contractor shall complete the installation and utilization of Security Content Automation Protocol (SCAP), Assured Compliance Assessment Solution (ACAS), Host-Based Security System, (HBSS) and investigate/correct/mitigate STIG deficiencies as well as execute or request Network configuration to secure the systems. The contractor shall perform software installation/maintenance/lockdown, to include various types of Adobe products, Microsoft Office, Firefox, Chrome, other web browsers, Antivirus, SCP/SSH/Putty, Puppet, .NET, Java, SoapUI, Loadrunner, Unified Functional Test, WebInspect, CISCO Anyconnect, GVS, Tumbleweek, 7-zip etc.

The Contractor shall provide technical expertise for the Operations and Maintenance of the deployed JPES & JCRM IAW all sections of this PWS. The Contractor shall ensure that JPES & JCRM (and its associated connectivity to all critical interfaces) is operational and maintained to service mission requirements (ready, stable, and reliable). This technical expertise is not only applicable to the operational suites, but also to the Continuity of Operations (COOP) suite. This technical expertise also extends to maintaining a current (up to date) data load for access and use by the deployed software. For this TO, this will primarily be for all the DevSecOps environments.

The contractor shall maintain the Microsoft Azure IL6 environment for JPES to include setting up and configuring the DevSecOps pipelines.

The contractor shall provide the technical expertise to setup and maintain Virtual Machines.

The contractor shall setup and maintain Red Hat Enterprise Linux Operating System to include patching and STIG remediation.

The contractor shall install and maintain the current JPES & JCRM versions.

Page 10 of 21 Pages

The contractor shall provide detailed installation instructions of the JPES application in IL6 to include all required infrastructure.

The contractor shall setup, configure, and maintain the JPES IL6 DevSecOps pipelines in the Command and Control Software Factory to include delivery of detailed installation instructions.

The contractor shall maintain and when requested by the Government, provide the scripts applicable to the JPES Microsoft Azure environment.

The contractor shall provide technical expertise for the performance of preventive maintenance on JPES & JCRM to ensure that it’s operating correctly and to minimize the risk of system failures. This will include performing system checks and ensuring that system backups are functioning correctly.

The contractor shall provide technical expertise for the performance of corrective maintenance and provide prompt repair services for any system failures or malfunctions. This will include diagnosing and resolving issues and performing system restorations from backup.

The contractor shall procure and maintain all COTS products required to sustain and maintain JPES in the Microsoft Azure IL6 environment.

6.3.2 Subtask 2 – System Administration Integration

The contractor shall provide integration & configuration management for JPES & JCRM delivered maintenance fixes/releases in DISA Headquarters Laboratory spaces, cloud, and virtualized environments as appropriate, to include all their supported environments. Following a successful delivery of software and documentation artifacts to the Configuration Management (CM) Repository and upon receipt of cybersecurity approval, the contractor shall install the software. The contractor shall also ensure that all required external data source interfaces are connected and operational and perform a software smoke-check to provide assurance that the installed software is ready for testing.

The contractor shall establish/administer data management and database user accounts, including consolidated permissions for data access. The contractor shall audit database activity to ensure operational capability.

6.3.3 Subtask 3 – System Administration Support

The Contractor shall test, implement, and assess the impact of software/hardware patches, upgrades, fixes, and enhancements in the test environments. The contractor shall deliver an impact report based on the findings. The impact report shall include red lines on any installation or other instructions.

The Contractor shall provide support for IAVAs and troubleshooting of issues in the test environments.

Deliverables:

A022 - Impact Report

6.3.4 Subtask 4 – System Administration Documentation & Artifacts The contractor shall prepare, complete, and update the documentation and other artifacts for the Government to perform the System Administration Support functions, to include Technical Analysis / Analytics & Reports, Standard Operating Procedures (SOPs), Lessons Learned, System Maintenance Instructions, Lab Wiring Diagrams, etc.

Deliverables:

A023 - System Admin Documentation

7. Performance Standards.

Page 11 of 21 Pages

Task Performance Standard Acceptable Quality Level (AQL) Method of Calculation

6.1 – 6.3 Deliverables and work products shall be evaluated in terms of meeting the objectives of the requirement and the deliverables or work product accuracy, clarity, conciseness, and completeness. All deliverables and work products shall be evaluated for depth and breadth of technical discussion, and the degree to which deliverables or work products enable third parties to understand the subject of the deliverable or work product.

Deliverables and work products shall not exceed three (3) revisions IAW schedule suspense date. The Contractor will have 5 business days to complete each revision and re-submit to the Government.

• 1st draft: 90% accurate, clear, concise, complete, depth and breadth.

• 2nd draft: 98% accurate, clear, concise, complete, depth and breadth.

• Final: 100% accurate, clear, concise, complete, depth and breadth.

100% Inspection

6.1 – 6.3 All tasks and work products identified by the Government shall be executed and delivered IAW the Government’s identified suspense date(s).

95% of Tasks and Deliverables identified by the Government shall meet the Government’s identified suspense dates.

100% Inspection

6.1 – 6.3 The contractor shall ensure that sufficient staffing and appropriately, skilled personnel are employed in the execution of this Task Order.

100% of this Task Order. Periodic Inspection

6.1 – 6.3

The contractor shall fill all Key Personnel positions identified in DITCO Instruction H3 within 15 business days of the TOs Period of Performance (PoP) start date and any future vacancy.

100% of this Task Order. 100% Inspection

6.1.5 The schedule shall be baselined within 30 business

days of Task Order start date and further changes cannot be made without concurrence from the Government. Schedule slips shall be communicated within 2 business days following the identification of the change. This notification shall include risks, impacts, probability of occurrence and potential schedule recovery mechanisms. The Contractor shall identify and propose a mitigation plan for each risk and issue identified.

Materials contain required information and are delivered on time at least 95% of the time. Revisions that occur are minor and are resolved in a satisfactory manner.

100% inspection

6.2 - 6.3 Functionality of software delivered allocated to a release shall be delivered in IAW the SRP.

95% AQL

The percentage of functionality of the release will be calculated by dividing the number of requirements/functions in the release against the number of functions planned in the SRP.

Periodic Inspection

– Functionality will be verified during Government Acceptance Testing.

6.2 - 6.3 Meeting the Definition of Done for each story. 90% of planned stories meet Definition of Done.

Periodic inspection by Government Product Owner.

Page 12 of 21 Pages

6.2 New defects in software delivered.

Any patches or re-deliveries to resolve issues in software already operationally fielded shall be free of any new defects.

0 Priority 1 defects 0 Priority 2 defects

Periodic Inspection

– To be verified during Government Acceptance Testing.

6.2.4 Tier 3 help desk shall provide initial triage and

response to issues as follows:

Priority 1: ≤ 2 hours Priority 2: ≤ 2 hours Priority 3: ≤ 48 hours Priority 4: ≤ 48 hours

Performance occurs with no required re-performance or re-work at least 95% of the time. Problems that occur are minor and resolved in a satisfactory manner.

Period Inspection of

TTSR.

6.2.6 The contractor shall notify the Government within

20 business days of expiration if a POA&M deadline or milestone cannot be met.

95% AQL Periodic Inspection of POA&M

8. Incentives.

The Government will positively and/or negatively review the contractor's performance based on the success or failure in meeting Quality Assurance Surveillance Plan objectives and all contractual obligations. The contractor is incentivized to earn favorable Government reviews to service continuation of DISA work and to service contract awards with other Government agencies seeking DISA's input on the Contractor's past performance and the Contract Performance Assessment Reporting System. Failure to meet the acceptable quality levels may result in an unsatisfactory past performance report by the Government.

9. Place of Performance.

Mission Location: DISA Headquarters, 6910 Cooper Ave, Ft. Meade MD 20755-7088

Contract performance shall be a combination of contractor-provided facilities for performance of unclassified work and all classified work to be performed at DISA facilities at DISA HQ, 6910 Cooper Ave, Ft. Meade, MD 20755- 7088. Situational teleworking may be approved by the COR. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services.

The Place of performance for Contractor's executing PWS Subtasks 6.2.6 – RMF shall be at DISA Headquarters, 6910 Cooper Ave, Ft. Meade MD 20755-7088, Monday-Friday. Alternate work sites will need to be approved by the COR 48 hours in advance.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Local travel to and around the mission location (or place of performance if the PWS does not include a list of places of performance), (add mission location such as DISA HQ Ft. Meade include contractor’s facility as well if that is part of the place of performance) may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS or OCONUS (if applicable) may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility.

Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the

Page 13 of 21 Pages extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance.

The Period of Performance (PoP) will be for

Base period: August 2026 to August 2027 Option Period 1: August 2027 to August 2028 Option Period 2: August 2028 to August 2029 Option Period 3: August 2029 to August 2030 Option Period 4: August 2030 to August 2031

Additional six-month option to extend services – FAR Clause 52.217-8: August 2031 to February 2032

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. Security Executive Agent Directive 4, National Security Adjudicative Guidelines, 8 June 2017

m. DoDM 5400.07, Freedom of Information Act Program

n. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

o. DoD Instruction 8510.01, “Risk Management Framework for DoD Systems,” July 19, 2022

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore, the company must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances

Page 14 of 21 Pages will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by

DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS Task / Subtask Clearance Level Access Justification for Access to Classified 6.1-6.4 Final SECRET SIPRNet The supported systems outlined in this

PWS require a FINAL SECRET clearance, all Contractor personnel must have this minimum clearance if they will be working with the Document IA Control posture in eMASS system classified data or working with the production systems on the SIPRNET.

11.3 Investigation Requirements. All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.3.1 The contractor is required to have personnel cleared with an interim or final Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization . Visit requests shall be processed and verified through the Defense Information System for Security (DISS) to SMO DKABAA10. DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR or Alternate COR specified in Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. DISS verification of Visit Authorization by Security Manager

4. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

Page 15 of 21 Pages

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

• Certification of personnel security clearance and any special access authorizations required for the visit

(type of investigation & date and adjudication date & agency)

• Name of COR/Alt COR

• Dates or period the VAL is to be valid (i.e., Start date / End date)

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.3 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology

Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

• Date contractor CAC was collected

• Name of COR/Alt COR

• Termination Date

• Reason for Termination: <insert reason from the 13 adjudicative guidelines, other actions, or type “No longer working on contract”>

*Any VAL/VAR submitted without the above information will be denied.*

Page 16 of 21 Pages

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-4039 or via mail at:

Defense Information Systems Agency Defense Information Systems Agency ATTN: J1/ MP61, Industrial Security ATTN: J1/ MP62, Personnel Security Command Building Command Building 6910 Cooper Ave. 6910 Cooper Ave.

Fort Meade, MD 20755-7088 Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Paula Gallman Phone Number: 301-225-5128

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2…