DRAFT PWS-J62D WMS SAP Hosting Support Services.docx

SECTION 1: DLA WMS – MaxSecure / Training Support ROM Estimate

BASE PERIOD

Mar 1, 2024 to Feb 28, 2025 (12 months)

1. SAP NS2 Engineering Architect

2. SAP NS2 TQM

3. SAP NS2 Support Portfolio including:

SAP NS2 Safeguarding

SAP NS2 Expert Resources

SAP NS2 Support Empowerment

4. SAP NS2 Expertise on Demand

5. 7 x 24 Priority Remote Support

OPTION PERIOD 1*

Mar 1, 2025 to Feb 28, 2026 (12 months)

1. SAP NS2 Engineering Architect

2. SAP NS2 TQM

3. SAP NS2 Support Portfolio including:

SAP NS2 Safeguarding

SAP NS2 Expert Resources

SAP NS2 Support Empowerment

4. SAP NS2 Expertise on Demand

5. 7 x 24 Priority Remote Support

*Note: The assignment of the SAP NS2 Engineering Architect, Support Technical Quality Manager, and SAP NS2 Support Portfolio Resources and the delivery of MaxSecure Support could be affected if the written notice of the option is not exercised within 30 (thirty) days prior to the expiration date of this Order Form.

OPTION PERIOD 2*

Mar 1, 2026 to Feb 28, 2027 (12 months)

1. SAP NS2 Engineering Architect

2. SAP NS2 TQM

3. SAP NS2 Support Portfolio including:

SAP NS2 Safeguarding

SAP NS2 Expert Resources

SAP NS2 Support Empowerment

4. SAP NS2 Expertise on Demand

5. 7 x 24 Priority Remote Support

*Note: The assignment of the SAP NS2 Engineering Architect, Support Technical Quality Manager, and SAP NS2 Support Portfolio Resources and the delivery of MaxSecure Support could be affected if the written notice of the option is not exercised within 30 (thirty) days prior to the expiration date of this Order Form.

SECTION 2: PERFORMANCE WORK STATEMENT

Brand Name SAP Software Licenses, Software Maintenance & Cloud Hosting Services in support of the Warehouse Management Systems (WMS) Program and Technical Refresh of Distribution Standard System (DSS)

1.0 BACKGROUND

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency that provides worldwide logistics support for the missions of the Military Departments and the Unified Combatant Commands under conditions of peace and war.

DLA’s current system for distribution processing of material is the Distribution Standard System (DSS). This requirement is in support of a working lifecycle technical refresh of DSS ongoing project to move to SAP products and better align DLA warehouse and distribution processes with industry standards and simplify storage and distribution requirements. The SAP system is called the Warehouse Management System (WMS) and is composed of the following SAP modules:

· Extended Warehouse Management (EWM)

· Transportation Management (TM)

· Global Trade Services (GTS)

· Event Management (EM)

· Enterprise Resource Planning Central Component (ECC)

· Process Orchestration (PO)

· Process Integration (PI)

· Solution Manager (SolMan)

· Business Objects Enterprise (BOE)

· Fiori Front End (FF)

· Enterprise Portal (EP)

· Message Queue (MQ)

· Web Dispatcher (WD)

· HANA Cockpit

· Data Services (DS)

· System Landscape Transformation (SLT)

· Enable Now

· S4 HANA

· HANA Side Car

WMS SAP Hosting Support Services

DLA currently operates around the clock warehouse support. DLA expects to have at least 10,000 users for the overall WMS system with approximately 4,000 concurrent sessions on any given day. DLA expects about 300 users for the software which requires named user licenses and approximately 1,000 users of business intelligence functionality.

Under previous task orders, DLA has purchased Cloud Access and Hosting Services via Perpetual Licenses and Software Licenses (as listed below):

SP3300-18-F-0378

Period of Performance: March 1, 2024 through February 28, 2025 The following SAP software licenses, maintenance and cloud hosting services were acquired.

· SAP Secure HANA Cloud Platform (GSA Material Code # 8005078) for the following 6 Environments: Development, Test, Quality Assurance, Patching/Sandbox, DR, Production

· SAP Data Services licenses

· SAP Information Steward Licenses

1.1 SCOPE OF WORK

A. DLA has 133 sites with approximately 210 warehouses that will be using the technically refreshed DSS. DLA has already configured 6 hosting environments to support the WMS lifecycle and requires continued hosting services for the environments. Each environment will have a fully operational copy of the WMS application. The environments required to support this initiative are:

1. Development

2. Test

3. Quality Assurance

4. Patch Fix/Sandbox

5. Disaster Recover (DR)

6. Production

The hosting environments are partially implemented with additional site roll outs continuing through the start of the Period of Performance beginning on March 1, 2024. The hosting environment must be able to scale capacity to meet the increased requirements as the DLA sites are brought into the system. The scalability should include an increase in quantity and size as determined by the cloud hosting provider’s experience in support of similar applications of size and scale. The full rollout to all DLA locations will continue through at least May 2025. The current database storage being used for the legacy DSS production system is approximately 4.1 TB of data. Storage capacity must be sized to support the production data requirements. Service Level Agreements (SLAs)/Service Level Requirements (SLRs), including Disaster Recovery requirements, are listed in section 1.2 below. DLA seeks to procure brand name SAP software maintenance and cloud hosting services in support of the DSS/WMS technical refresh project in support of DLA’s current existing software license and cloud hosting environment. DLA will transition to the SAP RISE licensing model that is subscription based on our previous model. We will lose nothing that we had under the previous model as a result of the change to the new RISE model. At this time, DLA has a requirement for renewal/continuation of the current WMS annual software maintenance and cloud hosting infrastructure.

· There is a requirement to support additional 3rd party software TBD, in the AWS hosting environment. Tricentis is an existing example of additional 3rd party software, however additional software needs may be identified in the future and need to be supported.

· All DoD cybersecurity standards and policies will also need to be followed and implemented to include patching and STIG compliance.

B. The Period of Performance of the work is as follows:

PoP:

C. This is a non-personal services contract to provide information technology services. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the Contractor. The Government may provide technical direction which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the Contractor to perform the service requirements set forth in the PWS.

1.2 Specific Tasks and Deliverables

1.2.1 Task Area 1 (IUS #0003)

1. CLOUD HOSTING & HOSTING SUPPORT (Cloud Access (SAP-06))

A. The contractor shall provide continued hosting support for WMS in a Department of Defense (DoD) certified FedRAMP Impact Level 4 (IL4) cloud hosting environment. The current environment is in the Amazon Web Services (AWS) Federal Government cloud offering. This shall include the below hosting environments:

· Development

· Test

· Quality Assurance

· Patch Fix/Sandbox

· Disaster Recovery (DR)

· Production

B. Overarching Security Requirement: The contractor shall provide FedRAMP IL4 (GovCloud) certified hosting for WMS to include all associated technology in compliance with:

i) DoD Secure Cloud Computing Architecture (SCCA) Functional Requirements (3/6/2017)

ii) Cloud Computing Security Requirements Guide (SRG) are available at: https://cyber.mil/dccs/ References:

· NIST SP 800-88, et al.

· DoDM 5200.01, DoD 5220.22, et al.

· NIST SP 800-63, et al.

· NISTIR 8006, et al.

· DoD Directive 8140.01

· NIST 800-37, Rev 2

· NIST 800-47, Rev 1

· NIST 800-53, Rev 5

· 44 U.S. Code Chapter 21, et al.

· NIST RMF, CSSP, et al.

· CNSSI 1253, DoDI 8510.01, et al.

· DoDD 8100.02, FIPS 140, Circular A-130, et al

· Government Accountability Office (GAO) Federal Information System Control Audit Manual (FISCAM); a copy of the FISCAM manual can be found at: http://www.gao.gov/products/GAO-09-232G

The Impact Level 4 GovCloud Solution must provide security that enables enhanced cyber defenses from the root level of systems through the Operating System (OS)/database (DB) layer with improved capabilities including continuous monitoring and auditing, automated threat identification, resiliency against persistent adversary threat, and an operating environment that meets or exceeds DoD information security requirements.

C. The contractor shall provide services that comply with the below requirements for audit readiness compliance:

· The Contractor shall comply with Support Controls described in the Government Accountability Office (GAO) Federal Information System Control Audit Manual (FISCAM); a copy of the FISCAM manual can be found at: http://www.gao.gov/fiscam/overview.

D. The contractor shall provide the infrastructure, networking, and architecture support for HA (High Availability) in the Production, DR and QA environments within the scope of this PWS. This shall include automated failover to alternative systems across multiple availability zones, utilizing automated tools such as Pacemaker. High availability will be expected at the database level regardless of size. DLA will define what areas of the system are to be included in the high availability of the system. Configuration and management for application-level HA will be the responsibility of DLA. DLA WMS also maintains a QAS (Quality Assurance) environment which performs the function of a pre-production or staging and is a mirror image of the Production. Therefore, DLA WMS requires QAS to have the same level of HA support as the Production environment.

· All 5 main components (EWM, ECC, TM, GTS, PI/PO, FIORI) must remain available at all times during patching. This should be delivered as part of the HA strategy.

E. The contractor shall support Remote Desktop Services (RDS) licensing/capabilities on all jump servers and Business Objects Data Services (BODS) servers for 10 concurrent users.

F. The contractor shall submit to DLA technical drawings and descriptions describing all technical aspects of the hosting environment. After the environments are stood up and deployed, the contractor shall deliver “as built” drawings and descriptions. The contractor shall submit a current drawing and include a list of all hardware and software supporting the hosting of the system on a quarterly basis. This must include at minimum host specifications, the OS running, CPU, memory, storage and a list of software installed on every server in all environments. The contractor shall include licensing details for all software on the quarterly licensing report. If any change is made to the environments at any time during the PoP, the contractor shall provide updated drawings to DLA within 10 business days of the change. DLA WMS must comply with RMF ConMon (Risk Management Framework) (Continual Monitoring) requirements, and as such will need an annual complete hardware and software list. However, it would be the expectation that the contractor would maintain a current hardware and software list that could be provided to DLA upon request to satisfy audit readiness requirements.

G. Contractor shall provide a final build sheet when a new system is created or when a system configuration is altered. The build sheet shall contain the detailed resource configurations defined in the DLA provided build sheet. Final approval of the build sheet shall be obtained from DLA prior to implementing changes.

H. The contractor shall provide a Project Plan as a deliverable, showing how the contractor will perform deployment, maintenance, and administration of the cloud environment to meet all applicable government, DoD and DLA rules, regulations, and standards. This will include an active role in participating in DLA RMF activities. The contractor will be required to participate in meetings, discussions and provide documentation in support of RMF and audit requests. The environments must meet all RMF and cyber security compliance and continuous monitoring requirements. The contractor must provide all artifacts, documentation and information necessary to meet the needs of RMF requirements. Refer to DoDI RMF 8510 for more information on the RMF process. The contractor will also need to maintain the system in accordance with relevant issued Security Technical Implementation Guide (STIGs). The current list of STIGs is available at www.cyber.mil. The Information System Security Manager (ISSM) will have the ultimate authority on applicable STIGs. Contractor shall conform to any and all Risk Management Framework (RMF), STIG, and SRG requirements and shall provide documentation of compliance when requested by the Program Management Office. The contractor has the responsibility for tracking vulnerabilities, with DLA WMS PM being the accountable party.

I. The hosting provided shall also include backup processes, for all environments as identified in the SLA section below. This process shall be documented in the Backup Plan listed in the Deliverables below. The contractor shall perform (upon DLA request) an on-demand backup of the production environment be done prior to every system release. That backup shall be available until DLA authorizes removal or the next release backup is requested. At any time there will only be one required system release backup. This requirement does not reduce or remove the regularly scheduled backups and normal retention periods for routine backups.

J. The contractor shall support a full disaster response and recovery capability. The contractor shall support a full reconstitution to the primary site following a Disaster Recovery (DR) event. If the primary site is considered a complete loss, a plan to reconstitute the non-Production environments (SBX, DEV, TST, QA) must be supported. In addition, if the primary site is considered a complete loss, then another DR site needs to be identified and configured to support DR functions. The contractor shall submit as part of their Project Plan a disaster response and recovery plan. In this plan the contractor must define their processes for disasters that may occur and include in the plan the location of alternate site storage and the process for data replication. The plan must include details around recovery time objectives (RTO) of 8 hours and recovery point objectives (RPO) of 30 minutes. If the frequency occurs more often, include those details on how often these tests occur. Also include a description of the procedure on how the tests are conducted and what DLA should expect in regard to potential downtime or outages when a test occurs. The plan shall include the frequency of disaster recovery tests that must occur at least once per year and document the results of the tests in a separate plan known as the Disaster Recover Report (DRR). The contractor shall perform at minimum one disaster recovery test per year. Following the test, the contractor shall submit to DLA the DRR identifying how the test worked, what changes will be made for future tests and what changes are necessary to the DRR plan. The Disaster Recovery (DR) environment must be separated from the primary processing site by at least 75 miles or more. Reconstitution to the primary site following a DR event must occur as soon as possible following notification that the primary site has regained fully operational capability and is no longer in danger of being impacted from the event. Full reconstitution must occur within 30 days, with a prioritization of environments being provided by DLA. DLA requires a Full Failover Exercise operating production for at least 2 weeks at the alternative site every two years. The contractor shall support DLA in performing the Full Failover Exercise at least twice during the contract performance period.

K. The contractor shall provide a Maintenance Plan which includes a description of how maintenance will be performed in the hosting environment. This must include how regular/routine and critical/unplanned maintenance is to occur. In addition, DLA requires an annual maintenance plan update to include a schedule at the beginning of every option identifying all planned maintenance windows and what is planned to be included in maintenance. The contractor shall provide notification to DLA in writing 5 business days in advance of all maintenance to include what maintenance is occurring and all patching that will be included in the maintenance.

In addition, the contractor shall include in the maintenance plan their change management process to include definition of how all updates, changes or new services are implemented in the hosting environments. The contractor shall also include in their Maintenance Plan how they will comply with DoD data sanitization and cleansing requirements. Include how removal or deletion of a service or host is handled.

L. The contractor shall not use shared accounts to access any system. Each account will be uniquely identifiable and tied to a specific user. No accounts will be created or permissions modified without a completed System Authorization and Access Request on file and only with the approval of the government.

· A DD Form 2875 or AMPS electronic submission will need to be provided and approved for any service or system account that is requested.

M. All environments shall implement logging according to the DLA Audit Logging Implementation Guide and shall all retain logging details and retention of logging data. The contractor shall submit to DLA daily log files that include data from the AWS Cloud Console/AWS CloudTrail, management console and event history for the operating system and database. These files must be submitted at a minimum daily to the DLA enterprise logging solution. Contractor shall work with the DLA Enterprise Logging team to immediately resolve issues with sending audit logs to DLA. All Operating System (OS) and Database (DB) event logs should be sent to the approved centralized log repository (currently SPLUNK) on a daily basis. The requirement is that they are sent to the server by 1000 EST.

N. The contractor shall review the results of vulnerability management scans and provide a timeline for remediating all found vulnerabilities. If the contractor identifies any findings as false positive findings, a justification with documentation will be provided to the government vulnerability scanning team and the contractor shall meet with that team to justify the false findings.

O. The contractor shall support all DLA efforts, projects and timelines for efforts related to migrating to DLA Identity Management (IDM). DLA IDM is an enterprise direction towards improving and centralizing security as it relates to user identity and user access.

P. The contractor shall include in their Project Plan their escalation procedure defining how they escalate and report any issues. This must include details on how troubleshooting is accomplished, how issues are escalated and define their escalation process. Include details on how incident reports and service requests are made, documented, escalated, worked and closed out. SLAs on incident reports and service requests are listed below.

In support of this the contractor shall include in their escalation process that they will notify DLA Information Technology Operations Center (ITOC), COR and Technical point of contact (TPOC) of any problems within 1 hour of all hosting environment issues that affect operational functionality.

The current contact information for the DLA ITOC and other relevant points of contact will be provided at time of award.

Q. The Contractor shall meet the following SLAs/SLRs:

(1) The production hosting environment shall have an availability of:

· DLA requires WMS Production systems to be available at a minimum 99.9% of the time. WMS is hosted in a cloud environment with an SLA from AWS that exceeds this requirement. This availability is based on unplanned outages. Scheduled downtime does not count against availability metrics.

· Reference section above describing High Availability configuration to support near zero downtime patching and High Availability configuration..

(2) The other non-production hosting environments shall have an availability of:

· DLA non production systems require 99.5% availability. WMS is hosted in a cloud environment with an SLA from AWS that exceeds this requirement. This availability is based on unplanned outages. Scheduled downtime does not count against availability metrics.

(3) All system and Maintenance requests should have a ticket submitted via DLA’s Service NOW system (https://dla.servicenowservices.mil/sp?id=index).

· If the contractor additionally wants to submit them in their system as well, this is acceptable.

· Additional details can be found in the subsequent Incident Report response requirements.

(4) Incident Report response & completion time:

· Priority 1 Very High (Critical Failure causing outage) – A production system is not available; an important component or critical business process in one or more business units is disrupted and the disruption cannot be worked around manually. There is a direct impact on business; an immediate negative effect is definitely expected. The disruption means individual groups or teams who work to business-critical deadlines are unable to work at all. No reasonable workaround exists. Support for Priority 1 Very High IRs shall be expected 24x7x365 as requested by the COR/COTR. The contractor shall provide the percentage of tickets that are being closed within priority specified timeline. A monthly percentage and annual percentage are needed to track this requirement.

a. Threshold Response Time: 20 minutes

1. Updates will be provided to the customer via the ticket or troubleshooting conference line every hour for all Very High (Priority 1) tickets until the issue has been resolved.

2. Updates should be made to the DLA SNOW ticket that was created.

b. The Contractor shall provide after hours contact information for emergency contact for Priority 1 issues in addition to entering a ticket in the contractor Service Now system. The contractor shall provide a phone number or e-mail address that can be used by DLA J62D senior management to quickly escalate a ticket. DLA J62D senior management will not maintain access to a vendor helpdesk system and must be able to escalate priority 1 tickets outside that system.

· Priority 2 High – A critical business process or function (for example, printing or an interface) does not work correctly, causing a significant impact on business. However, a manual workaround is available. The customer requires support for a critical business process with a short deadline to avoid affecting its financial results. DLA determines what is a critical business process and can be attributed to a non-production environment as defined by the COR/COTR. Support for Priority 2 High IRs shall be expected 24x7x365 as requested by the COR/COTR.

a. Updates should be made to the DLA SNOW ticket that was created.

b. Threshold Response Time: 2 hours for production systems and 4 hours for non-production systems.

1. Updates will be provided to the customer via the ticket every 4 hours for production and daily for non-production for every High (Priority 2) ticket until the issue has been resolved.

2. Updates should be made to the DLA SNOW ticket that was created.

· Priority 3 Medium – A business process or function does not work correctly, causing a minor impact on business; an effect on financial results is not expected. A manual workaround is available. The customer requires handling support for a business process with a fixed deadline but that will not have any critical impact on its financial results. The customer orders an enhancement or optimization of existing critical business process. Support for Priority 3 Medium IRs shall be expected 24x7x365 as requested by the COR/COTR.

a. Threshold Response Time: 4 hours for production and non-production systems.

1. Updates will be provided to the customer via the ticket every 3 business days for production and non-production for every Medium (Priority 3) ticket until the issue has been resolved.

· Priority 4 Low – General improvement to the system is required, but there is no direct influence on results. The customer requires handling support for a topic without a deadline and without influence on its results. The customer orders the enhancement or optimization of an existing business process without a deadline and without influence on its financial results. Support for Priority 4 Low IRs shall be expected 24x7x365 as requested by the COR/COTR.

a. Threshold Response Time: 1 business day for production and non- production systems.

1. Updates will be provided to the customer via the ticket every 1 week for every Low (Priority 4) ticket until the issue has been resolved.

· Service Request response time:

a. Threshold response time: 1 business day

1. Service request will be completed within three business days. If additional time is required updates will be provided to the customer via the ticket every two business days.

2. If DLA COR/COTR identifies a service request as critical to business operations the threshold response time shall be in accordance with a Priority 2 High IR as listed above and will be required to be supported 24x7x365 as requested by the COR/COTR.

(5) Backups for all environments shall be done according to the below:

a. Production

1. Backup

a. Daily and retained for 30 days with backups replicated to alternate site.

2. Restore

a. Recovery Time Objective: 60 minutes

b. Disaster Recovery

1. Backup

a. Daily and retained for 30 days

2. Restore

a. Recovery Time Objective: 8 hours

c. All Other environments

1. Backup

a. Daily and retained for 30 days with backups replicated to alternate site

2. Restore

a. Recovery Time Objective: 4 hours

(6) The contractor shall submit a monthly status report due on the 5th day of each month. The report is to document how the contractor is fulfilling this requirement, and shall include details on the following:

· Monthly and Annual (by PoP) statistics/metrics detailing total usage amount, capacity used and any changes from month to month (last month and current month with rate of change), system availability report for each environment for the month and overall by PoP including dates, times and duration of reported down time, resource allocation tracking from month to month and overall by PoP showing variation of resource allocations utilized to include memory, processors, disk space, storage for each host and by environment.

· Contractor to provide a fully reconciled list of purchased servers with what is currently deployed. Contractor shall update this list and provide to DLA on a monthly basis.

· Total number of incident reports and service requests received, the ticket numbers and subject of the tickets received and worked each month including any still open tickets at the end of each month. Include the closure rate on a monthly and annual basis illustrating that the contactor is meeting the response time requirements.

(7) The contractor shall provide a monthly AMI and DB Backup Status & Validation Report with the following:

· Identify the total number of backups that were successfully completed per environment.

· Identify failed backups:

a. Upon identification of a failed backup, the contractor shall take corrective actions to perform a current backup and identify the failure on the report.

· Contractor shall provide proof that Production environment backups performed are valid and can be used to restore a system

a. Backup verification is needed for all Production servers and can be proven through a random sampling of production system backups and performing a test restore. The success or failure of the restore process shall be documented and reported.

b. In the event a failure is determined, the contractor shall take corrective actions to ensure a valid backup is available and document the failures on the monthly report.

R. Operating System (OS) and Database (DB) account management processes will follow the DLA Access Control Plan, Segregation of Duties (SoD), Role Based Access Control (RBAC), Law of Least Privilege, and any other DLA documents as defined and approved by DLA. DLA account management processes, procedures, and approvals will always supersede any other contractor account management processes. This requirement pertains regardless of implementation with AMPS and AD. All account access should comply with DLA policy and procedures whether through manual provisioning and the use of DD Form 2875s or through AMPS.

S. Contractor shall document with a breakdown of all subnets deployed, and identifying which IPs are used and which are available. This documentation is be maintained and provided to DLA whenever changes are made.

T. SOC 1 Report

· Cloud / Data Center Hosting Organizations and Application Service Providers (ASPs): The SOC 1 report must be prepared in accordance with Attestation Standards Clarified (AT-C) 320, AT-C 105, and AT-C 205.

· The SOC 1 report must address the design and operating effectiveness of the Cloud Hosting organization’s controls to meet identified control objectives (generally referred to as a Type II report). The Government shall review any findings gleaned from the SOC 1 Report and/or Type II report and the contractor will be notified of the findings. The contractor shall address those findings according to negotiated Corrective Action Plan (CAP) timelines.

· The SOC 1 report must address any complimentary user entity controls of higher-level providers as applicable. The SOC 1 report will include information system general control objectives that are comparable with the U.S. Government Accountability Office (GAO) Federal Information System Controls Audit Manual (FISCAM) control objectives for security management, access controls, configuration management, segregation of duties, and contingency planning.

· The SOC 1 report period will begin October 1 and end on June 30 of each year.

· The SOC 1 report will be delivered to DoD (FIAR Directorate) no later than August 15 of each year.

· The Service Organization will provide a bridge letter to DoD no later than October 8 of each year to address the period from July 1 through September 30.

U. The contractor shall follow all required DLA and DoD cyber security requirements. This includes complying with the requirement to have all staff that interact with the DLA hosted environments certified in the baseline 8140 certification and the appropriate computing environment certification. The contractor shall provide a monthly 8140 deliverable report to the COR/COTR that includes a list of applicable 8140 key personnel. This report is due by the 5th calendar day of each month.

· Name

· IA Category

· IA Level

· Company

· Contract Name/Description

· COR

· Contract/Task Order #

· Primary/Baseline IA Certification Held

· Date of Primary/Baseline IA Certification

· Date Primary/Baseline IA Certification Expires

· Primary CE Certification Held

· Date Primary CE Certification Received

· Primary IA Certification Status (Current or Past Due)

· Primary CE Certification Status (Current or Past Due

8140 contractor personnel identified on this task order shall have their required DoD 8140 security and industry competency certifications prior to starting work and maintain their certifications throughout the life of this task order. The first report shall be a comprehensive report covering all 8140 personnel. The contractor is only required to report updates on a monthly basis thereafter (or report no changes). See the below Technical Exhibits list for the 8140 Deliverable Report template. This template is included as a separate attachment from the PWS. The WMS Project currently requires and IAT Level II Computing Environment (CE) Certification. If a certification becomes obsolete during the life of the task order, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification prior to the IT product’s end of life.

V. Test Contractor shall ensure that all DLA related communications are being made using their DLA email accounts. All meetings/presentations/briefings sponsored by the contractor should be done using DLA approved meeting tools/software. Contractors should be logging into the DLA network and would therefore be able to utilize the meeting software loaded on DLA VDI desktops. DCS conferences should only be used in situations where communication with outside parties is absolutely necessary.

· DLA will use available meeting tools (i.e. Microsoft Teams, Conference line, etc) to hold a meeting. Contractors with DLA access are required to use DLA meeting tools foremost.

Deliverables:

· Project Plan -Due: within 10 business days after date of award and then quarterly thereafter or within 10 business days after any major change.

· Backup Plan -Due: within 10 business days after date of award

· Disaster Recovery Report (DRR) -Due: within 10 days of the test or as needed

· The contractor shall perform at minimum one disaster recovery test per year- Due: As Required

· Maintenance Plan -Due: Within 10 business days of task order award and then Quarterly thereafter or within 10 business days of any change to the maintenance plan

· Log Files -Due: daily by 10:00 AM EST

· Monthly Status Report- Due: 5th day of each month

· System Availability Report – Due: 5th day of each month

· Breakdown of all subnets deployed and which IPs are uses and available -Due: As requested

· SOC Report- Due: August 15th or as required

· 8140 Report (template attached) -Due: 5th day of each month

· Build Sheet – Due as requested & when there is any change to a system

· Backup report for successful completions and status report of currently available AMI and Database backups – Due monthly

1.2.2 Task Area 2 (IUS #0007)

1. ANNUAL SAP SOFTWARE LICENSES AND MAINTENACE (Enterprise Maintenance (SAP-05))

A. DLA will transition to the new subscription-based licensing model SAP is now offering and will lose nothing we have required as a result of the change. DLA has a requirement to renew the maintenance on the identified existing software. The list of licenses is defined in attachment A which is an embedded spreadsheet at the bottom of this document.

B. The contractor shall submit to DLA a Licensing Report on a quarterly basis. The Report must itemize all parts of the environment that DLA is maintaining and any projected changes necessary to continue the appropriate level of support for the DSS/WMS system. The licensing report shall also include expiration dates on the licenses, notice of renewals, and the support level received for the licenses.

· Licensing Report -Due: quarterly

1.2.3 Task Area 3 (IUS #0003)

1. SAP MAXSECURE – SAFEGUARDING, END-TO-END HYBRID OPERATIONS

DLA security policy permits access to DLA’s SAP environment only by DLA- approved U.S. citizen personnel through DLA-specific secure communication procedures. This policy prohibits SAP Active Global Support from providing support to DLA through standard DLA procedures and protocols. Providing an SAP support environment with Facility and Personal level clearances will enable DLA to fully leverage SAP support experience and expertise, while maintaining a secure interface and reach back to the SAP Global Support and Development environments. Cleared US citizen support is not available through SAP global standard support, and therefore the DLA security and U.S. citizenship requirements can only be provided through SAP CD Max SPSLE Support and SAP MaxSecure Support.

A. The contractor will deliver MaxSecure services to facilitate the safeguarding and end to end hybrid operations in support of the DLA WMS Program.

a. Provide SAP technical support, including analysis of system degradations and determine corrective actions such as capacity upsizing, performance tuning, and data.

b. Provide technical support to DLA during performance testing and integration testing.

c. Provide recommendations for High Availability solutions for the SAP software components to meet RPO/RTO requirements.

d. Roadmap planning to future releases.

e. Architecture and solution assessments that provide short term stability as well as a long-term path to system consolidation.

f. Provide technical support and design assessments of the DLA Warehouse Execution System (WES) and its interface with WMS and its components.

B. Integration Validation Delivery Approach and Scope

· When user acceptance and integration tests are executed, nonfunctional requirements like performance, data consistency, exception management, and scalability need to be validated. The service supports customers to perform these tasks.

C. Volume Test Optimization Delivery Approach and Scope

· To make sure that volume testing delivers reliable results, volume test optimization takes place in three stages: assessment of the volume test plan, monitoring of the volume test, and reporting of test results.

D. Planning the Digital Transformation

· This service starts with the creation of a strategic road map and can end with the concrete transformation planning of an SAP implementation project. Applicable portions of best practices, solutions, and trends, along with business needs, are combined to derive a customer-specific transformation road map driven by customer-specific values, risks, and efforts.

E. Platform Design Support/Platform Execution

· The technical architecture and infrastructure service component supports customers in the technical design of a scalable, flexible, and maintainable SAP solution that fits their specific requirements. This is especially relevant when customers plan to migrate or transition to SAP products.

F. UX/UI Strategy

· The purpose of this service component is to do a fit-gap validation of SAP Fiori user experience (UX) based on an SAP standard setup in a sandbox environment. The gaps between sandbox setup and the customer-specific requirements are identified and validated and a solution will be defined. This allows companies to benefit from the new UX based on SAP Fiori.

G. Platform Design Support/Platform Execution

· Data migration requirements of newly implemented cloud or on-premise SAP products are assessed. For on-premise products, data migration requirements resulting from complex landscape transformation scenarios, such as system consolidation, can be covered as well.

H. Build Design Support

· The build design service covers all relevant functional design activities during the implementation of SAP on-premise and cloud products. The main purpose is to design and document a customer’s target SAP solution based on the functional scope identified in the project’s planning phase. A standardized, repeatable, and efficient methodology supports all SAP implementation projects, no matter if these projects are led by the customer, a partner, or SAP.

· MaxSecure Support Services Report – Due: Monthly

1.2.4 Deliverables

The Table below identifies the deliverables resulting from the tasks defined in Section 1.2 Specific Tasks and Deliverables. All completed deliverables shall be forwarded to the COR/COTR. Contractor shall use best commercial practices for formatting all deliverables under this task order. Electronic copies of all deliverables shall be sent to the COR/COTR via email in Microsoft Office compatible formats. If deliverable exceeds email size limitations, the deliverable shall be sent via Compact Disk (CD). A written monthly status report (in Word format) shall be delivered to the COR/COTR that includes information on problems, items to track, and a list of activities and deliverables completed during the preceding month via email to the COR/COTR.

TABLE 1: DELIVERABLES:

Table 1 identifies the Deliverables resulting from the tasks defined in Section 1.2

then Quarterly thereafter or within 10 business days of any major change to the project plan

Disaster Recover Report

test or as needed

then Quarterly thereafter or within 10 business days of any change to the maintenance plan

which IPs are uses and available

each month

readiness (2 business days)

AMI and DB Backup Status & Backup Validation Report

1.3 Technical Exhibits

TE NUMBER AND TITLE

Attachment A: Current DLA software licenses and new licenses

1 - DLAI5105 Reporting of Criminal Incidents

2 - ICT Accessibility Requirements Section 508

3 - Voluntary Product Accessibility Template (VPAT)

4 - 8140 Deliverable Report Template & Instructions

5 - DoD 8140 Approved Baseline Certifications as of

6 - DLA Approved CE Certification List

1.4 PERFORMANCE SUMMARY

1.4.1 ACCEPTABLE PERFORMANCE LEVELS

The COR will monitor performance to ensure SAP software maintenance and cloud hosting services are received as set forth in this task order. This monitoring shall be done via Government inspection and review of the various reports and documentation generated in performance of the SAP software maintenance and cloud hosting services requirements. The COR will monitor compliance with contract terms and conditions and identify nonconforming services to determine the appropriate action.

All work required under this task order is subject to surveillance. The Government will make objective assessments of the contractor’s performance to determine whether contract performance is acceptable. The contractor is expected to perform all functions in a professional manner and prepare accurate and timely documentation. Progress will be tracked based on the milestone event when the contractor receives a specific tasking.

Inspection and Acceptance Criteria Final inspection and acceptance of all work performed, reports and other deliverables will be delineated in the task order and accepted by the COR. All deliverables will be inspected for content, completeness, accuracy, legibility and conformance to contract requirements by the COR. At the discretion of the Government, inspection may include validation of information or software through the use of automated tools and/or testing of the deliverables.

If the Government finds that a draft or final deliverable contains spelling errors, grammatical errors, improper format, or otherwise does not conform to the requirements stated within the PWS, the document may be immediately rejected without further review and returned to the Contractor for correction and resubmission. If the Contractor requires additional Government guidance to produce an acceptable draft, the Contractor shall arrange a meeting with the COR.

The basis for acceptance shall be compliance with the requirements set forth in this PWS, the Contractor's proposal and other terms and conditions of the task order. Deliverable items rejected shall be corrected in accordance with the applicable clauses.

The Contractor shall provide electronic copies of deliverables. Electronic copies shall be delivered via email attachment or other media by mutual agreement of the parties. The electronic copies shall be compatible with the current DLA Microsoft (MS) Office products or other applications as appropriate and mutually agreed to by the parties. The Contractor shall use best commercial practices for formatting deliverables under this task order. If the draft deliverable is adequate, the Government may accept the draft and provide comments for incorporation into the final version. All of the Government's comments to deliverables must either be incorporated in the succeeding version or the Contractor must demonstrate to the Government's satisfaction why such comments should not be incorporated.

Performance Review and Payment Procedures The Contractor shall provide sufficient management to ensure that tasks are performed efficiently, accurately, on time, and in compliance with the requirements of this document. Specifically, the

Contractor shall designate a single Point of contact to oversee these tasks and interface with the Government regarding those assigned to these tasks. The Contractor shall ensure that a Monthly Progress Report is submitted outlining the expenditures, billings, progress, status, and any problems/ issues encountered in the performance of these tasks.

The following performance payment procedures will be applied to the resultant contract:

The contractor shall submit a combined monthly invoice for 100% monthly amount for each task.

As part of the COR’s monthly certification process, the COR will indicate on the invoice submitted, the amounts authorized for payment for each task based on the performance measures described herein. If there is an issue with performance that is determined unacceptable, the contractor will be notified to correct the problem and/or submit a corrective action plan within 5 business days of the notification. The corrective action plan will identify steps that will be taken to meet the full level of performance and the period of time the contractor believes it will take to reach that level. The Contracting Officer will determine whether the proposed plan is acceptable. If an unacceptable rating is determined, payment shall be withheld until the issues are resolved and concurrence is achieved. Once that is accomplished the contractor would begin to receive payments at the resultant performance level.

Below are the Performance Standards that will be used in evaluating performance in determining the amount of the payment owed to the contractor. These performance Standards apply to the deliverables listed above and to all performance under this task order PWS.

Performance Ratings

Agency. The Government will make the performance determination and the contractor will be paid the awarded amount.

on the mission of the Agency. The Contracting Officer will make the performance determination and the payment will be withheld pending resolution.

The ratings, as described in the table above, will be based on the performance of the contractor on the timeliness and quality of the services provided using the rating scale for each criterion as shown below.

Timeliness

Quality

2.0 GENERAL OPERATING CONDITIONS

2.1 INTERACTIONS WITH OTHER GOVERNMENT ORGANIZATION

The Contractor’s primary interaction with the Government will be through the Contracting Officer’s Representative (COR). The COR will perform all COR functions and perform quality assurance evaluations of the Contractor’s performance. The Contractor may be required as part of the performance of this effort to work with other Contractors working for the Government.

Such other Contractors shall not direct this Contractor in any manner. Also, this Contractor shall not direct the work of other Contractors in any manner.