DRAFT_PWS - Jira Enterprise.pdf

AUG 22

Performance Work Statement (Includes associated Performance Requirements Summary (PRS)

PERFORMANCE WORK STATEMENT (PWS)

DeCA Enterprise Atlassian Software and Professional Services

Part 1 General Information

1. General: This is a non-personal service(s) contract under which the personnel rendering the service(s) are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

1.1 Description of Services/Introduction: This is a non-personal service(s) contract to provide Atlassian software subscriptions and associated expert professional services for implementation, migration, and training.

1.2 Background: The Defense Commissary Agency (DeCA) is executing a strategic IT modernization effort to consolidate multiple business units onto a single, commercially supported enterprise platform for work management, service management, and project portfolio management. This action is necessary to replace aging legacy systems, eliminate data silos, and improve operational efficiency across the agency. This contract will serve as the single, enterprise-wide vehicle for procuring all Atlassian software licenses and the professional services required to onboard multiple DeCA organizations. While DeCA previously held a limited Atlassian contract for a single engineering unit (W58P05-25-P-0011, expiring 25 September 2026), this new contract will serve as the overarching enterprise-wide vehicle for procuring all Atlassian software licenses and professional services required to onboard the PMO, ARTS, and HR organizations.

1.3 Scope: The Contractor shall provide all personnel, software, materials, supervision, and other items necessary to perform the services as described in this PWS, except for those items specified in Part 3.

The scope of this contract is divided into two primary service categories:

1. Software Subscriptions: The procurement and annual renewal of all required Atlassian software licenses for the designated DeCA enterprise organizations: Advanced Retail Technology Suite (ARTS), Human Resources (HR), and the Program Management Office (PMO) (specifically encompassing the Program Management, IT Product Support, and Systems Test & Evaluation teams) for the life of the contract.

2. Professional Services: This category includes two distinct types of support:

• One-Time Implementation (Base Year): The contractor shall provide the initial, one-time implementation, data migration, and training services necessary to fully onboard the new user groups (PMO, ARTS, and HR).

• Ongoing Sustainment Support (All Years): The contractor shall provide an optional, flexible Level of Effort (LOE) for ongoing technical support. This support is available to all user groups for tasks that arise after their initial implementation is complete, such as minor enhancements, refresher training, or continued configuration assistance.

The Contractor shall perform all tasks to the standards and acceptable quality levels identified in this PWS.

1.4 Objectives: The primary objectives of this contract are to:

• Procure and maintain the required Atlassian software licenses (Jira Software, Confluence) for DeCA organizations.

• Successfully implement, configure, and onboard the PMO, ARTS, and HR teams onto the enterprise platform.

• Provide expert data migration support for all onboarding user groups.

• Deliver comprehensive, role-based user training to ensure successful adoption.

• Provide a flexible mechanism for ongoing technical support, minor enhancements, and refresher training for all user groups throughout the life of the contract.

1.5 General Information:

1.5.1 Quality Control Plan (QCP):

This acquisition is for commercial products and services and will be conducted in accordance with FAR Part 12. Therefore, as specified in FAR 12.208, the Government will rely on the contractor's existing quality assurance system. The contractor is responsible for delivering services that meet the performance standards defined in this PWS.

The Contractor shall provide a copy of their corporate Quality Control Plan (QCP) to the Contracting Officer’s Representative (COR) within ten (10) days after contract award {A001}.

This plan should describe the contractor’s internal processes for ensuring that all services and deliverables comply with the requirements of the contract.

1.5.1.1 RESERVED

1.5.1.2 RESERVED

1.5.2 Quality Assurance: The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the acceptable quality levels (performance thresholds).

1.5.3 Recognized Holidays: The following provides information on recognized holidays for the purpose of the PWS. If submittal of any documentation (e.g. deliverables, submittals, etc.)

deadlines fall on a holiday, the closest work day prior to the holiday will apply as the deadline for submittal.

1.5.3.1 U.S. Holidays: Work shall not be performed on U.S. federally recognized holidays occurring during the normal workweek unless otherwise directed by the Contracting Officer.

When a U.S. holiday occurs on a Saturday or a Sunday, the holiday is observed on the preceding Friday or following Monday, respectively.

New Year’s Day January 1st M. L. King Memorial Day 3rd Monday in Jan Presidents Day 3rd Monday in February Memorial Day last Monday in May Juneteenth June 19th Independence Day July 4th

Labor Day 1st Monday in September Columbus Day 2nd Monday in October Veteran’s Day November 11th Thanksgiving Day 4th Thursday in November Christmas Day December 25th

1.5.3.2 Host Nation Holidays: RESERVED

1.5.4 Operating Hours: The Government facility office hours, facility operating hours, and the Contractor support hour requirements often coincide, however, they may differ. Please refer to the following.

1.5.4.1 Government Facility Office Hours: The Government's core business hours for communication and collaboration are 0800 to 1700 Eastern Time, Monday through Friday, except U.S. Holidays identified in paragraph 1.5.3.1 or when Government personnel are unavailable due to administrative closings.

1.5.4.2 Government Facility Operating Hours: As this contract will be performed primarily at the contractor's facilities, Government facility operating hours are not applicable for the remote portion of the work. For any required on-site performance at Fort Lee, VA, access will be coordinated in advance with the COR and will generally occur during the Government's core business hours.

1.5.4.3 Contractor Support Hours: The Contractor shall have its key personnel available for communication and collaboration with Government personnel during the core business hours of 0800 to 1700 Eastern Time, Monday through Friday, excluding U.S. Holidays. The Contractor is responsible for managing its own work schedule to meet the performance requirements of this PWS. As this is a Firm Fixed Price contract, the Government will not be responsible for contractor downtime resulting from the unavailability of Government personnel or systems.

1.5.4.3.1 Program Management Plan (PMP): The Contractor shall prepare and maintain a comprehensive Project Management Plan (PMP) that details the approach, schedule, and resources to be used in the performance of this contract. This PMP shall serve as the authoritative document for managing the project schedule, deliverables, and communication.

The Contractor’s proposed PMP shall be submitted to the Contracting Officer via the COR for review and acceptance within ten (10) days after contract award {A002}. The Government will review and provide comments to the Contractor within ten (10) days of receipt. The Contractor shall then have five (5) days to incorporate comments and submit a final, baseline PMP.

The PMP shall be treated as a living document and updated as necessary throughout the period of performance. Significant changes to the schedule or approach must be submitted to the COR for review and acceptance prior to implementation. At a minimum, the PMP shall include:

• A detailed project schedule with major tasks, milestones, and dependencies for the Base Year implementation.

• A list of key personnel and their assigned roles and responsibilities.

• A Communication Plan outlining the frequency and format of meetings and reports.

• A Risk Management Plan identifying potential project risks and proposed mitigation strategies.

1.5.5 Training Holidays: RESERVED

1.5.6 Place of Performance: The work to be performed under this contract shall primarily be performed at the Contractor's own facilities.

On-site performance will be required at Fort Lee, Virginia, for specific tasks such as requirements workshops and user training, as coordinated in advance and approved by the

COR.

1.6 Security Requirements: The work performed under this contract is UNCLASSIFIED.

1.6.1 Security Program: RESERVED.

1.6.2 Personnel Security Clearance Requirements: RESERVED.

1.6.3 Installation Access: Access to U.S. installations, buildings, and controlled areas is limited to personnel who meet security criteria. For any required on-site work, the Contractor shall comply with all local installation access control requirements. The Contractor is responsible for returning any issued installation passes upon contract completion or when an employee no longer requires access.

1.6.3.1 Installation Pass Log: RESERVED.

1.6.3.2 Individual Termination or Expiration of Employment: The Contractor shall collect any installation access passes or Common Access Cards (CACs) from an employee on their last day of employment on this contract and shall return them to the issuing office within two

(2) business days.

1.6.3.3 Contract Termination or Cancellation: Upon termination or cancellation of this contract, the Contractor shall collect all outstanding installation access passes and CACs and return them to the issuing office within two (2) business days.

1.6.3.4 Common Access Cards (CAC) and CAC Log: The Government will sponsor contractor personnel for CACs as required for logical access to Government networks and physical access to facilities. The Contractor shall provide all necessary information (e.g., full name, date of birth) for its personnel to the COR within five (5) business days after contract award to initiate the CAC sponsorship process {A003}. The Contractor shall maintain a log of all CACs issued to its personnel under this contract and provide it to the COR upon request.

1.6.4 Background Checks: Contractor personnel performing work under this contract are designated as holding ADP-II / Moderate Risk Public Trust positions.

1.6.4.1 U.S. Citizen: All contractor personnel requiring access to Government IT systems must be U.S. Citizens. Contractor personnel must undergo and be favorably adjudicated for, at a minimum, a Tier 2 background investigation prior to being granted access to Government networks or being issued a CAC. The Government will sponsor contractor personnel for the required background investigations. The Contractor is responsible for ensuring their personnel complete all required paperwork in a timely manner. An employee may not begin work requiring network access until a favorable suitability determination has been made.

1.6.4.2 Local Nationals and Third Country Nationals: RESERVED.

1.6.5 Physical Security: The Contractor shall safeguard all Government equipment, information, and property provided for Contractor use.

1.6.6 Operations Security (OPSEC) Requirements: Contractor personnel shall adhere to all Government OPSEC policies. The Contractor shall brief all personnel on the iWATCH "See Something, Say Something" program. Government-issued access badges shall not be worn outside Government facilities where visible to the general public.

1.6.7 Cybersecurity Requirements:

• (a) CMMC Level 2: The work under this contract involves the handling of Controlled Unclassified Information (CUI). Therefore, the contractor must be certified at a minimum of Cybersecurity Maturity Model Certification (CMMC) Level 2 at the time of contract award and must maintain this certification for the life of the contract.

• (b) Training: All contractor personnel with access to Government IT systems must complete annual DoD Cyber Awareness training, as well as any other directed cybersecurity training. The Contractor shall provide certificates of completion to the COR upon request.

1.7 Key Control: RESERVED.

1.8 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Contracting Officer, COR, and other Government personnel, as appropriate, will meet periodically with the Contractor to review performance. At these meetings, the Government will apprise the Contractor of its view of the Contractor's performance, and the Contractor shall apprise the Government of any problems being experienced. These meetings shall be at no additional cost to the Government.

1.8.1 Project Status and Communication:

(a) Recurring Meetings: The Contractor shall lead and participate in recurring project status meetings with the COR and Government stakeholders.

• During the Base Year implementation phase, these meetings shall be held weekly to review progress against the project schedule, discuss risks, and resolve issues.

• During the Option Years, the frequency of these meetings may be reduced to bi-weekly or monthly, as determined by the COR.

(b) Issue and Risk Reporting: The Contractor shall immediately inform the COR of any problems, risks, or potential issues that may negatively impact contract performance, cost, or schedule. Verbal notification must be made within one (1) business day of identification. This verbal report shall be followed up with a detailed discussion and written summary during the next scheduled weekly project status meeting.

(c) Monthly Progress Report: The Contractor shall prepare and deliver a comprehensive Monthly Progress Report {A006}. This report shall be delivered by the 5th business day of each month. At a minimum, the report must include:

• A summary of all activities performed in the previous month.

• The current status of all project schedule milestones and deliverables.

• A detailed summary of any new or ongoing risks, issues, and proposed mitigation steps.

• A summary of funds expended.

The Contractor's Project Manager or their designated alternate shall attend all scheduled meetings. Meetings will be conducted virtually unless otherwise specified by the COR.

1.9 Contracting Officer’s Representative (COR): Refer to Part 2 of this PWS for the definition of a COR. As determined by the Contracting Officer, a COR will be appointed and identified by letter of designation, a copy of which will be provided to the Contractor by the Contracting Officer. The designation letter states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is not authorized to obligate the Government. If the work is not written in the contract, the COR is not authorized to request new work. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the Contractor concerning technical aspects of the contract, issue written interpretations of technical requirements, including Government drawings, designs, specifications, monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies, coordinate availability of Government property, and coordinate site entry of Contractor personnel.

1.10 Key Personnel: The following personnel are considered key personnel by the Government: Project Manager and Lead Technical Architect. The contractor is prohibited from removing or replacing key personnel without the prior written consent of the Contracting Officer.

The Contractor shall provide a Project Manager who shall be the primary point of contact and be responsible for the overall performance of the work. The names and Curricula Vitae (CVs) for the proposed Project Manager and the Lead Technical Architect shall be submitted with the contractor's proposal for evaluation.

The Project Manager or a designated alternate shall be available during the core Government business hours defined in paragraph 1.5.4.1. Qualifications for all key personnel are listed below:

a. Project Manager: The proposed Project Manager shall have, at a minimum:

• Five (5) years of experience managing the implementation of enterprise-level IT service management or project management platforms for U.S. Federal Government clients.

• A current Project Management Professional (PMP) certification or equivalent (e.g., Agile Certified Practitioner (ACP)).

• Demonstrated experience managing projects of similar size and complexity (i.e., multi-year, multi-million dollar IT implementations).

b. Lead Technical Architect: The proposed Lead Technical Architect shall have, at a minimum:

• Seven (7) years of hands-on experience designing, configuring, and deploying the

Atlassian suite (Jira Software and Confluence).

• Demonstrated experience performing complex data migrations into the Jira platform from legacy systems.

• A current Atlassian Certified Master or multiple Atlassian Certified Expert level certifications. This is a mandatory requirement.

1.11 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties must identify themselves, to include proper marking of signature blocks in correspondence, to avoid creating an impression in the minds of members of the public that they are Government officials. The Contractor shall ensure that all documents or reports, produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

1.12.1 RESERVED.

1.12.2 Contractor Identification Badges: When performing work on-site at a Government facility, Contractor personnel shall be clearly identifiable as contractors. Their Government-issued Common Access Card (CAC) shall serve as their primary identification. Additionally, the Contractor shall ensure all personnel display a company-provided identification badge clearly showing the employee’s name and company affiliation. All badges shall be worn visibly while on Government property. The Contractor shall ensure proper accountability for all company-provided badges.

1.13 Contractor Travel: The Contractor shall be required to travel to perform on-site requirements workshops and role-based user training. The primary anticipated travel location is Fort Lee, Virginia. It is estimated that two (2) separate one-week trips for up to two (2) contractor personnel will be required during the Base Year implementation phase.

All travel must be approved in writing by the COR at least ten (10) business days in advance of the planned travel date.

Travel will be established as a separate, cost-reimbursable, not-to-exceed (NTE) Contract Line Item Number (CLIN). The Contractor will be reimbursed for actual travel costs in accordance with the substantive provisions of the Federal Travel Regulation (FTR) and FAR 31.205-46.

The Government will not pay any profit or fee on travel costs.

1.14 Other Direct Costs (ODCs): RESERVED.

1.15 Data Rights: The Government shall have unlimited rights to all data, documentation, and materials first produced or delivered in the performance of this contract. This includes, but is not limited to, all system configuration documentation, training materials, reports, and migrated Government data.

For the Commercial-Off-the-Shelf (COTS) Atlassian software itself, the Government receives the customary license rights provided by the manufacturer under their standard commercial license agreement. The Government does not own the source code of the COTS software.

The Contractor shall not use, release, or disclose any Government data or deliverables created under this contract for any purpose outside of contract performance without the prior written permission of the Contracting Officer.

1.16 Non-Disclosure Requirements: Performance under this contract requires the Contractor to access Government Controlled Unclassified Information (CUI). The Contractor and all Contractor personnel shall not divulge, release, or disclose any data or information developed or obtained during the performance of this PWS, except to authorized Government personnel or upon the written approval of the Contracting Officer. The Contractor shall comply with all requirements for the safeguarding of CUI as specified in DFARS Clause 252.204-7012 and as required by their CMMC Level 2 certification. All documentation containing individual names or other Personally Identifiable Information (PII) shall be controlled and protected in accordance with the Privacy Act of 1974.

1.17 Protection of Government and Contract Information: The Contractor shall not use the DeCA name, logos, or any information obtained during the performance of this contract for any public-facing advertising, marketing, or promotional purposes, including on its company website or social media, without the prior written approval of the Contracting Officer.

1.18 Non-Disclosure Statements: All contractor personnel performing work under this contract shall sign a Non-Disclosure Agreement provided by the Government. The Contractor shall provide these signed NDAs to the COR no later than ten (10) business days after contract award, and prior to any individual being granted access to Government systems or data (A004).

1.19 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive or have access to proprietary or source-selection sensitive information. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI as defined in FAR Subpart 9.5. If an OCI is identified, the Contractor shall promptly submit a mitigation plan to the Contracting Officer for approval. The Government may affect other remedies as it deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.20 Phase Out Period: Phase Out Period: The Contractor shall support a phase-out period during the final sixty (60) days of the contract's period of performance. During this time, the Contractor shall provide all necessary support to ensure a smooth transition of all responsibilities, data, and system administrative knowledge to Government personnel or a follow-on contractor, as directed by the Contracting Officer. Specific transition activities will be defined in a Government-approved Phase-Out Transition Plan, to be delivered by the contractor no later than ninety (90) days prior to the end of the contract {A009}.

1.21 Safety: The Contractor shall perform all work in a safe manner and shall comply with all applicable federal, state, and local safety regulations. While on Government property, the Contractor shall adhere to all local installation safety and emergency procedures.

1.21.1 RESERVED.

1.21.1.1 RESERVED.

1.21.1.2 RESERVED.

1.21.1.3 RESERVED.

1.22 Environmental Compliance: RESERVED

1.22.1 Environmental Compliance Plan and Program: RESERVED

1.23 Required Training: The Contractor is responsible for ensuring all employees, including subcontractor employees, performing on this contract complete and maintain all mandatory Government-directed training. Verification of training completion for all required courses shall be provided to the COR upon request.

In the event contractor personnel are unable to access the online training portals due to technical issues, the Contractor shall immediately notify the COR. The COR will then coordinate with the appropriate Government office to provide an alternate means of completing the training requirement.

1.23.1 Anti-Terrorism (AT) Level I Training: All contractor personnel shall complete AT Level I training within thirty (30) days of contract start and annually thereafter. The training is available at https://jkodirect.jten.mil {A010}.

1.23.2 OPSEC Training: Operations Security (OPSEC) Training: All contractor personnel shall complete Level I OPSEC training within thirty (30) days of contract start and annually thereafter. The training is available at http://www.cdse.edu/catalog/elearning/GS130.html {A010}.

1.23.3 iWATCH Training: All contractor personnel shall be briefed on the iWATCH "See Something, Say Something" program. The briefing shall be completed within thirty (30) days of contract start. Training materials are available on Army OneSource {A011}.

1.23.4 Information Assurance (IA) Training: All contractor personnel requiring access to Government information systems shall complete the annual DoD Cyber Awareness Challenge training prior to being granted network access and annually thereafter. The training is available at https://public.cyber.mil/training/cyber-awareness-challenge/ {A010}.

1.23.4.1 RESERVED.

1.23.4.2 RESERVED.

1.23.4.3 RESERVED.

https://jkodirect.jten.mil/ http://www.cdse.edu/catalog/elearning/GS130.html https://public.cyber.mil/training/cyber-awareness-challenge/

1.23.5 Personally Identifiable Information (PII): All contractor personnel shall complete training on "Identifying and Safeguarding Personally Identifiable Information" within thirty (30) days of contract start and annually thereafter. The training is available at:

https://securitytraining.dcsa.mil/.

1.24 RESERVED.

1.24.1 RESERVED

1.24.2 RESERVED.

1.24.3 RESERVED.

1.25 Notice to Proceed: RESERVED.

1.26 Electromagnetic Compatibility Directive: RESERVED.

1.27 Government Property and Services: Refer to Part 3, Section 3.4 of this PWS for Government-Furnished Equipment (GFE) provided for this contract.

1.28 Conventional Forces Europe (CFE) Treaty Verification Inspection: RESERVED.

https://securitytraining.dcsa.mil/

PART 2

DEFINITIONS & ACRONYMS

2. Definitions and Acronyms

2.1 Definitions: Although not inclusive of every term used within this PWS, the following provides a list of definitions used throughout this PWS and commonly used in the acquisition field.

Commercial-Off-the-Shelf (COTS) – A product or service that is sold, leased, or licensed to the general public, offered by a vendor trying to profit from it.

Contracting Officer – means a person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

Contracting Officer's Representative (COR) – As defined in DFARS 202.101, means an individual designated and authorized in writing by the Contracting Officer to perform specific technical or administrative functions. DoD Instruction (DoDI) 5000.72, Part II Definitions states the following when defining a COR: “Defined in subpart 202.101 of Reference (f). Any individual delegated responsibilities pursuant to subpart 1.602-2 of Reference (e), regardless of local terminology, must be certified in accordance with this instruction. For example, local terminology can be COR, Contracting Officer’s technical representative, technical point of contact, technical representative, alternate COR, administrative COR, assistant COR, line item manager, task order manager, quality assurance personnel, quality assurance evaluator, or COR management.” In addition, Army Regulation 70-13, Chapter 2, paragraph 2-2g, states, in part, the following when providing other surveillance support personnel to assist the COR when needed, “…These other surveillance support personnel may serve as on-site representatives of the COR in performance of actual contract surveillance if they meet all COR requirements and have been appointed by the Contracting Officer as alternate CORs.”

Contractor – means a supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Day – means, unless otherwise specified, a calendar day.

Defective Service – means a service output that does not meet the standard of performance associated with the PWS.

Deliverable – means anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

Government-furnished Property – As reflected in FAR 52.245-1, Government-furnished Property “means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract

Initial Operational Capability (IOC) – The point at which a user group has its core workflows configured, critical data migrated, and users trained, allowing them to begin conducting their primary business functions on the platform.

Project Management Plan (PMP) – The formal, approved document used to guide both project execution and project control. It documents planning assumptions and decisions.

Government Property - means all property owned or leased by the Government.Government property includes both Government-furnishedand Contractor-acquired property. Government property includes material, equipment, special tooling, special test equipment, and real property. Government property does not include intellectual property and software.

Property Administrator - means an authorized representative of the Contracting Officer appointed in accordance with agency procedures, responsible for administering the contract requirements and obligations relating to Government property in the possession of a Contractor.

Physical Security – means that part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard against espionage, sabotage, damage, and theft.

Quality Assurance – (or Government contract quality assurance) means the various functions, including, inspection, performed by the Government to determine whether a Contractor has fulfilled the contract obligations pertaining to quality and quantity.

Quality Assurance Surveillance Plan (QASP) – means the key Government-developed surveillance process document, and is applied to Performance-Based Service Contracting (PBSC). The QASP is used for managing Contractor performance assessment by ensuring that systematic quality assurance methods validate that Contractor quality control efforts are timely, effective, and are delivering the results specified in the contract or task order. The QASP directly corresponds to the performance objectives and standards (i.e., quality, quantity, timeliness) specified in the PWS. It provides specific details on how the Government will survey, observe, test, sample, evaluate, and document Contractor performance results to determine if the Contractor has met the required standards for each objective in the PWS. The QASP, with very few if any exceptions, is an internal to Government document.

Quality Control – means all necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

Statement – means the specific results-based activities required to satisfy HLOs. A statement contains a result, the context of the statement, and the required action(s). Statements focus on

“what” is to be accomplished; however they are not prescriptive in describing “how” the outcome is to be achieved. Each HLO may have several statements to flesh out the areas necessary to meet the objective. Statements are similar to Level 3 in a Work Breakdown Structure.

Subcontractor – means one that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

Work Day - The number of hours per day the Contractor provides services in accordance with the contract.

Work Week - Monday through Friday, unless otherwise specified.

2.2 Acronyms: Although not inclusive of every term used within this PWS, or that may be included in an acquisition, the following provides a list of acronyms commonly used in the acquisition field.

AQL Acceptable Quality Level ARTS Advanced Retail Technology Suite CAC Common Access Card CMMC Cybersecurity Maturity Model Certification CONUS Continental United States COR Contracting Officer’s Representative COTS Commercial-Off-the-Shelf CUI Controlled Unclassified Information CV Curriculum Vitae DeCA Defense Commissary Agency DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense FAR Federal Acquisition Regulation FFP Firm Fixed Price FTR Federal Travel Regulation GFP Government-Furnished Property IA Information Assurance IGE Independent Government Estimate IOC Initial Operational Capability IT Information Technology ITSM IT Service Management J&A Justification and Approval JSM Jira Service Management LOE Level of Effort MICS Management Information Control Systems MRR Market Research Report NDA Non-Disclosure Agreement OCI Organizational Conflict of Interest OKR Objectives and Key Results

OPM Office of Personnel Management PII Personally Identifiable Information PM Program/Project Manager PMP Project Management Plan PMO Program Management Office PoP Period of Performance PWS Performance Work Statement QASP Quality Assurance Surveillance Plan QCP Quality Control Plan RFQ Request for Quote SaaS Software-as-a-Service SMS Sustainment Management System SSO Single Sign-On STD Standard UAT User Acceptance Testing

PART 3

GOVERNMENT PROPERTY (GP) AND SERVICES

3. Government Property and Services

3.1 Services: The Government will provide timely access to DeCA Subject Matter Experts (SMEs) from all participating organizations for interviews, workshops, and requirements validation sessions as required for the contractor to perform their duties.

3.2 Facilities: For any required on-site performance, the Government will provide adequate workspace, such as a conference room, for the contractor personnel.

3.3 Utilities: For any required on-site performance, the Government will provide access to all necessary utilities in the provided workspace, including electricity and internet connectivity.

3.4 Equipment: For contractor personnel requiring logical network access or performing on-site work, the Government will provide Government-Furnished Equipment (GFE) in the form of laptops configured for the DeCA network.

3.5 RESERVED.

3.6 Materials: The Government will provide the contractor with access to all available Government-Furnished Information (GFI) necessary to perform the contract, including existing documentation on legacy systems, operational workflows, data schemas, and points of contact for relevant programs.

3.7 Training: The Government will provide access to all mandatory Government training as specified in paragraph 1.23.

3.8 Common Access Cards (CAC): The Government will sponsor and provide Common Access Cards (CAC) for all contractor personnel requiring logical or physical access to Government resources.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. Contractor Furnished Property and Services

4.1 General: The Contractor shall furnish all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to perform services as described in this PWS, except for those items specified as Government furnished in Part 3.

4.2 RESERVED.

4.3 Materials: The Contractor shall provide all necessary office supplies, materials, and automated data processing equipment (ADPE) required to perform the services outlined in this PWS from their own facilities.

4.4 RESERVED.

4.5 Background Checks: The Contractor is responsible for ensuring its proposed personnel meet the background check and suitability requirements specified in paragraph 1.6.4. The Contractor shall cooperate fully and ensure their personnel complete all necessary paperwork in a timely manner to facilitate the Government-sponsored investigation process.

PART 5

SPECIFIC TASKS

5.1 Basic Services: The Contractor shall provide all necessary software, professional services, and project management required to procure, implement, and sustain the enterprise Atlassian platform for designated DeCA organizations. The Contractor shall perform all tasks to the standards defined herein.

5.2 Tasks:

5.2.1 High Level Objective 1: Software Provisioning and Management

5.2.1.1 Task: The Contractor shall procure, provision, and manage the specific types and quantities of Atlassian Premium software subscriptions for the designated DeCA organizations as detailed in the table below. All licenses shall be provisioned in the Atlassian Government Cloud (FedRAMP Moderate) environment.

DeCA Organization

Jira Software (Premium)

Confluence (Premium)

Program Management Office (PMO)* 140 140 Advanced Retail Technology Suite (ARTS) 300 300 Human Resources 60 60 Total 500 500

*Note The PMO license allocation of 140 users is shared across three distinct operational teams: Program Management, IT Product Support, and Systems Test & Evaluation.

(a) STD: All required licenses, as specified in the table above, shall be provisioned and made accessible to authorized DeCA administrative personnel no later than the contract start date of September 26, 2026.

AQL: 100% Compliant. No deviation permitted.

5.2.1.2 Task: The Contractor shall successfully renew all software subscriptions for each subsequent option year with no lapse in service.

(a) STD: All required licenses, as specified in the table above, shall be provisioned and made accessible to authorized DeCA administrative personnel no later than the day after the end of the prior option year.

AQL: 100% Compliant. No lapse in service permitted.

5.2.2 High Level Objective 2: Project Management

5.2.2.1 Task: The Contractor shall manage the performance of this contract in accordance with the Government-approved Project Management Plan (PMP).

(a) STD: The Contractor shall lead weekly project status meetings during the Base Year implementation phase.

AQL: No more than one unexcused missed meeting per quarter.

5.2.3 High Level Objective 3: Base Year Implementation and Onboarding

5.2.3.1 Task: The Contractor shall perform the one-time implementation, configuration, and data migration services necessary to achieve Initial Operational Capability (IOC) for the new user groups (PMO, HR, and ARTS).

(a) STD: The Contractor shall achieve IOC for the PMO & ARTS Teams within 60 days after contract award.

AQL: 100% Compliant.

(b) STD: The Contractor shall achieve IOC for the Human Resources (HR) Team within 90 days after contract award.

AQL: 100% Compliant.

5.2.3.2 Task: The Contractor shall deliver comprehensive, role-based user training for all onboarding user groups {A007}.

(a) STD: All training materials shall be delivered for Government review at least 15 days prior to the first scheduled training session.

AQL: No more than one late delivery.

(b) STD: All initial user training sessions shall be completed within the first 120 days of the contract.

AQL: 100% Compliant.

5.2.4 High Level Objective 4: Optional Sustainment Support (This task shall only be performed when the Government exercises the optional CLIN for a block of support hours.)

5.2.4.1 Task: The Contractor shall provide a flexible Level of Effort (LOE) for ongoing technical support, available as a separately priced, optional CLIN in the Base Year and all Option Years.

This support is available for use by any of the DeCA teams for tasks that fall outside the scope of the initial implementation, such as:

• Minor configuration enhancements and workflow adjustments for any team.

• Refresher training for new or existing users.

(a) STD: When an optional task is assigned by the COR, the Contractor shall provide an initial response acknowledging the request and assigning a technical expert.

AQL: Initial response shall be provided within two (2) business days, 95% of the time.

5.2.5 High Level Objective 5: Data Management and Portability

5.2.5.1 Task: The Contractor shall ensure that all Government data hosted within the Atlassian platform remains the property of the Government. The platform must provide a capability for authorized Government administrators to export all Government data at any time.

• (a) STD: This export capability must allow for all user-generated content (e.g., issue descriptions, comments, attachments) and system configuration data to be exported in a standard, non-proprietary format (e.g., CSV, JSON, XML).

• AQL: This capability shall be available and functional throughout the entire period of performance. The contractor must demonstrate this capability to the COR within 90 days of contract award and annually thereafter, or upon Government request. No more than one failed demonstration per year is acceptable. {A008}

5.3 Service Contract Reporting

5.3.1 System for Award Management (SAM) Service Contract Report (SCR): In accordance with FAR Subpart 4.17, the Contractor shall be required to report all contractor labor hours required for the performance of services provided under this contract. The Contractor shall complete all required reporting via the System for Award Management (SAM) at www.sam.gov by the required deadline of October 31st for the preceding Government Fiscal Year and provide confirmation of SCR submission to the COR {A005}.

STD: All information provided by the Contractor shall be accurate, complete, and not exceed suspense dates noted in corresponding paragraph above.

AQL: 100% Compliant http://www.sam.gov/

PART 6

APPLICABLE PUBLICATIONS

6. Applicable Publications (Current Editions): The following publications, manuals, regulations, etc. are mentioned in this PWS and are listed below.

6.1 Federal Acquisition Regulation (FAR) References:

FAR 31.205-46 - Travel Costs FAR Part 42.5 - Postaward Conferences

6.2 Defense Federal Acquisition Regulation Supplement (DFARS) References:

DFARS 252.204-7012 - Safeguarding Covered Defense Information and Cyber Incident Reporting DFARS 252.204-7021 - Cybersecurity Maturity Model Certification (CMMC) Requirements

6.3 Other Government Regulations and Directives:

36 CFR Part 1194 - Section 508 of the Rehabilitation Act Federal Travel Regulation (FTR) Privacy Act of 1974, Public Law 93-579 DoD Instruction 8500.01 - Cybersecurity (or current equivalent) NIST Special Publication 800-171 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

6.4 Training Links:

DoD Cyber Awareness Challenge: https://public.cyber.mil/training/cyber-awareness-challenge/ AT Level I Training: https://jkodirect.jten.mil OPSEC Level I Training: http://www.cdse.edu/catalog/elearning/GS130.html https://public.cyber.mil/training/cyber-awareness-https://public.cyber.mil/training/cyber-awareness-https://jkodirect.jten.mil/ http://www.cdse.edu/catalog/elearning/GS130.html

PART 7

ATTACHMENT AND TECHNICAL EXHIBIT LISTING

7. Attachment and Technical Exhibit List

7.1 Technical Exhibit A – Performance Requirements Summary:

7.2 Technical Exhibit B – Deliverables Schedule

TECHNICAL EXHIBIT A

Performance Requirements Summary (PRS)

PERFORMANCE

OBJECTIVE

STANDARD

PERFORMANCE

THRESHOLD

ACCEPTABLE

QUALITY LEVELS

(AQLs)

METHOD OF

SURVEILLANCE

PRS#1 - Initial Software Provisioning (PWS para 5.2.1.1) - The Contractor shall procure and provision all required software licenses.

All required licenses, as specified in the PWS table, shall be provisioned and made accessible to authorized DeCA personnel no later than the contract start date of September 26, 2026.

100% Compliant. No deviation permitted.

100% Inspection

PRS#2 - Annual License Renewal (PWS para 5.2.1.2) - The Contractor shall renew all software subscriptions in the option years.

All required licenses shall be successfully renewed with no lapse in service.

Renewals must be complete no later than the day after the end of the prior option year.

100% Compliant. No lapse in service permitted.

100% Inspection

PRS#3 -

Implementation Milestones (PWS para 5.2.3.1) - The Contractor shall achieve Initial Operational Capability (IOC) for the new user groups.

The Contractor shall achieve IOC for the PMO & ARTS Teams within 60 days after contract award, and IOC for the HR Team within 90 days after contract award.

Milestones must be met on the specified date. A deviation of more than 5 business days requires a formal corrective action plan.

Periodic Inspection;

Review of Contractor Reports

PRS#4 - Optional Sustainment Support (PWS para 5.2.4.1) - When an optional LOE task is assigned, the Contractor shall provide a timely initial response.

When an optional task is assigned by the COR, the Contractor shall provide an initial response acknowledging the request and assigning a qualified technical expert.

Initial response shall be provided within two (2) business days, 95% of the time.

Random Sampling;

Validated Customer Complaint

PRS #5 - Data Portability (PWS para 5.2.5.1) - The Contractor shall ensure the Government can export its data in a standard format.

The Contractor must demonstrate the capability to export all user-generated content and system configuration data in a standard, non-proprietary format (e.g., CSV, JSON, XML).

This capability shall be successfully demonstrated within 90 days of award and annually thereafter. No more than one failed demonstration per year.

Periodic Inspection;

Direct Observation

PRS #6 - Service Contract Reporting (SCR) (PWS para 5.3) - The Contractor shall report all required labor hours in the System for Award Management

(SAM).

The Contractor shall complete all required information accurately and submit the report no later than October 31st of each calendar year.

100% Compliant.

Zero Deviation from Standard.

100% Inspection

PRS #7 – Mandatory Training (PWS para 1.23)

Contractor personnel shall complete AT Level I, OPSEC, iWATCH, and Cyber Awareness training within 30 days.

100% Compliant. 100% Inspection of Certificates.

TECHNICAL EXHIBIT B

DELIVERABLES SCHEDULE

Deliverable

Deliverable Title (PWS Paragraph) Frequency # of

Copies Medium/Format Submit To

A001

Quality Control Plan (QCP) (para 1.5.1)

Once, within 10 days after contract award.

Electronic (MS Word or PDF) / Contractor Format

COR

A002

Project Management Plan (PMP) (para 1.5.4.3.1)

Once, within 10 days after contract award.

Updated as required.

Word or PDF) /

A003

Information for CAC Sponsorship (para 1.6.3.4)

Once, within 5 business days after contract award.

Electronic (Email) /

A004

Signed Non- Disclosure Agreements (NDAs) (para 1.18)

Once, within 10 business days after contract award.

Electronic (PDF)

A005

Confirmation of SCR Submission (para 5.3)

Annually, by October 31st.

Electronic (Screenshot or Email)

A006

Monthly Progress Report (Implicit in 1.8.1)

Monthly, by the 5th business day.

Word or PDF) /

A007 Training Materials (para 5.2.3.2)

Once, 15 days prior to the first 1

Electronic (508 Compliant MS Office/PDF) / scheduled training session.

A008

Data Portability Demonstration(par a 5.2.5.1)

Once, within 90 days of award, and annually thereafter.

N/A

Live Demonstration (Virtual)

A009

Phase-Out Transition Plan (para 1.20)

Once, 90 days prior to the end of the final contract period.

Word or PDF) /

A010

Mandatory Training Certificates (1.23.1, 1.23.2, 1.23.4)

Once, within 30 days of contract start/hire.

Electronic (PDF)

A011 iWATCH Training Confirmation (1.23.3)

Once, within 30 days of contract start/hire.

1 Electronic (Email or Memo) COR

ATTACHMENT 1

ESTIMATED WORKLOAD DATA

RESERVED

ATTACHMENT 2

HISTORICAL WORKLOAD DATA

ATTACHMENT 3

GOVERNMENT FURNISHED PROPERTY (GFP)