Attachment A – Operations Engineering and Security Services (OESS)

HHS Office of the Chief Information Officer (OCIO) Office of Operations (OPS) Engineering and Security Services (OESS)

Statement of Objectives (SOO) / Hybrid Performance Work Statement

Document Intent Defines the outcomes, required capabilities, and selected task-level performance requirements for the OESS task order.

Approach Hybrid SOO/PWS framing. Objectives are outcome-based, but where precision improves performance administration, task-level requirements and service levels are stated explicitly.

1. Background The Department of Health and Human Services (HHS) protects the health and well-being of all Americans through a diverse portfolio of programs and services. The Office of the Chief Information Officer (OCIO) Office of Operations (OPS) provides the technological foundation that enables these programs to operate effectively and securely. HHS OCIO OPS maintains an enterprise infrastructure that spans data centers, cloud environments, collaboration tools, cybersecurity platforms, and supporting operational systems serving tens of thousands of users.

Over time, operations and engineering services have been performed under multiple discrete efforts.

That fragmentation has contributed to duplicative practices, uneven modernization, and inconsistent service levels. This task order consolidates OPS Engineering and Security Services (OESS) into a unified enterprise support construct intended to improve governance, standardize engineering and operations processes, strengthen cybersecurity and Zero Trust implementation, and accelerate migration from legacy environments to secure modern services.

This Attachment A establishes the objectives, required capabilities, and measurable performance requirements for the OESS task order. The Contractor shall provide the personnel, processes, and technical services necessary to engineer, operate, secure, and continuously improve endpoint, infrastructure, network, collaboration, and related enterprise services in support of HHS OCIO Operations.

The intended outcome of this task order is robust, flexible, efficient, and secure information technology that enables the HHS enterprise and its mission partners to meet operational requirements with high availability, strong cybersecurity, disciplined governance, and timely service delivery.

In performing this task order, the Contractor shall support the HHS goals and CIO priorities for OneHHS by helping the Government operate HHS as a single, strategic, shared enterprise. The Contractor shall support measurable policy implementation, healthy operational patterns, sustainable government value, enterprise visibility, security, interoperability, portability, and reuse across the full lifecycle of IT investments and operations. All work performed under this task order shall reinforce enterprise-aligned behaviors, measurable outcomes, and government control where feasible over accounts and tenancy, identity and access, logging and auditability, data portability, and transition and exit rights.

• Establish and manage endpoint and infrastructure engineering processes that improve end-to-end integration and service delivery.

• Perform endpoint and infrastructure engineering across requirements definition, design, development, integration, testing, implementation, and sustainment support.

• Perform design analysis, requirements analysis, alternatives analysis, capacity analysis, concept-of-operations development, and related technical documentation.

• Manage engineering and integration projects for current and future HHS OCIO-managed hardware and software.

• Develop engineering planning documentation and maintain an Engineering Test Lab, including government-approved procurement support as needed.

• Evaluate, test, and document COTS and GOTS software and hardware solutions, including engineering and development toolsets.

• Coordinate activities across system interface boundaries with other contractors, service providers, and government organizations.

• Integrate service delivery processes with government processes to provide seamless user experience.

• Provide Tier 3 support through government-furnished service management workflows and approved escalation procedures.

• Promote IT innovation through research, assessments, and studies of evolving technologies and industry best practices.

• Adhere to incident, problem, change, release, and configuration management requirements and all applicable federal and HHS security, privacy, and accessibility mandates.

2. Scope and Scale of OESS The scope includes support necessary to advance enterprise requirements that improve the HHS as OneHHS. Accordingly, the Contractor shall perform this task order in a manner that maximizes shared services, enterprise visibility, control, usability, purpose alignment, security, cost efficiency, governance streamlining, architecture reuse, portability, interoperability, measurable value, and sustainable government rights across supported platforms, environments, tools, identities, and data flows.

The Contractor shall provide engineering, operational, cybersecurity, and management support necessary to administer, manage, and perform the duties and responsibilities described in this order.

The Government will maintain the authoritative listing of supported sites, systems, hardware, software, and other in-scope assets in the applicable Section J attachments and appendices. The Contractor shall maintain the currency of those inventories and supporting appendices as directed by the Government.

• Task 1 - Management

• Task 2 - Infrastructure Engineering

• Task 3 - Infrastructure Operations*

• Task 4 - Information Assurance*

• Task 5 - Cloud-Based Infrastructure/Identity Management Services

3. Period and Place of Performance The place of performance includes Government facilities, supported HHS sites, and approved hybrid or remote work locations as authorized by the Contracting Officer’s Representative (COR). VTC and Network Operations personnel shall be local to support onsite deployments and response activities in the Washington, DC and Maryland metropolitan areas. Other teams may support the task order through a hybrid or remote staffing model when approved by the Government and when performance requirements continue to be met.

The Government will identify supported sites in the applicable Section J documentation. The Contractor shall support those sites and any approved additions, deletions, or changes directed under the task order.

The Government anticipates a period of performance for a twelve (12) month base period and potential for four (4) twelve-month option periods.

4. Operating Hours Unless otherwise directed, the Contractor shall provide support between 8:00 a.m. and 5:00 p.m.

Eastern Time, Monday through Friday, excluding Federal holidays. The actual daily start and stop times shall be coordinated with and approved by the COR. All teams shall maintain an on-call roster to support after-hours escalation and mission needs. The Network Operations Center (NOC) and Security Operations Center (SOC) functions shall be operated on a continuous 24x7x365 basis.

Work outside standard hours may be required for emergency response, maintenance, deployments, cutovers, testing, or other mission needs. Exceptions to the standard operating hours shall be approved by the Government on a case-by-case basis.

Federal holiday Observed date

New Year's Day January 1

Martin Luther King Jr. Day Third Monday in January

Presidents Day Third Monday in February

Juneteenth National Independence Day June 19

Independence Day July 4

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans Day November 11

Thanksgiving Day Fourth Thursday in November

Christmas Day December 25

5. Contract Type The Government anticipates a hybrid contract type, firm fixed price (FFP) for baseline effort and time-and-materials (T&M) for surge and variable effort, task order to be best suited to fulfill these requirements most efficiently. The pricing model and associated cost structure are addressed in the Government pricing instructions and workbook.

6. Task Objectives and Required Capabilities This section is structured primarily as a Statement of Objectives. Where the Government requires greater specificity to manage performance, the objective includes required task-level capabilities and work products. The Contractor may propose efficient methods of performance but shall achieve the stated outcomes and comply with the performance requirements in Section 10.

6.1 Requirements for Enterprise Outcomes Supporting OneHHS Goals and CIO Priorities

• Promote enterprise-aligned behavior, measurable outcomes, and healthy operational patterns that improve security, mission delivery, and long-term government value across

HHS.

• Increase enterprise visibility by maintaining inventory, registry linkage, logging, traceability, and authoritative reporting for assets, identities, environments, tools, and data flows within the task order scope.

• Leverage and expand shared services and common operating models where practical so that solutions are reusable, measurable, portable, and positioned for enterprise-wide adoption.

• Support a unified identity, connectivity, and security posture across HHS by aligning engineering and operations activities to common standards, shared platforms, and interoperable services.

• Design and operate architecture, tools, and processes to preserve government control where feasible over tenancy, access, logs, data governance, portability, and transition or exit capability.

• Use modular planning, phased delivery, and evidence-based performance management so the Government can verify outcomes, scale successful approaches, and reduce lock-in, duplication, and waste.

Objective 1 - Management

Program Management

• Provide unified direction, planning, oversight, and delivery governance for all work under the task order, including cost, schedule, technical performance, quality, staffing continuity, and timely completion of contractual deliverables.

• Establish and maintain the management structure, processes, and reporting mechanisms necessary to direct the full body of OESS work in coordination with HHS OCIO leadership, mission objectives, and OneHHS enterprise priorities.

• Provide strategic direction through the Program Manager and maintain continuity of operations through a designated Deputy Program Manager who coordinates day-to-day integration among capability leads and supports continuity in the Program Manager's absence.

• Maintain the Integrated Master Schedule, risk and issue logs, action tracker, staffing and succession data, and performance dashboards that give the Government current visibility into status, dependencies, resourcing, and emerging concerns.

• Monitor milestones, verify deliverable quality, evaluate issues affecting cost, schedule, or technical results, and develop recommendations and corrective actions for Government decision-making.

• Support audits, reviews, data calls, invoice coordination, and performance reporting, and ensure all contractual deliverables are complete, accurate, traceable, and submitted on time.

• Promote collaboration among all work areas, maintain consistent documentation standards, apply lessons learned, and keep every workstream aligned to OCIO strategic direction and mission needs.

Change Management

• Facilitate the Engineering Review Board, System Change Notification processes, and related governance for all OCIO-supported systems and environments within scope.

• Manage the full lifecycle of standard, normal, and emergency changes using risk-based procedures that preserve configuration control and compliance with federal and HHS policy.

• Coordinate change approvals; maintain change records, logs, and supporting documentation; and ensure each change is reviewed, tested, approved, implemented, and communicated to affected stakeholders.

• Integrate change management with incident, release, configuration, maintenance, and security processes so the Government retains visibility into impacts, dependencies, and enterprise consequences across supported systems.

Project Management

• Plan, baseline, execute, and monitor all approved technical initiatives using project management processes and EPLC-aligned artifacts where required.

• Define scope, allocate resources, manage dependencies, maintain milestones and risk plans, and track progress against approved performance baselines and Government direction.

• Translate OCIO operational priorities into executable projects and verify performance and cost against approved plans, schedules, and measurable outcomes.

• Provide accurate status reporting through established review cycles and coordinate across engineering, operations, cybersecurity, and support functions so deliverables remain aligned to task order objectives and OCIO priorities.

Communications Management

• Establish consistent methods for sharing information across the contract and among stakeholders, including reporting structures, meeting cadence, escalation procedures, communications protocols, and cross-provider coordination routines.

• Prepare and distribute briefings, dashboards, meeting materials, operational documentation, and other communications products that sustain situational awareness for OCIO leadership and task order participants.

• Document cross-boundary coordination mechanisms, standing forums, and notification pathways needed to address changes, outages, incidents, project decisions, and customer-facing communications.

Quality Assurance

• Maintain standards of accuracy, completeness, technical sufficiency, testing adequacy, accessibility, and compliance for all work products and operational activities under the task order.

• Review deliverables, validate documentation against HHS and federal requirements, verify testing outcomes, and track deficiencies and corrective actions to closure.

• Measure and report service level attainment, identify recurring defects or process failures, implement performance improvement actions, and ensure all work meets required quality standards for OCIO-supported systems and infrastructure.

Objective 2 - Infrastructure Engineering

Server Engineering

• Engineer improvements to on-premises Active Directory and related identity-supporting server services; test patching and security updates for data center and Azure-hosted servers; and sustain engineered improvements to core server platforms.

• Maintain and modernize the virtualization stack operating on Hyperconverged Infrastructure with VMware and plan and execute migration of virtualization capabilities from data center environments to Microsoft Azure when approved.

• Develop and maintain hardened server images using applicable DISA STIG and other required security baselines for Windows Server, Linux/Unix, and VMware ESX platforms.

• Evaluate, implement, and test improvements to core infrastructure services including DNS, DHCP, certificate services, printer management, network shares, and related supporting services.

• Manage and support the Engineering Test Lab across on-premises HCI and Azure platforms and engineer and test enhancements to backup and recovery solutions for OCIO-supported systems.

Network Engineering

• Design, maintain, and optimize secure network infrastructure supporting HHS enterprise connectivity, including routing, switching, SD-WAN, site additions and deletions, and future-state architecture development.

• Provide Tier 3 engineering support for complex Layer 2 and Layer 3 issues affecting critical operations and collaborate with divisions and service providers to resolve interoperability and routing issues across government networks.

• Lead annual upgrade and refresh cycles for Cisco routers and switches, replace end-of-life devices, maintain Cisco IOS on production devices, and use capacity, impact, and alternatives analysis to inform future upgrades and network change decisions.

Security Engineering

• Enhance and maintain cybersecurity engineering capabilities including Palo Alto firewalls, CrowdStrike or equivalent endpoint protection, VPN, access controls, and other enterprise security technologies supporting OCIO-managed infrastructure.

• Provide higher-tier technical support for outages and critical issues related to firewall, VPN, access, and security platform performance and collaborate with divisions to design tailored security solutions where specialized engineering is required.

• Lead proof-of-concept activities, technology evaluations, and engineered improvements that strengthen defensive posture and implement and maintain controls that support the DHS CISA Continuous Diagnostics and Mitigation program and related HHS cybersecurity objectives.

Platform Engineering

• Manage endpoint design and lifecycle engineering for Windows, macOS, and iOS devices across HHS, including standard image development, security baseline application through Intune and JAMF, software compatibility validation, and configuration management documentation.

• Produce and maintain platform engineering technical plans, image build procedures, technical specifications, test artifacts, and acceptance-ready image builds consistent with HHS security, accessibility, licensing, and operational requirements.

• Support evaluation and provisioning of non-standard software and government-owned devices, maintain open and reusable design approaches, and document configurations and export pathways so platform solutions can be transitioned, expanded, or reused across

HHS.

Microsoft 365 (M365) Engineering

• Design, configure, and integrate Microsoft 365 services across Exchange Online, SharePoint, OneDrive, Teams, Entra ID, and related mobility and compliance capabilities.

• Maintain engineering support for hybrid operations spanning on-premises and cloud environments and apply security, retention, records, compliance, and policy controls consistent with HHS standards.

• Coordinate with Platform Engineering, UCC Engineering, and identity-related functions to align collaboration, endpoint, access, and mobile capabilities, including derived credentials, device enrollment, security configuration, compliance, and application deployment for government-furnished iOS devices.

• Validate new features and releases before production implementation and design solutions that preserve enterprise interoperability, portability, auditability, and Government control to the maximum extent feasible.

Unified Communications and Collaboration Engineering

• Design and modernize voice, messaging, Slack, video teleconferencing, and related collaboration capabilities across cloud and on-premises environments.

• Manage lifecycle planning, architecture updates, risk and change integration, technology refresh, interoperability improvements, and security controls needed to sustain secure and resilient communications services.

• Maintain encryption and multifactor authentication controls where applicable and engineer new VTC solutions and related implementation packages for Government-approved deployments.

VDS Engineering

• Design, build, and improve virtual desktop services that enable secure remote and hybrid work and deliver performance and security outcomes comparable to physical government-furnished equipment where required.

• Manage virtual machine templates, patch cycles, testing, and configuration validation before release and align virtual desktop standards with physical endpoint standards and HHS security requirements.

• Develop cost-competitive virtual desktop approaches that support portability, consistent management, and scalable user support across HHS.

Objective 3 - Infrastructure Operations Operate and support Microsoft 365, messaging, server, network, security, collaboration, VDS, onsite, NOC, and SOC services required to sustain secure and reliable day-to-day operations across the HHS enterprise in a manner that strengthens shared services, interoperability, auditability, and enterprise-wide service health.

Email and M365 Operations

• Administer and support Microsoft 365 services including Teams, Exchange, account provisioning, shared mailbox governance, license management, email relay, DKIM signing, Entra ID support, and continuity of hybrid email operations.

• Provide subject matter expertise to lower-tier support teams for M365 applications and mobile device operations and manage updates, application deployment, operating system updates, and derived credential capabilities for HHS mobile devices.

Server Operations

• Operate and maintain Windows and Linux servers supporting OCIO infrastructure and applications, including HCI environments, SCCM-related capabilities, DNS administration, Active Directory audits, certificate lifecycle management, and monitoring services.

• Execute operational patch management, compliance remediation, backup operations, restore readiness, and routine support for OCIO-supported systems so mission services remain available, secure, and supportable.

• Maintain and operate CDM-related operational capabilities and HHS PKI services, including HSM and OCSP components, as part of day-to-day infrastructure sustainment.

Network and Data Center Onsite Operations

• Manage the physical and logical infrastructure supporting connectivity and computing across supported HHS sites, including data center facilities, regional locations, and approved site additions or modifications.

• Install, configure, remove, and document network hardware and cabling; conduct audits and preventive maintenance; monitor network performance; and resolve connectivity, wireless, and related infrastructure issues across OCIO-supported locations.

• Administer and maintain SD-WAN connectivity and support data center environmental monitoring and management, including power, UPS, HVAC, cable plant, fire detection and suppression, temperature and humidity controls, generator-related support coordination, water detection, secondary power, and controlled physical access support arrangements.

Network Operations Center

• Provide continuous 24x7x365 monitoring and operational support for network infrastructure to sustain optimal performance and availability across production environments.

• Deliver operational support for incidents involving routers, firewalls, LAN/WAN connectivity, and related network services; coordinate escalations and service restoration with higher-tier teams and service providers; and document and communicate outage status and response actions in real time.

Security Operations

• Manage and maintain firewalls, vulnerability scanners, VPN-related security capabilities, and other security platforms protecting OCIO-managed infrastructure and services.

• Triage alerts, investigate incidents, execute containment and recovery actions, administer vulnerability management activities, verify remediation of identified weaknesses within required timeframes, and fulfill data and report requests from security tools.

• Perform recurring security scans, support firewall rules and VPN troubleshooting, maintain centralized visibility and audit trails, and coordinate with the SOC to refine defensive configurations and threat intelligence application.

Security Operations Center

• Provide continuous 24x7x365 monitoring, correlation, analysis, and triage of security events across endpoint, network, server, cloud, and collaboration environments supporting OCIO operations.

• Perform Tier I and Tier II cybersecurity monitoring, compliance scanning, threat analysis, and incident triage; escalate critical events to higher-tier security teams and OCIO leadership; and coordinate response with the Office of the Secretary Incident Response Team, HHS CSIRC, and other incident response partners.

• Communicate security alerts, emerging threats, and status information to Government stakeholders and the OCIO operations community as directed.

Unified Communications and Collaboration Operations

• Sustain daily performance of voice, messaging, Slack, VTC, and related collaboration services used by HHS and maintain defined service levels for availability, reliability, and quality.

• Monitor services, apply updates, resolve incidents, enforce applicable security controls, coordinate maintenance with network operations and change management, and provide onsite support for new VTC installations and higher-tier escalation support for existing deployments.

VDS Operations

• Operate the production virtual desktop environment to maintain secure access, system stability, and acceptable end-user performance.

• Monitor performance, apply patches, resolve connectivity and access issues, and coordinate with VDS Engineering to release validated configurations into production in accordance with endpoint standards and HHS security requirements.

Objective 4 - Information Assurance

Information Assurance

• Perform vulnerability and patch monitoring and reporting for all OCIO-supported infrastructure and endpoints and analyze vulnerability and compliance scan data to identify required remediation actions.

• Coordinate with OS VRMT, CSIRC, the SOC, and other appropriate stakeholders to remediate zero-day and critical findings within required timeframes and to distribute alerts, notifications, and operational threat information to affected parties.

• Evaluate application inventory and software version reports, remove or disable end-of-life software where directed, and support the operational enforcement of secure software posture across the environment.

• Manage ServiceNow or other government-designated tasks and incident tickets by monitoring, prioritizing, documenting, and resolving actions within required service levels.

• Support FISMA, CSIRC, OIG, audit, compliance, Assessment and Authorization, governance, risk, and compliance activities, including preparation of documentation, maintenance of system records, and upkeep of GRC data for OCIO-supported systems.

• Generate and maintain cybersecurity threat landscape reporting and other situational awareness products needed for operational and management decision-making.

Objective 5 - Cloud-Based Infrastructure/Identity Management Services

Cloud-Based Engineering The Contractor shall design, engineer, secure, optimize, and sustain cloud-based infrastructure services that support the HHS OCIO enterprise environment across Microsoft Azure, Microsoft 365–integrated cloud components, and approved multi-cloud or shared-service offerings.

• Develop and maintain cloud reference architectures, patterns, and reusable engineering templates that align with HHS enterprise architecture, Zero Trust principles, and OneHHS interoperability goals.

• Perform requirements analysis, alternatives analysis, capacity planning, and cost modeling to support cloud migrations, modernization initiatives, and hybrid service integrations.

• Support datacenter-to-cloud migration efforts, including identifying migration candidates, planning sequencing, validating dependencies, and performing engineering testing

• Implement and maintain cloud security controls including identity protection, conditional access, network security groups, firewall rules, logging, vulnerability management pipelines, and cloud security posture management (CSPM).

• Engineer capabilities that support CDM, FISMA, HHS policy, and Zero Trust requirements, ensuring traceability, auditability, and centralized visibility of cloud assets and activity logs.

• Maintain guardrails, policies, tagging standards, compliance baselines, and automation that ensure Government control over cost, access, data residency, logging, and platform configuration

Cloud-Based Operations

• Support cost optimization through monitoring, reserved instance planning, consumption analysis, and recommendations for rightsizing or consolidating services.

• Perform engineering support for incidents, performance issues, and cloud-related security events in coordination with NOC, SOC, and operations teams.

• Implement monitoring and observability solutions that provide enterprise-level insights into availability, performance, cost, and service health

• Engineer hybrid connectivity, identity integration, and resource interoperability between on-premises systems, data centers, Microsoft 365 services, and cloud workloads.

• Validate new cloud services, updates, and features prior to production rollout and ensure integration with endpoint, network, identity, and collaboration engineering functions

• Maintain engineering documentation, cloud configuration baselines, test plans, deployment procedures, and export pathways necessary for reuse, auditability, and transition.

• Operate within the Engineering Test Lab and support evaluation and testing of new cloud features, security controls, and platform enhancement

Identity Management Engineering

• When exercised, design, implement, operate, and support identity and access management services across OCIO-supported systems, including single sign-on, federation, multifactor authentication, lifecycle provisioning, lifecycle deprovisioning, and Microsoft Entra ID administration.

• Automate identity processes where feasible, enforce common access policies, and maintain authentication and authorization services that support zero trust, interoperability, shared services, and enterprise-wide operational consistency across HHS.

• Integrating identity and access management services across enterprise applications and infrastructure platforms.

• Supporting implementation of enterprise ICAM architectures across hybrid IT environments.

• Designing integration patterns for authentication services and enterprise identity platforms. Defines subsystems and their interfaces; allocates responsibilities to subsystems; understands solution deployment and communicates requirements for interactions with solution context.

• Ensuring interoperability between identity providers, directory services, and enterprise systems.

• Supporting modernization of identity services supporting enterprise digital identity initiatives.

Identity Management Operations

• Developing architecture patterns for integrating identity services across enterprise platforms.

• Supporting enterprise architecture reviews for systems requiring identity integration.

• Contributing to development of technical standards and architectural guidance related to

ICAM services.

• Monitors and analyzes ICAM performance metrics, and cost efficiency, implementing strategies for capacity planning and cost optimization.

• Articulates and communicates to stakeholders and manages projects, problems to be solved, actionable events, milestones, and/or program issues under review, and deadlines and timeframes for completion.

• Using standard Project Management processes, tools, and techniques, manages project scope, cost and time while managing risk, communications and quality. Leads projects that implement state-of-the-art technological advancements. Develops work breakdown structures, resource leveling, milestones, predecessor and successor tasks, and methods for collecting and reporting project status data. Consults with stakeholders about their requirements throughout the entire project. Ensures customers are involved at all stages from planning and development to testing and implementation

7. Personnel, Training, and Security Requirements

7.1 Personnel Training and Competency

• All contractor personnel shall be trained, competent, and skilled to perform assigned work. Except for billable government-mandated training expressly approved by the COR in writing, training costs are the responsibility of the Contractor.

• The Contractor shall provide initial, recurring, refresher, and remediation training necessary to maintain required certifications, proficiency, and staff readiness for all assigned task order duties.

• The Task Order Management Plan (TOMP) shall include an employee training plan covering initial and recurring training, required certifications, and any HHS-directed training the Contractor identifies as necessary.

• The Contractor shall provide instruction on government statutes, regulations, policies, and guidelines, including conduct, ethics, safety, security, health, fire prevention, environmental compliance, privacy, and records handling, upon hire, annually, and as otherwise directed.

• The Contractor shall develop, implement, and maintain written guidelines, SOPs, and user procedures necessary for effective task order performance and shall comply with the Privacy Act and all other requirements governing sensitive information.

7.2 Personnel Security Requirements

• Contractor personnel are expected to require routine physical access to HHS-controlled facilities, logical access to HHS-controlled systems, access to sensitive HHS data, or a combination of those conditions.

• The Contractor shall comply with HSPD-12, OMB M-05-24, FIPS PUB 201, the HHS Information Security Program Policy, the HHS Office of Security and Drug Testing Personnel Security/Suitability Handbook, and the HHS HSPD-12 policy requirements, as updated.

• The minimum required government investigation for non-sensitive positions is a National Agency Check and Inquiries (NACI) with fingerprinting unless a higher level of investigation is required for the position.

• The Contractor shall notify the Contracting Officer in advance when new personnel subject to background investigation will perform work and shall provide required forms and supporting information promptly.

• Within seven calendar days after final acceptance of the work or termination of the task order, the Contractor shall return all government-issued identification badges as directed by the Government.

• The Contractor shall flow down equivalent facility, system, data access, and personnel security requirements to any subcontractor personnel requiring the same access.

8. Key Personnel The Contractor shall provide a Program Manager, and task leads or task managers sufficient to direct technical and administrative performance across all task areas. Prior to task order start, the Contractor shall provide to the Contracting Officer, for approval, the name, resume, and work mobile number of each identified key person and an alternate designated to act in that person’s absence.

The Contractor shall maintain and update a succession plan for key personnel throughout the task order period of performance.

Key personnel shall represent the Contractor in formal technical and administrative matters and shall be accountable for continuity of operations, timely issue escalation, staffing transitions, and delivery performance for their assigned work areas.

9. Deliverables, Data Management, and Reporting Requirements All dynamic deliverables, dashboards, logs, plans, reports, metrics, knowledge artifacts, and historical records shall be created, maintained, and made accessible in Government-hosted systems or Government-approved repositories. Deliverables shall not rely on contractor-hosted repositories as the authoritative source. The Government expects accessible systems of record such as SharePoint, Confluence, dashboards, and other Government-controlled tools that preserve query capability, historical traceability, and operational knowledge. For dynamic reporting, the deliverable shall be the maintained data set or knowledge artifact itself rather than only a static Word document.

• The Contractor shall structure work, reporting, and recommendations to demonstrate enterprise value, including opportunities for shared-service adoption, reuse, portability, consolidation, and elimination of duplicative tools, pipelines, or operating patterns.

• The Contractor shall maintain documentation, configurations, and operational artifacts in a form that preserves Government control, auditability, and transition readiness, including enforceable handoff and exit support for successor operations where directed.

• The Contractor shall support enterprise architecture, data portability, and interoperability outcomes by documenting interfaces, dependencies, configuration baselines, and export or migration considerations for services and tools within scope.

• The Contractor shall not maintain local or offline copies as the authoritative source for current operational reporting or knowledge artifacts except where specifically authorized for continuity or security purposes.

• The Contractor shall maintain logs, schedules, procedures, and knowledge repositories in a manner that supports search, trend analysis, historical reporting, and orderly transition to the Government or successor support provider.

• The Contractor shall provide the deliverables identified by the task order, including kickoff materials, TOMP, IMS, monthly status reports, project plans, status reports, patch reports, incident reports, root cause analyses, meeting minutes, EPLC artifacts, test documents, asset refreshment materials, maintenance plans, backup and disaster recovery materials, procedures, manuals, and other deliverables directed by the Government.

9.1 Core Deliverable Cadence

Deliverable Required timing

Kickoff briefing Within 10 business days after task order award

Draft / final TOMP 15 business days / 30 business days after award

Draft / final IMS 30 business days after award / 5 business days after government feedback

Monthly status report and PM review inputs 10th calendar day of each month

SLA performance results and improvement plans 12th calendar day of each month

Security incident notification Within 1 hour of occurrence

Root cause analysis / after-action report for Severity 1 incidents Within 48 hours after resolution, unless otherwise directed

Meeting minutes and presentations Within 3 business days after relevant meeting

Infrastructure and endpoint patch reports Within 5 business days after the end of each month

Backup status reporting Within 1 business day of attempt and via monthly report

Updated attachment J appendices / asset inventories Quarterly or as otherwise directed

10. Service Level Objectives and Performance Standards The performance standards below are incorporated into this Attachment A and apply to the associated objectives and task areas. The Government will evaluate performance throughout the task order period of performance. Surveillance may include 100 percent inspection, log review, dashboard review, ticket system review, random or planned audit, direct observation, and review of monthly or quarterly performance reports. The Contractor shall maintain the logs, ticket data, deliverable records, schedules, and other source material necessary to substantiate measured performance.

Unless otherwise stated, reporting begins at task order award and continues throughout the period of performance. Hold harmless periods, assumptions, exceptions, and measurement details shall be implemented as stated in the task order and associated SLA administration procedures.

SLA Mapped objective / task area Performance measure Required target

ENG-1 All objectives / all tasks Key personnel replacement

100% of key personnel replaced within 4 calendar weeks; vacancy notice to CO and COR within 24 hours.

ENG-2 All objectives / all tasks Deliverable quality

95% accepted by second submission; 100% by third submission; contractor to track and correct rework causes.

ENG-3 All objectives / all tasks Deliverable timeliness

95% submitted on or before due date; 100% within 5 business days of due date; deviations >24 hours reported within 1 business day.

ENG-4 Objective 2 / Platform Engineering

Endpoint image build timelines

95% ready for deployment within 30 business days of receipt of requirements; 100% within 45 business days.

ENG-5

Objectives 2 and 3 / Server, Platform, and Infrastructure patching

Endpoint and infrastructure critical patch timeliness

90% of applicable patches delivered within required patch windows;

remove any engineering-to-operations handoff construct from interpretation.

ENG-6 Objective 1 / Management On-schedule delivery

90% of milestones completed by baseline due date; 100% within 10 business days of baseline due date unless re-baselined with approval.

ENG-7 Objectives 2 and 3 / Tier 3 support Tier 3 incident resolution

Severity 1: 95% < 4 business hours, 99% < 8 business hours; Severity 2:

95% < 8 hours, 99% < 16 hours;

Severity 3: 95% < 1 business day, 99% < 2 business days; Severity 4:

95% < 3 business days, 99% < 5 business days.

ENG-8 All objectives / incident management Root cause analysis

90% within 1 business day after ticket closure; 95% within 2 business days after ticket closure for Severity 1 incidents or as directed.

ENG-9 Objective 2 / Platform and engineering support

Non-standard device provisioning

Reduce mean time from request to provisioning by 10% or more year-over-year.

ENG-10 Objective 3 / NOC Network and system availability 99.9% availability.

ENG-11 Objective 3 / Infrastructure Operations Network IMAC

95% of 1-5 approved IMACs in < 1 business day and 100% in < 2 business days; 95% of 6-15 IMACs in < 3 business days and 100% in < 5 business days.

ENG-12 Objective 3 / Security Operations

Managed security services

- firewall

100% of required firewall rule set modifications implemented within 24 hours of request.

ENG-13 Objective 3 / Patch management

Production patch deployment

100% of emergency patches to production within 4 calendar hours of government approval; 100% of critical patches within 2 calendar days; 100% of routine patches within 15 business days.

ENG-14 Objective 3 / Server Operations and NOC

Mean time to apply fix for a problem

Reduce mean time to apply fix by 10% or more year-over-year.

ENG-15 Objective 3 / NOC Re-opened tickets Maximum re-opened ticket rate:

CY1 10%, CY2 9%, CY3 8%, CY4 7%,

CY5 5%.

10.1 Additional Objective-Level Performance Requirements

• The Contractor shall maintain service level monitoring and reporting procedures that conform to HHS requirements, ITIL-aligned service management practices, and applicable HHS policy.

• SLA performance and any required improvement actions shall be documented monthly. For every breached SLA, the Contractor shall provide an improvement plan, corrective actions, owner, and expected restoration date.

• Performance reports shall be generated in Government-hosted systems and support real-time and historical queries, trend analysis, and export of records for audits, reviews, and transition.

• Backup, recovery, and disaster recovery readiness are material performance obligations. The Contractor shall maintain backup success reporting, restoration readiness, disaster recovery planning, and update cycles sufficient to protect mission services and support evidence-based review by the Government.

• Patch management obligations apply to engineering validation, operational deployment, and infrastructure-wide reporting. The Contractor shall maintain documented patch cycles, monthly status reporting, exceptions tracking, and explanatory rationale for deferred patches.

10.2 Objective-to-SLA Crosswalk and Enterprise Alignment

Objective Mapped SLAs Intent

Objective 1 - Management

ENG-1, ENG-2, ENG-3, ENG-6,

and supporting portions of

ENG-8

Ensures staffing continuity, deliverable quality and timeliness, schedule performance, reporting discipline, and corrective action management.

Objective 2 - Infrastructure Engineering

ENG-2, ENG-3, ENG-4, ENG-5,

ENG-7, ENG-9, and supporting portions of ENG-8

Links engineering execution to image build timing, patch timeliness, Tier 3 resolution, and provisioning efficiency.

Objective 3 - Infrastructure Operations

ENG-2, ENG-3, ENG-5, ENG-7,

ENG-8, ENG-10, ENG-11,

ENG-12, ENG-13, ENG-14,

ENG-15

Links operations performance to availability, IMAC turnaround, firewall implementation timeliness, patch deployment, fix speed, and ticket quality.

Objective 4 - Information Assurance

ENG-2, ENG-3, ENG-5, ENG-7,

ENG-8, ENG-12, ENG-13

Links cybersecurity reporting, response, vulnerability management, and remediation support to measurable service levels.

Optional Objective 5 - Identity Management Operations

ENG-1, ENG-2, ENG-3 and any task-order-tailored identity service levels

Supports continuity, quality, and timeliness for identity-related deliverables and operational actions.

The Government will evaluate whether the Contractor not only meets the associated service levels, but also performs the work in a manner that advances enterprise visibility, shared services, portability, interoperability, sustainable government control, and measurable OneHHS value.

11. Special Compliance Requirements

• The Contractor shall comply with HHS policy for information technology procurements, including information security, physical access security, privacy, records, and related control requirements applicable to this task order.

• The Contractor shall comply with HHS Section 508 and accessibility standards for deliverables, systems, documentation, and user-facing materials as applicable.

• The Contractor shall collaborate with the HHS Information Assurance function to ensure required security controls are incorporated into engineered and operational solutions.

12. Notes for Task Order Administration The Government may tailor the specific reporting format, dashboards, templates, and repository structure at task order kickoff or through subsequent direction, provided the substantive timing, traceability, and accessibility requirements of this attachment are preserved.

Where this Attachment A states an objective and also states a specific work product or timing requirement, the requirement is intentional and is included because the Government has determined that a hybrid SOO/PWS approach optimizes performance administration and expected outcomes for this task order.