DRAFT Statement of Work.pdf

PMT PID# N00421-19-RFPREQ-680000A-0001 RFP#N68520-20-R-0002

Statement of Work (SOW) For

Information Technology Solutions Support (ITSS)

1.0 Introduction / Scope

1.1 Introduction: This Statement of Work (SOW)) supports the mission(s) of the Naval Air Systems Command (NAVAIR), Naval Air Warfare Centers (NAWC), Fleet Readiness Center (FRC) Headquarters, and individual FRC’s Information Technology (IT) and related initiatives. Naval Aviation must be capable of responding quickly and operating effectively across a wide range of environments, which has solidified the importance of IT solutions. High readiness demands adequate, well-maintained equipment; realistic training; strategic mobility; and sufficient Naval Aviation support and sustainment capabilities. The rapid evolution of IT can enhance Naval Aviation’s speed to the fleet principles including capability, productivity, quality, and cost control. For Naval Aviation to maintain cutting edge, there is a need for restructuring by developing and implementing IT solutions to better align with the realities of the digital age. IT has fundamentally changed the relationship between people and knowledge, developing a need for advanced IT solutions. In order to maintain updated and current IT the Government will need to be able to provide solutions safely, quickly, and economically. Now more than ever, well-planned IT solution investments will provide timely, comprehensive, and detailed support to the U.S. Warfighter. A multi-faceted team with experience in existing NAVAIR Logistics, Maintenance, Analytical, and FRC IT solution sets will enhance Naval Aviation’s ability in achieving speed to the fleet principles.

1.2 Scope: The scope of this effort is to provide IT and related initiatives and solutions for NAVAIR, NAWC, FRC Headquarters, and FRC’s. This scope includes:

All activities of the Software Development Life Cycle (SDLC):

- Planning

- Systems Analysis and Requirements

- Systems Design

- Development

- Integration/Testing/Verification and Validation

- Deployment

- Operations and Maintenance

All activities associated with Commercial Off the Shelf (COTS) and Software-as-a-Service (SaaS) utilization:

- Software Requirements Analysis

- Evaluation

- Implementation

- Operations and Support

Support activities:

- Program/Project Management

- Software and Systems Engineering

- Enterprise Architecture

- IT Compliance/Network Security/Cyber Security

- Configuration Management

- Risk Management

- Data/Modeling/Analytics

- Database Administration

- Web Support

- Sustainment

- Education and Training

- Help/Service Desk

- Documentation

2.0 Applicable Documents: NOTE: Throughout the life of the contract, if any instruction or document referenced in section 2.0 is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this SOW.

2.1 Department of Defense Specifications.

2.1.1 DoD 5220.22-M, National Industrial Security Program Operating Manual, (NISPOM) 28 Feb

2.1.2 SECNAV M-5510.36 Information Security Program, 30 Jun 2006

2.1.3 DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) 24 Feb 2012

2.1.4 DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) Sep 1998

2.1.5 DoDD 5230.24 Distribution Statements on Technical Documents, Change 1, Effective 28 Apr

2.1.6 SECNAV M-5510.30 Personnel Security Program Jun 2006

2.1.7 OPNAVINST 3440.17A Navy Installation Emergency Management Program, 1 Aug 2014

2.2 Department of Defense Standards.

A comprehensive list of Navy regulatory documents can be found at the DON Chief Information Officer (CIO) IT Policy and Guidance website http://www.doncio.navy.mil/.

The Contractor shall be responsible for researching and complying with any additional regulations applicable to the task areas in which they are involved.

2.3 Other Government documents (e.g. NAVAIR Documents)

None

2.4 Industry documents

None

3.0 Requirements

3.1 General Requirements

http://www.doncio.navy.mil/

3.1.1 Compatibility - The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of SECRET up to and including TOP SECRET, unless otherwise noted herein. The current operating environment required for this contract includes:

Microsoft Windows 10 Microsoft Project 2010 Microsoft Office 2016 Adobe Acrobat XI (reader) Internet access

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain state-of the-art anti-virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and Local Area Network (LAN) communications with the Government Customers. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the Government Customers during working hours whether at Contractor work site or on travel.

3.1.2 Work Location and Facilities

3.1.2.1 Work Location: Approximately 70 percent of work is anticipated to be performed at the Government site and 30 percent of work performed at the Contractor site based on Government requirements. During contract execution, task orders may be issued for either contractor facility or Government site depending on Government requirements. Government site(s) include NAVAIR Headquarters at Patuxent River, MD, the NAWCADs at Patuxent River, MD, Lakehurst, NJ, and Orlando, FL; the NAWCWDs located at China Lake, CA and Point Mugu, CA; and the In-Service Support Centers (ISSC) located at Jacksonville, FL, Cherry Point, NC, and North Island, CA. The following FRCs are applicable to this contract effort Commander Fleet Readiness Center, Patuxent River, MD (COMFRC), Fleet Readiness Center Southeast, Jacksonville, FL (FRC-SE), Fleet Readiness Center East, Cherry Point, NC (FRC-E), Fleet Readiness Center Southwest, North Island, CA (FRC-SW), Fleet Readiness Center, West, Lemoore, CA (FRC-W), Fleet Readiness Center, North West, Whidbey Island, WA (FRCNW), Fleet Readiness Center, and Western Pacific, Atsugi, Japan (FRCWP). This list is not all-inclusive as locations may change over the life of the contract.

Contractors shall have facilities within 10 driving miles of Naval Air Station Patuxent River.

Contractor personnel performing on-site support will be provided access to Government workspaces, telephones, printers, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.2 Meeting Support: In support of the tasking outlined in this SOW, the Prime Contractor’s facility shall be able to host/conduct meetings and training sessions with a location within 10 driving miles of Naval Air Station Patuxent River, MD. These efforts shall be supported at classification levels up to the UNCLASSIFIED level. The meeting / training room capacity shall support a minimum of thirty (30) persons utilizing NMCI network connected laptop assets (meeting attendees / students training will bring their own assets). The meeting / training room shall be configured with contractor furnished telephone, VTC capability, and computer networking capability as well as sufficient equipment to conduct meetings with presentations including compatible software in

Paragraph 3.1.1. The Contractor shall provide simultaneous connection (computer-networking capability) to allow attendees to connect with NAVAIR’s NMCI work environment.

3.1.3 Work Schedule to include Compressed Work Schedule (CWS), overtime, holidays, and installation closure.

3.1.3.1 Work Schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0800 to 1630 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.1.2). Some supported Government offices have flexibility to start as early as 0600 and end as late as 1800, Monday – Friday.

3.1.3.1.1 Compressed Work Schedule (CWS): CWS is an alternative work schedule to the traditional five (5), 8.5-hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period: eight (8) weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one (1) weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch), and the employee does not work one (1) weekday. The result is 80 hours worked every two (2) weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met and CWS is approved by the Contracting Officer Representative (COR). If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government.

Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage by the Government.

3.1.3.1.2 Holidays: The Government observes the following holidays:

New Year’s Day, January 1 Martin Luther King’s Birthday, Third Monday in January President’s Birthday, Third Monday in February Memorial Day, Last Monday in May Independence Day, July 4 Labor Day, First Monday in September Columbus Day, Second Monday in October Veteran’s Day, November 11 Thanksgiving Day, Fourth Thursday in November Christmas Day, December 25

With the exception of the events in section 3.1.4.1.3 below, the Contractor is permitted to observe the above Holidays in accordance with its corporate policy.

3.1.3.1.3 Installation Closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, the Contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally Contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work performed by Contractor personnel deemed mission essential and performance of such mission essential work is authorized to continue at the Government facility despite the facility otherwise closed for normal operations. The circumstances permitting work being performed by Contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work performed by Contractor personnel is mission essential.

3.1.3.1.4 Overtime: Overtime will be determined at the task order level when applicable and be executed in accordance with task order determined requirements.

3.1.4 Other Direct Costs:

3.1.4.1 Travel: Travel will be determined at the task order level when applicable and executed in accordance with 5252.232-9509.

3.1.4.2 Material: Material will be determined at the task order level when applicable and executed in accordance with 5252.242-9515.

3.1.5 Subcontractors and Consultants: Provisions stated herein shall be clearly and effectively communicated to all subcontractors and consultants providing support under this contract. All provisions of this SOW shall flow down to subcontractors and consultants providing support under this contract.

3.1.6 Management of Contractor Personnel: The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual Contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.1.7 Transition Out Strategy

The Contractor’s overall transition out strategy shall be built around maintaining the mission of NAVAIR, NAWC, and FRCs IT solutions with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Upon termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with CDRL A002, Transition Out Plan.

- Work Turnover. The Contractor shall provide a plan of action, which effectively transfers tasked work that is in process at the expiration, or termination of the contract. Establish and maintain effective communication with the incoming Contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period.

- Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

- Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data.

3.1.8 Increased Capacity Options

This contract includes option CLINs associated with each period of performance for an increase in capacity not to exceed ten percent (10%) of the total dollars of the Labor and ODC CLINs within the respective term. This option may be exercised at the Government’s discretion in accordance with clause H.X of this contract.

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific Government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:

Classified: All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Contractor personnel may be required to access classified information in performance of this contract up to and including TOP SECRET dependent on order issued. The Contractor shall be responsible for ensuring all personnel receive the requisite investigation and are favorably adjudicated in accordance with DoDM 5220.22, National Industrial Security Program Operating Manual.

Contractor employees who fail to meet security clearance requirements shall not access classified information or perform sensitive duties. In such cases, the Contractor employee shall not perform on the contract.

The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; For Official Use Only; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activities only. Other requests for deliverables under this contract shall be referred to the COR/TOCOR of this contract/task order for approval.

Controlled Unclassified Information including For Official Use Only and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR-N).

3.2.3.1 SAAR-N: All Contractor personnel requiring access to Government IT systems shall have an approved SAAR-N Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty-days of their first day of work. SAAR-N forms shall be submitted to the COR, TOCOR, or to the assigned Government Trusted Associate Sponsorship System (TASS) Trusted Associate.

3.2.3.2 Command Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges issued by the Government to on-site Contractor personnel shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to Regulations Governing admissions to the each Government facility location. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department at the Government site in accordance with Regulations Governing admissions to each Government facility location, following completion of the contract, relocation, or termination of an employee, or upon request from the COR/TOCOR. The Government will provide the Contractor access to Government facilities for performance of tasks under this contract. The local instructions cited herein may be revised in each task order issued hereunder as determined by the location of the work to be performed.

3.2.4 Information Security. If the work is performed at the Contractor’s facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with DoD 5220.22-M (NISPOM) and SECNAV M-5510.36. If the work is performed at the Government's facility, the Contractor shall comply with the sites security procedures and controls.

3.2.4.1 Marking: All information generated by the Contractor shall be properly marked. For Official Use Only information generated and/or provided under this contract shall be marked in accordance with DoDM 5200.01. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDD 5230.24 and Program Security Classification Guidance.

3.2.4.2 Public Release: No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release through the servicing agency’s Public Affairs Office via the PCO.

3.2.4.3 Loss, Compromise, and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise, and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TOCOR, and Government Security Office within 24 hours of the incident occurring.

3.2.5 Operations Security (OPSEC): The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

a. Assignment of responsibility for OPSEC direction and implementation.

b. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training.

d. Provisions for management, annual review, and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR, NAWC or FRC sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and Contractor in support of the mission.

3.2.6 Anti-Terrorism Force Protection and Emergency Management: The work performed on this contract is not Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism, and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism, and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only.”

All Contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 Classified COMSEC material is not releasable to Contractor employees who have not received a final security clearance at the appropriate level. Cryptologic keying materials and Controlled Cryptographic Items (CCI) are controlled by Department of the Navy, NISPOM, and National Security Agency (NSA) guidelines. The Contractor shall be guided by NSA/CSS Policy Manual 3-

16 in the control and protection of COMSEC material/information at their facilities. When access is required at Government facilities, Contractor personnel shall adhere to COMSEC rules and regulations as mandated by DoD 5520.22-M, EKMS 1 (series) and Command policy and procedures.

Written concurrence of the Government Contracting Activity (GCA) or Point of Contact (POC), identified in Block 16 of the DD254, or Contracting Officer Representatives required prior to adding/changing subcontractors.

3.2.8 Non-SCI: No Contractor access to Non-SCI intelligence information or Foreign Intelligence Information required (Secret Internet Protocol Network (SIPRNet) access requirement only). If additional access via SIPRNet is required, the Technical Point of Contact/Contracting Officer Representative must modify/revise the requirements of DD254 for Scientific Technical Intelligence Liaison Officer (STILO) approval and signature.

3.2.9 North Atlantic Treaty Organization (NATO) Information: To facilitate potential access to NATO classified information, to include NATO accredited SIPRNet terminals, all DoD military, civilian, and Contractor personnel who are briefed on their responsibilities for protecting U.S.

classified military information, shall also be briefed on the requirements for protecting NATO information, per Deputy Under Secretary of Defense Policy Security Memo of 5 Dec 01. Written concurrence of the Contracting Officer/ is required prior to adding/changing subcontractors.

3.2.10 Classified Information/Material Access: All classified information/material shall be provided by the Contractor facility or Government Contracting Activity (GCA) and safeguarded at the approved actual performance site.

3.2.11 Program Unique Requirements

3.2.11.1 Physical Security: The Contractor shall be responsible for safeguarding all Government property provided for their use. At the end of each work period, all facilities, equipment, and materials shall be secured.

3.2.11.2 Performance Requirements: The Contractor shall have direct experience and thorough knowledge of DoD, DoN, and/or NAVAIR IT policy, concepts, and toolsets, including but not limited to, NAVAIR Logistics, Maintenance, Analytical, and FRC IT solution sets, Navy Networks, and Mission Aligned Organization (MAO). An understanding of these policies and concepts shall be required to ensure stability and continuity of the workforce when hiring personnel and during execution of this SOW.

The Contractor shall comply with Command Initiatives. The Contractor shall perform in accordance with DoD, DoN, and NAVAIR initiatives, standards, policies, and mandates such as Application Portfolio Management, Defense Business Transformation Guidance, Navy Enterprise Application Developer’s Guide (NEADG), Clinger Cohen Act (CCA), Federal Information Security Management Act (FISMA), Web Enablement, and 508 Compliance. Any systems/applications or tools that will reside on NMCI, Continuity of Services Contract (COSC), Next Generation Enterprise Network (NGEN), or run on these workstations must be certified for NMCI, COSC, NGEN, and comply with NMCI, COSC, and NGEN policies.

3.2.11.3 Data Rights: For all technical data produced or delivered under this contract, the Contractor shall grant the Government rights, as per Defense Federal Acquisition Regulation (FAR) Supplement

(DFARS) 252.227-7013 Rights in Technical Data--Noncommercial Items. For all computer software produced or delivered under this contract, the Contractor shall grant the Government rights, as per DFARS 252.227-7014 Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation. This includes the source code and artifacts (such as Interface Description Language (IDL) / Web Service Description Language (WSDL) files and all required interop’s (technology that enables Common Object Model (COM) objects to interact with .NET objects and vice versa), build scripts and procedures, install scripts and procedures, minimal data required to build, install, and start application, and executable code, which shall be Government property. The Contractor shall flow these data rights down to all subcontractors and suppliers. These rights are IAW DFARS 252.227-7014, Rights in Data – General, DFARS 252.227-7020, Rights in Data – Special Works, and DFARS 252.227-7021, Rights in Data—Existing Works.

3.2.11.4 Government Furnished Property, Equipment, and Information: The Government reserves the right to provide Government Property, Equipment, and Information on an as needed basis at the task order level. The Contractor shall be required to manage and track such furnished property in accordance with applicable Government property clauses and reporting requirements.

3.2.11.5 Contractor Acquired Material/Property: The Contractor shall document the transfer of the materials and property in the monthly status report and appropriate Government documentation.

3.2.11.6 Organizational Conflict of Interest: The Government requires that a Contractor-provided Organizational Conflict of Interest (OCI) Mitigation Plan be submitted within fifteen (15) days after contract award. All Contractor personnel working this contract shall receive company sponsored OCI training within fourteen (14) calendar days after contract award. (CDRL A003 OCI Mitigation Plan)

3.2.11.7 Non-Disclosure Agreements: In the performance of the contract, the Contractor may have access to non-public proprietary information. If the Government determines that the Contractor will have access to non-public proprietary information at a task order level, then the Contractor shall require that any employee performing services under that task order sign a Non-Disclosure Agreement (NDA). The NDA shall acknowledge the Contractor and employees’ duties and promise to comply with those obligations. The Contractor shall provide the COR/TOCOR a NDA for each individual Contractor employee before the employee begins performance by individual task orders.

3.2.11.8 Disclosure of Information: Contractor employees shall not discuss nor disclose any information to which they are exposed during the execution of tasks to parties other than the originator of the information, authorized Government investigative personnel, the Contracting Officer, or COR personnel. Improper disclosure of sensitive information may be grounds for removal of Contractor personnel.

3.2.11.9 Training. The Contractor shall provide qualified personnel who are capable of assuming their duties at contract award. Training for Contractor personnel shall be at the Contractor’s expense.

In the event the Contractor must attend training, the Contractor shall coordinate training dates with the Government to ensure continuity of operations.

3.2.11.10 Quality Assurance. The Government will evaluate the Contractor’s performance under this contract and orders in accordance with the Contract Surveillance Plan (CSP) required by FAR Part 46. The principal evaluator of Contractor work quality is the Government COR/ACOR in coordination with TOCOR/TPOC. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the Government will survey, observe, test, sample, evaluate, and document the Contractor’s performance standards identified in the Contract and Orders.

3.2.12 Cybersecurity

3.2.12.1 Cybersecurity Plan

For Cybersecurity (CS) requirements see the Cybersecurity Plan (CSP), Attachment 9. Specific mentioned policies in the CS Plan can be accessed via the Cybersecurity Policy Chart at the following link: http://iac.dtic.mil/csiac/ia_policychart.html.

The Contractor shall prepare and deliver a Program Cybersecurity Implementation Plan (CSIP) or Annex CSIP to address each of the sections of the Cybersecurity Plan (CSP) on a semi-annual (twice per year) basis in accordance with CDRL A004 Cybersecurity Implementation Plan.

The Contractor shall demonstrate its understanding of the CSP and describe how the requirement of each of the sections of the CSP will be achieved by the Contractor. Sections of the CSP that are NOT applicable are required to be addressed.

The Contractor shall describe why a particular section is not applicable. The final Program CSIP shall be in Adobe Acrobat format with a digital signature from the Contractor cognizant authority.

If no approved Program CSIP currently exists between the Contractor and the Government, then one shall be created and submitted. If an approved Program CSIP already exists and sufficiently satisfies the CSP requirements for the contract, then no new CSIP delivery is required. In such cases, the Contractor in consultation with the Government shall only submit a Contract Letter to the Government stating that all CSP requirements are satisfied by the existing Program CSIP.

If CSP requirements are NOT adequately addressed by the existing Program CSIP, then an update to the Program CSIP or a supplemental CSIP document referred to as an “Annex CSIP” shall be created to satisfy the CSP requirements. An Annex CSIP shall address unique CSP Section "G" Assessment and Authorization requirements if a system is being delivered under the contract and unique Section "Q" Software requirements if software is being delivered.

3.2.12.2 Cybersecurity System/Software Assurance Report

CDRL A005 Cyber Security System/Software Assurance Report: If a system or software is to be delivered to the Government, then the Contractor shall address these requirements within the Cyber Security System/Software Assurance Report.

3.3 DETAILED SUPPORT: The following appropriations may be utilized on this contract:

Funding of Functional Performance Requirements: Functional performance requirements – the function required to execute TO requirements – are outlined below in Section 3.3.1 through 3.3.4.

The applicability of each functional performance requirement to funding types is indicated in the table below.

http://iac.dtic.mil/csiac/ia_policychart.html

SOW # Description RDT&E O&M OP AP Other

3.3.2 Software Development Life Cycle (SDLC)

3.3.2.1 Planning X X X X X

3.3.2.2 Systems Analysis and Requirements X X X X X

3.3.2.3 Systems Design X X X X X

3.3.2.4 Development X X X X

3.3.2.5 Integration/Testing/Verification and Validation X X X X X

3.3.2.6 Deployment X X X X X

3.3.2.7 Operations and Maintenance X X X X X

3.3.3 Commercial off the Shelf (COTS) and Software-as-a-Service (SaaS)

3.3.3.1 Software Requirements Analysis X X X X X

3.3.3.2 Evaluation X X X X X

3.3.3.3 Implementation X X X X X

3.3.3.4 Operations and Support X X X X X

3.3.4 Support Activities

3.3.4.1 Management X X X

3.3.4.2 Software and Systems Engineering X X X X X

3.3.4.3 Enterprise Architecture X X X X X

3.3.4.4 Information Assurance/Network Security/Cyber Security X X X X X

3.3.4.5 Configuration Management X X X X X

3.3.4.6 Risk Management X X X X X

3.3.4.7 Data/Modeling/Analytics X X X X X

3.3.4.8 Database Administration X X X X X

3.3.4.9 Web Support X X X X X

3.3.4.10 Sustainment X X X X

3.3.4.11 Education and Training X X X X X

3.3.4.12 Help/Service Desk X X X X X

3.3.4.13 Status Reporting X X X X X

3.3.1 Contract Data Requirements

3.3.1.1 Process/Program Improvement: The Contractor shall define, implement, measure, and maintain effective and efficient practices that enable repeatedly executed workload with high levels of success. The Contractor shall update existing processes, build, and develop new processes for Government approval. (CDRL A006 Process/Program Improvement Plans)

3.3.1.2 Project Planning Documents: The Contractor shall develop and/or update existing planning documents, build, and develop new processes for Government approval. All program-planning documents required by individual task orders shall be completed by the Contractor. (CDRL A008 Project Planning Documentation)

3.3.1.3 Engineering Documents: The Contractor shall provide engineering documents and attend reviews requested from the Government. All required engineering documents requested by the Government will be approved by the Government. (CDRL A009 Engineering Documentation)

3.3.1.4 Analysis and Design Documents: The Contractor shall develop all High-Level Design (HLD). HLD explains the architecture that would be used for developing a software product. The architecture diagram provides an overview of an entire system, identifying the main components that would be developed for the product and their interfaces and Low-Level Designs (LLD). LLD describes the class diagrams with the methods and relations between classes and program specs. It describes the modules so that the programmer can directly code the program from the document.

Government approval of the HLD is required before the LLD effort can begin. Government approval of the LLD is required before development can begin. All required analysis and design documents requested will be approved by the Government. (CDRL A010 Analysis and Design Documentation)

3.3.1.5 Testing Documentation: The Contractor shall develop all testing documentation when requested by the Government. All required analysis and design documents requested will be approved by the Government. (CDRL A011 Testing Documentation)

3.3.1.6 Training Documentation: The Contractor shall develop curriculum and training documentation such as briefs and reading material as detailed in task order. The Contractor shall provide supporting documentation, and training to the Government as specified in individual task orders. All training documentation requested will be approved by the Government prior to distribution and before training is conducted. (CDRL A012 Training Documentation)

3.3.1.7 Implementation Documentation: The Contractor shall provide the software release package, supporting documentation, and training to the Government required in individual task orders. The Contractor shall provide software installation and implementation support to the Government as defined in the task order. All implementation documentation requested will be approved by the Government. (CDRL A013 Implementation Documentation)

3.3.1.8 Software Application Source Code: The Contractor shall develop the Software Application Source Code (and other IT artifacts) when requested by the Government in accordance with the approved design. The supporting documentation shall follow approved IT templates. All Software Application Source Code and artifacts will be approved by the Government. (CDRL A014 Software Application Source Code)

3.3.1.9 Training Development/Delivery: The Contractor shall provide courseware strategy, design, development/test, delivery, and maintenance training activities. The training will include, but not limited to, end user and “train the trainer” utilizing web based, classroom approaches, and other delivery methods. All training documentation requested will be approved by the Government prior to distribution and before training is conducted. (CDRL A015 Training Development)

3.3.1.10 Sustainment Support: The Contractor shall provide sustainment support including, but not limited to, sustaining engineering, data management, licensing, system supportability, system interoperability, maintenance updates and redesign, maintenance agreements, subscriptions, and application support packages. All sustainment support requested will be approved by the Government. (CDRL A016 Sustainment Support)

3.3.1.11 Monthly Plan of Action & Milestones (POAM): The Contractor shall provide a POAM each month for all Software Change Requests (SCRs) that are in work from requirements engineering through implementation. (CDRL A017 Plan of Action and Milestones)

3.3.2 Software Development Life Cycle (SDLC)

3.3.2.1 Planning: The Contractor shall perform planning tasks to initially design or reshape an IT solution with respect to customer-specific requirements and boundary conditions. Examples are planning for a major IT change, a functional extension of an existing IT solution, an overhaul of the technical platform, preparation for growth, or a change of business organization. The Contractor shall perform transformational planning and organizational change through coordinated execution of change activities that enable users to adopt a new vision, mission, or system. The Contractor shall assess current IT architectures as it aligns with mission and strategic goals and produce an Information System strategic plan. The Contractor shall identify new IT Architectures and operational plans resulting in Information Systems development projects.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A006 Process/Program Improvement Plans and A008 Project Planning Documents.

3.3.2.2 Systems Analysis and Requirements: The Contractor shall analyze and evaluate existing or planned system(s) and solutions. The Contractor shall define system and software requirements for proposed solutions. The Contractor shall transform business/mission and operational needs into system requirements. Requirements analysis shall also include hardware, operating systems, data, integration, and cyber security. The Contractor shall perform analysis to address if current software used is adequate or is new or upgraded software needed to meet future objectives. The Contractor shall conduct gap analysis. The Contractor shall evaluate and analyze the current items used to determine if the product or system is meeting the standards/requirements set or that improvements / advancements need to be addressed. The Contractor shall analyze requirements for clarity, potential problems, risks, and feasibility concerns. The Contractor shall utilize the information gathered from the analysis to determine the best course of action to ensure requirements (functional, technical and performance) and future objectives are met.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A006 Process/Program Improvement Plans, A008 Project Planning Documents, and A009 Engineering Documents.

3.3.2.3 Systems Design: The Contractor shall provide the design of the projected high level and detailed design specification(s) for a system to satisfy specified requirements. The Contractor shall define the architecture, components, modules, interfaces, data, and cyber security for the system. The Contractor shall employ disciplines of systems analysis, systems architecture, and systems engineering.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A009 Engineering Documentation and A010 Analysis and Design Documentation.

3.3.2.4 Development: The Contractor shall perform system development for embedded and business systems and solutions to create or alter systems, along with the processes, practices, models, and methodologies used to develop them. The Contractor shall transform the design specification into software by generating the code. The Contractor shall develop applications and interfaces for stand-alone, embedded systems, and specialized software systems. The Contractor shall ensure system interoperability. The Contractor shall conduct reviews such as Preliminary Design Reviews (PDRs), Critical Design Reviews (CDRs), and Cyber assessments when requested by the Government.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A008 Project Planning Documents, A009 Engineering Documents, A010 Analysis and Design Documentation, and A014 Software Application Source Code.

3.3.2.5 Integration/Testing/Verification and Validation: The Contractor shall perform all tasks to ensure successful integration has occurred and a functioning product or system is available for testing.

The Contractor shall perform testing of the developed software to detect software failures. This testing includes the examination of code, the execution of that code in various environments and conditions, and examining the aspects of code: does it do what it is supposed to do and do what it needs to do. The Contactor shall perform the following types of testing:

- Unit

- Integration

- Systems

- Operational Acceptance

The Contractor shall perform the following testing techniques and tactics:

- Installation Testing

- Compatibility Testing

- Smoke and Sanity Testing

- Regression Testing

- Destructive Testing

- Software Performance Testing

- Usability Testing

- Accessibility Testing

- Security/Cyber Testing

- Internationalization and Localization Testing

The Contractor shall plan and conduct software/process quality control utilizing verification and validation (V&V) processes to ensure that a software system(s) meets specifications and that it fulfills its intended purpose.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A009 Engineering Documents, A011 Testing Documentation, and A013 Implementation Documentation.

3.3.2.6 Deployment: The Contractor shall plan and deploy software solution(s) performing all the activities that make a software system available for use. The Contractor shall perform the deployment process, interrelated activities, and transitions between each activity. The Contractor shall provide system deployment support to achieve operational capability that satisfies mission need.

The Contractor shall provide system deployment support to achieve operational capability that satisfies mission need. Once the maturity level has been demonstrated, reviewed, and approved by the Government, the system or increment shall be baselined and a methodical and synchronized deployment plan (for all applicable locations) shall be developed and executed.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A012 Training Documentation and A013 Implementation Documentation.

3.3.2.7 Operations and Maintenance: The Contractor shall perform IT operations and maintenance.

The Contractor shall monitor and adjust software and hardware environments to ensure proper operations. The Contractor shall report and correct any discrepancies or defects discovered in order to ensure proper system or software operation(s). The Contractor shall execute industry standard service models, such as Information Technology Infrastructure Library (ITIL) and Information Technology Services Management (ITSM) supporting development and operations.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A008 Project Planning Documents and A009 Engineering Documents.

3.3.3 Commercial off the Shelf (COTS) and Software-as-a-Service (SaaS)

3.3.3.1 Software Requirements Analysis: The Contractor shall analyze requirements to determine required functionality needs. The Contractor shall analyze all requirement(s) to ensure all aspects of the software and solution will meet anticipated functions and operations. The Contractor shall conduct analysis activities such as:

- Definition of approved requirements

- Creation of the Functional Requirements Document and Requirements Traceability Matrix

- Completion of a COTS gap-fit analysis and requirements validation

- Systems analysis and engineering

- Cyber Security

CDRLs A006 Process/Program Improvement Plans, A008 Project Planning Documents, A009 Engineering Documents, and A010 Analysis and Design Documentation.

3.3.3.2 Evaluation: The Contractor shall evaluate the product characteristics, such as functionality, maturity, technology, architecture, licensing fees, and long-term viability. The Contractor shall ensure performance of a full cost analysis and maintain a clear understanding of the recurring and non-recurring costs associated with the information software system. Determine expected maintenance costs and the costs to modify or enhance the COTS/SaaS system. The Contractor shall evaluate on the vendor characteristics such as maturity, stability, cooperation, and ability to provide adequate support, training, and documentation. The evaluation should ensure the COTS software/services meets all requirement expectations.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A006 Process/Program Improvement Plans, A009 Engineering Documents, and A010 Analysis and Design Documentation.

3.3.3.3 Implementation: The Contractor shall perform all toolset configuration and deployment tasks and functions for all locations. The Contractor shall perform all components of configuration, adaptation, and testing for all needs of the system and requirement.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A009 Engineering Documents, A011 Testing Documentation, A012 Training Documentation, and A013 Implementation Documentation.

3.3.3.4 Operations and Support: The Contractor shall provide support of implemented solutions.

The Contractor shall ensure that additions such as enhancements, updates, and upgrades are deployed to maintain the system in accordance with requirements, commercial considerations, and rapidly changing technology.

Required task order data resulting from this task shall be prepared and delivered in accordance with CDRLs A008 Project Planning Documents and A009 Engineering Documents.

3.3.4 Support Activities

3.3.4.1 Program/Project Management: The Contractor shall manage schedule, risk, and quality for assigned programs and projects. The Contractor shall perform effective integration through management of architecture, interfaces, requirements, testing, and other aspects of project planning and execution. The Contractor shall maintain a strong process culture within the program(s) and project(s). The Contractor shall define, implement, measure, and maintain effective and efficient practices and processes that enable repeatedly executed workload with high levels of success. The Contractor shall update existing processes, build, and develop new processes for Government approval.

The Contractor shall perform the following Program/Project key activities:

Governance: Structure, process, procedures and metrics to control operations.

Alignment: Support higher-level vision, goals and objectives.

Assurance: Verification and validation ensuring adherence to standards.

Integration: Optimize functional and technical performance within the solution.

Planning: Develop plan bringing together information on projects, resources, timescales, monitoring and control. Execute to plan.

Improvement: Continuously conduct performance management, research, develop new capabilities, and systemically apply learning and knowledge.

The Contractor shall conduct investment and financial initiatives, mitigate project risks, and perform independent assessments (e.g.