DTRA.ACES.Follow.On.Support.DRAFT.SOW-12.9.25.pdf

ACES Support Services SOW

Arms Control Enterprise System (ACES) Support Services Statement of Work

9 Dec 2025

1.0 Introduction/Background/Scope

This effort is for Arms Control Enterprise System (ACES) Support Services required by the ACES Conventional and Strategic arms control community in the Department of War (DoW), Department of State (DOS), and throughout the United States (U.S.) arms control community to meet Conventional and Strategic arms control treaty and agreement requirements.

ACES is Defense Threat Reduction Agency (DTRA) owned customized arms control treaty automation software providing equipment transaction processing, notification generation/workflow, and report generation. It is an automated information system for tracking and reporting conventional and strategic arms control information and notifications as required by the following treaties and agreements:

• New Strategic Arms Reduction Treaty (START), NST

• Conventional Armed Forces in Europe (CFE) Treaty

• Vienna Document 2011

• Treaty on Open Skies

• Global Exchange of Military Information (GEMI)

• United Nations Transparency in Armaments (UN/TIA) Agreement

• Wassenaar Arrangement

The integrated solution provides timely and efficient worldwide access to users throughout the arms control community using a web interface and SECRET Internet Protocol Router Network (SIPRNet) connectivity.

The ACES application is implemented in Java and uses a range of mature components from RedHat Open JDK. ACES utilizes a suite of proven and mature industry standard frameworks and technologies including Enterprise Java Bean (EJB), XML, and Web Services.

The ACES application is hosted on a two-node cluster of JBoss Application Server. The data storage solution in ACES utilizes the latest Oracle technologies including Oracle Cluster, Data Guard, and multiple dimensions of data backup solutions. The contingency ACES system is operational at an alternate site and the data is replicated in real time utilizing Oracle Data Guard technology.

The virtual servers that host the ACES application and ACES database are Red Hat Linux (RHEL) servers. ACES interfaces via XML and Web Services with third party solutions hosted on Windows platforms that provide additional capabilities such as printing treaty reports.

ACES is currently hosted on a DTRA managed virtual environment located within the

DTRA Information Technology (J6) Directorate managed Server Operations Center (SOC) at DTRA Fort Belvoir, Virginia. The virtual servers that host the ACES application and ACES database are Linux servers. The ACES software is owned by the U.S. Government/DoW/DTRA. The application source code is a deliverable on the contract with updated source code to be provided after every software release.

This Statement of Work also includes providing arms control treaty / agreement automation subject matter expertise (SME) and user support to users of the Next Generation ACES (Next-Gen ACES) modules as they are deployed. The Next-Gen ACES requirement is procured under a separate, entirely unique, contacting action and is adjacent to this requirement. Support will be limited to areas regarding the specifics of the treaties and agreements and the associated transaction processing, notifications development / workflow and data management functions and not on the specific use of the Next-Gen ACES interface or issues with Next-Gen ACES user accounts, system issues, database issues, etc.

2.0 Applicable Documents

• National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M, and any revisions to that manual.

• DoD Directive 5000.1, The Defense Acquisition System, September 9, 2020

• DoD Instruction 5000.2, Operation of the Adaptive Acquisition Framework, January 23, 2020

• Risk Management Framework, NIST Special Publication 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems”, and NIST Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations”.

• National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Overview: http://csrc.nist.gov/groups/SMA/fisma/framework.html

• DoD Instruction 5000.87, “Operation of the Software Acquisition Pathway,” October 2, 2020

• DoDI 8500.01 Cybersecurity, Incorporating Change 1, October 7, 2019

• DoDI 8510.01 Risk Management Framework (RMF) for DoD Systems, July 19, 2022

• DoDM 8140.03 Cyberspace Workforce Qualification and Management Program, February 15, 2023

• Application Security and Development (ASD) Security Technical Information Guide (STIG) Version 6, June 5, 2024

• DoDI 8582.01 Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information, December 9, 2019

• DoD Developer’s Guidebook for Software Assurance, December 2018

• DoD Instruction 5200.48, Controlled Unclassified Information, March 6, 2020

• DoD Controlled Unclassified Information (CUI) Program, CUI Registry http://csrc.nist.gov/groups/SMA/fisma/framework.html

• Deputy Chief Information Officer for Cybersecurity Memo, Requirements for Applying Baseline Controls for Controlled Unclassified Information Systems, February 23, 2022

• DoD Instruction 5230.24, Distribution Statements for DoD Technical Information, January 10, 2023

• DoD Manual 8400.01, Accessibility of Information and Communications Technology (ICT), November 14, 2017

• W3C Web Content Accessibility Guidelines (WCAG) 2.0, December 11, 2008

• W3C Web Content Accessibility Guidelines (WCAG) 2.1, June 5, 2018

• DTRA Instruction 1020.02, Implementation of Section 508 of the Rehabilitation Act of 1973, April 18, 2014, as amended

• DTRA Instruction 8580.2, Acquisition of Information Technology (IT) Goods and Services, August 31, 2018

• DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management

• DTRA/SCC-WMD Instruction 8500.4 Information Assurance Implementation

• Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) - http://iase.disa.mil/stigs/Pages/index.aspx

• DISA Enterprise Mission Assurance Support Service (eMASS) -http://www.disa.mil/Cybersecurity/Certification-Accreditation/EMASS

• Data Center Optimization Initiative (DCOI) -https://www.gsa.gov/portal/content/139770

• DTRA INSTRUCTION 8570.1 - Defense Threat Reduction Agency (DTRA) and U.S.

Strategic Command Center for Combating Weapons of Mass Destruction (SCC-WMD) Information Assurance (IA) Workforce Training and Management Improvement Program Instruction. Originating Component: Chief Information Officer (CIO);

Effective: April 14, 2011; Change 1 Effective: May 23, 2018

• DoD Directive 8140.01. Cyberspace Workforce Management. August 11, 2015 Incorporating Change 1, July 31, 2017

• H1540CR.HSE - National Defense Authorization Act (NDAA) for Fiscal Year 2012

• OMB Memorandum M-19-19, “Update to Data Center Optimization Initiative

(DCOI)”

• Documents listed as Contract Data Requirements List (CDRLs) in section 3.5 of this Statement of Work are all applicable this effort.

3.0 Tasks

3.1 Process and Program Management

The Contractor shall provide, manage and execute tailored and documented processes in accordance with IEEE/EIA 12207.0 and 12207.1. Processes will include data http://iase.disa.mil/stigs/Pages/index.aspx http://www.disa.mil/Cybersecurity/Certification-Accreditation/EMASS http://www.gsa.gov/portal/content/139770 management, configuration management, risk management, operational testing, information assurance, software problem resolution, etc. Additionally, the Contractor shall provide program management for the Operations and Maintenance (O&M) activities of the ACES program required to support the DoW, DoS, and ACES users throughout the U.S. arms control community. Program management areas will include User Support, User Training, Cybersecurity Actions, Maintaining System Accreditation, and very minimal, critical need only, software coding (primarily due to required operating system, database and application component periodic or security update patches) and associated testing and release deployment. Plan, manage, execute, and measure activities to ensure effective performance on the program throughout the period of performance are expected.

The Contractor shall support any Independent Verification and Validation (IV&V) and Field-Testing activities and schedules identified by the DTRA. Direct IV&V activities for this program are procured under a separate contract and are outside the scope of this requirement.

The Contractor shall ensure that files generated in ACES are, as required, 100% compatible with ACES related applications, such as the Organization for Security and Cooperation in Europe’s (OSCE) Integrated Notification Application (INA), Automated Data System (ADS) and the Military Information Application System (MIDAS).

The Contractor shall manage, maintain, execute and keep current Assessment and Authorization (A&A) status and DoW Information Technology (IT) security update requirements activities and tasks.

The Contractor shall not propose any solutions approach or course of action that will result in government ownership of any data center assets as defined in H1540CR.HSE - National Defense Authorization Act for Fiscal Year 2012 or in establishing a government data center as defined in OMB Memorandum M-16-19, “Data Center Optimization Initiative (DCOI).” This includes any effort resulting in the procurement of a server(s), whether in a production, test, staging, development, or any other environment.

Software development efforts must identify source code as a contract deliverable and require the performer to employ standard coding best practices, including the avoidance of proprietary techniques, algorithms, or code. The Contractor shall ensure that its software developers have the requisite security clearances commensurate with the security environment / network in which the work is to be performed. Senior Information Security Officer (SISO) review and approval of the controls used to isolate the test or evaluation instance from DTRA's operational networks is required prior to the installation of software deliverables within a DTRA pre-production or software lab environment. The controls proposed may require software code analysis. SISO review and acceptance of the documented source code analysis findings will, however, be required prior to installation of any software deliverable on and DTRA operational network, integration with any operational system, or to support a Certificate of Networthiness issued by DTRA.

3.2 O&M Activities and Support

The Contractor shall provide O&M activities and support for the ACES operational environment to allow for 24/7 usage. O&M activities include, but are not limited to:

3.2.1 Network, systems administration and help desk support on an on-call

24x7, 365-day basis.

• The help desk will gather appropriate metrics on questions and defects, as well as solution turn-around time

• With users across the United States and in multiple locations across

Europe and in Japan, it is imperative that on-call assistance be available for our users who may have treaty mandated deadlines to meet and require immediate or near-term assistance.

System administration and management responsibilities for production, contingency of operations planning (COOP) site, and unclassified/training systems at the DTRA Fort Belvoir site and other, potentially remote, locations. System administration duties will include, but not be limited to:

• Creating, deleting, modifying user accounts, and resetting passwords

• Producing user reports to include contact information and e-mail lists

• Modifying user node access/permissions

• Backing up the data to external media on a regular basis

• Backing up the complete system on a periodic basis

• Performing data restores as required

• Resolving notifications and performing back-end data modifications as required

• Installing Security, Operating System, and various software application patches on a regular basis (often monthly and periodically to solve an urgent cybersecurity concern)

• Documenting all changes to the system to keep the extensive volumes of ACES documentation current and accurate.

• Communicating with users prior to any system changes that will affect system availability

• General system administration support to/coordination with COOP site personnel in support of DTRA back-up site planning, testing, and execution.

• Provide input to the DTRA Program Manager (PM) for quarterly updates to data center asset inventories.

• Coordinating with DTRA J6 DITEC (DTRA Integration, Test and Engineering Center) personnel to ensure development and testing configurations are in place to support a wide range of local and remote ACES development tasks and ACES testing.

3.2.2 The Contractor shall perform the following ACES application configuration management responsibilities:

• System Change Request (SCR) and System Problem Report (SPR) tracking, investigation, correction and management

• User documentation, system documentation, and help files maintained to be consistent with current software as per section 3.5.

• Analyze and produce ACES SCRs and SPRs documenting enhancements/fixes required due to interface changes in components and applications such as the Organization for Security and Cooperation in Europe’s (OSCE) ADS and INA, and the Navy Strategic Programs Automated Reporting Treaty Accountable Notification System (SPARTANS). Submit the SCRs and SPRs to the ACES Control Change Board (CCB)

• Data, security, and configuration management and control of the ACES system software and components

• Anticipate system and database growth and make appropriate recommendations for configuration changes

• The ACES programming team shall continue with and introduce selected Agile methodology techniques into their processes for planning, developing, integrating, and deploying new ACES code/releases.

3.2.3 Software development and deployment of enhancements/maintenance releases and patches shall be coordinated with the DTRA ACES PM. Development, releases and system patches will be directed by the DTRA ACES PM and external program interface upgrades will be coordinated with the appropriate system owners. The Contractor shall plan for the following assumptions:

• The Government anticipates having minimal maintenance releases as many actions arising from SCRs and SPRs may be planned to be addressed in the Next-Gen ACES application.

• The Government estimates that two (2) or more system patches will be installed per contract year to resolve time sensitive concerns with the system.

• The Government estimates one or two database upgrades will be required.

• Due to frequent changing cybersecurity concerns and associated risk mitigation strategies, various operating system, database or other patches may be required monthly.

• Testing and installing required software upgrades to systems and system components to include major operating system, database management, web server, firewall upgrades, minor patches, etc.

• The following STIGs will need to be addressed by the software coding staff:

o Application Security and Development o Application Server o Oracle JRE8, 9 or latest version o Red Hat JBOSS (EAP) latest version

3.2.4 Assessment and Authorization (A&A)/Cybersecurity duties and responsibilities for production, COOP site, and any other instances of the ACES application at the DTRA Fort Belvoir site and other, potentially remote, locations. Information Assurance/Cybersecurity duties will include but not be limited to:

• The Contractor shall identify qualified individuals to serve as the ACES

Information System Security Officer (ISSO) and the Information System Security Manager (ISSM) per DTRA/SCC-WMD Instruction 8500.4 Information Assurance Implementation or any future DoW/DISA guidance. The Contractor shall ensure that the ISSO, ISSM, and all privileged users have the appropriate technical training and certifications in accordance with DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management (and any future/similar DoD Directives). The Contractor shall ensure that the COR and/or the DTRA ACES PM is notified of each ISSO and ISSM’s qualifications before accessing DTRA systems. The notification may be documented in the Progress Report CDRL A005.

• Security and software upgrades and modifications as directed by the U.S.

Government to maintain A&A status / Authority to Operate (ATO) within the RMF or other DoW and/or DISA mandated methodology/tool.

• Maintain system security data in the Continuous Monitoring and Risk Scoring (CMRS) system, the Enterprise Mission Assurance Support Service (eMASS), and/or other DoW/DISA mandated information assurance applications. Complete monthly DoW information security Scorecard reports via the Enterprise Reporting System or via any similar/new reporting system/tool.

• Ensure compliance with the DoW STIGs and Information Assurance Vulnerability Alerts (IAVAs) in support of achieving and maintaining ACES ATO at the DTRA primary and back-up sites.

• Coordinate with DTRA J6 personnel to ensure all Assured Compliance Assessment Solution (ACAS) scans are completed on time and coordinate to resolve any identified vulnerabilities. The Contractor shall ensure scan results are posted to appropriate location.

• Conduct security assessment, monitoring and mitigation tasks to ensure data integrity, availability, and assurance for the system in accordance with DTRA IT infrastructure guidelines, logistics and security requirements.

• Monitor the J6 managed Cybersecurity Continuous Monitoring Dashboard and provide required artifacts, information, etc. to achieve a Green status in all areas. The contractor shall work with J6 personnel and the ACES Contracting Officer’s Representative (COR) and PM in preparing for successful reviews or audits on all Cyber Operational Readiness Assessments (CORA) or similar reviews/inspections.

• Review and provide/coordinate solutions for all applicable IA Directives (official cyber defense orders aimed at protecting DoW networks and information technology systems).

• All IA reports, such as Plan of Action and Milestone (POA&M) reports, shall be completed as scheduled by the ACES COR and PM to allow for review. The method of surveillance will be program manager monitoring.

• Respond as required to all DTRA IA/Cybersecurity taskers.

3.2.5 The Contractor shall provide the following user/data management support:

• Formal and informal user training and telephone support on ACES software in the context of arms control treaties and agreements (training at customer sites, DTRA, or contractor site).

• ACES treaty related support to DTRA Treaty Data Manager and DTRA ACES PM Team with general questions/concerns and as related to recurring treaty reporting requirements and notifications.

• Treaty data exchange reporting support, quality assurance review, and final version production support (to include reproduction of final treaty documentation for CFE/Vienna Document in December and GEMI in April.)

3.2.6 The Contractor shall provide a contract close-out and transition plan, to include:

• The Contractor shall support a 30-day transition period with the incoming contractor personnel so they can become familiar with the ACES application, servers, users, etc. As part of the transition, the contractor shall develop a comprehensive Support Transition Plan (STP) covering all aspects of the ACES O&M support as it relates to all treaties and agreements supported, system configurations, documentation locations, training materials, etc.

• The STP shall outline the location of key documentation, providing an overview of the design of ACES, describing the operational and development environments and process for migrating application releases from development to production.

• In addition to covering all areas such as software code structure, software development processes, database configuration, cybersecurity concerns, systems A&A status (to include in-depth review of the RMF controls), etc.

the STP will also clearly identify the more complex, intricate aspects of the support. For example, with several of the conventional treaties and agreements there are complex interrelationships regarding reporting thresholds and categorization/sub-categorization of equipment. The intent is for the incumbent to clearly articulate the potential areas of confusion that a new team could experience.

3.3 Next-Gen ACES user support, SME and user training support. Upon request from the contracting officer’s representative, the contractor shall provide the following support.

• Be the secondary tier of support with Next-Gen ACES user requests for assistance regarding conventional and strategic arms control automation concerns. Requests could include but not limited to equipment transactions, formal treaty reports, notification workflows, etc. but would not include any system related requests such as creating new user accounts, unlocking accounts, application performance issues, etc.

• Assistance would be strictly limited to user support and not include any assistance with manual database updates or system administration related actions.

• In coordination with the COR work with the Next-Gen ACES development contractor on executing a Module Level Transition Plan or similar formal or semi-formal document that outlines the transition of ACES Next-Gen application modules from Development Contractor Support to O&M Contractor Support. Such coordination would address user support as well as application support topics. Coordination would include participation by the O&M and Development contract CORs and possibly with a contractors designated as an engagement manager.

3.4 Other Requirements

3.4.1 Contractor Acquired Property

The Contractor shall purchase materials to satisfy operations and maintenance requirements. Such material may include license and maintenance agreements or support activities by other vendors. All materials purchased by the Contractor for the use or ownership of the Federal Government will become the property of the Federal Government. In the monthly progress report, the Contractor shall document expenses and the transfer of materials or any licenses or agreements. The Contractor must furnish evidence of having obtained three competitive quotes for like items prior to any purchases. In some instances, materials may be available from Government supply sources, including General Services Administration (GSA) schedules. When applicable, the Government will provide the Contractor authorization to use Government supply sources in accordance with Federal Acquisition Regulation (FAR) 51.101(b). Any hardware or software purchases will follow the provisions of the FY 2012 NDAA. The 2012 NDAA prohibits programs from obligating funds for a data center, or any information systems hardware and software used therein or specifically for the operation and administration of a data center, without explicit approval from the DoW CIO. The contractor shall assist the PM in developing the requisite documentation to obtain both DTRA and DoW CIO approval.

All material purchases must be approved by the DTRA COR in writing. Notwithstanding the DTRA COR’s approval of material or equipment purchases, the Contractor may not exceed the value on the contract.

3.4.2 Process Execution

The government desires that the performing business unit be certified at Capability Maturity Model Integrated (CMMI) level 3, as a minimum.

3.4.3 Fielding Activities

Support IV&V, deployment, and training activities and schedules.

3.4.4 Required Training

In addition to training required per DoW and DTRA Directive(s)/Instructions by certain personnel in various cybersecurity/Assessment and Authorization (A&A) positions, all contract personnel with access to any DTRA/DISA networks will be required to complete various initial and refresher training courses as directed by DTRA and outlined below. The contactors will use the Learning Management System (LMS) to register, track, and complete the courses. Some courses may be offered in-person only at DTRA Fort Belvoir.

The five courses/topics below will be assigned to contractors in LMS.

1. Antiterrorism Level I (Initial and Refresher) - Initial Classroom requirement due 90 days from assignment and the online refresher due every year thereafter (365 days after initial classroom completion, and then 365 days after each completion of the refresher)

2. Information Security (INFOSEC) (Initial and Refresher) - Initial Classroom requirement due 90 days from assignment and the online refresher due every year thereafter (365 days after initial classroom completion, and then 365 days after each completion of the refresher)

3. Operations Security (OPSEC) (Initial and Refresher) - Initial Classroom requirement due 90 days from assignment and the online refresher due every year thereafter (365 days after initial classroom completion, and then 365 days after each completion of the refresher)

4. Cyber Awareness Challenge - Online training due 90 days from assignment and every year thereafter (365 days after completion)

5. Sensitive Compartmented Information (SCI) Annual Refresher - Online training due 60 days from assignment and every year thereafter (365 days after completion) for TS/SCI personnel (Level 6 Badge holders)

In all cases the initial due date only applies for those who have not yet met the initial training requirement. If the initial requirement has already been met, the due date is set to 365 days from their last completion.

3.5 Deliverables

The contractor shall provide the deliverables outlined below.

3.5.1 ACES O&M Monthly Performance and Cost Report (A015)

Performance Data:

The Contractor shall provide a summary of activities accomplished during the reporting period, status of ongoing actions, and projected activities for the next reporting period (meetings, travel, etc.).

Planning Data:

The Contractor shall provide a summary of planned activities within a twelve-month window to include such activities as:

• Hardware and software updates, patches, and releases (description and expected dates)

• Planned Outages

• Purchases – Planned Training, Planned Documentation updates, and other planned activities e.g., meetings, CCBs, working groups, etc.

Cost Data:

The Contractor shall provide a monthly cost report in the following format:

1. Incurred costs, cumulative costs, status of funds, purchase of materials, etc.

2. Number of hours worked, hourly rate, and overall cost for each individual performing work on the contract

3. Number of hours for individuals should be further broken down by activity – o Requirements Analysis o Development o Testing/Verification and Validation o Work on specific CDRLs o Other categories as appropriate

Risk Data:

The Contractor shall provide a listing of all program risks for all areas of the program to include technical, mechanical, security, resources, etc. Each risk shall contain a recommended mitigation strategy and timeline.

3.5.2 Technical and User Documentation Deliverables

The intent of the O&M technical and user documentation effort (specific deliverables detailed in the table below) is to update as necessary and maintain the documentation to be consistent with the current level of the released software. Note, several of the documents are very technically detailed and lengthy, the requirement is to keep all documentation current as various software releases may impact the documentation.

The contractor shall provide electronic versions of each CDRL specified in the following table, using the appropriate format as approved by the Program Manager.

The documents from the previous contract will be provided to the Contractor as Government Furnished Information. DTRA will share the documents with the Contractor upon award of this contract or soon thereafter. The documents will be posted on an internal SharePoint site or as otherwise arranged by the DTRA PM.

CDRL

Product Title Delivery

A001 System Requirements Specification (SyRS) Provided to the COR

/Software Requirements Specification (SRS) Document reviewed and updated to be consistent with the current software version The SyRS must document the overall system structure, list the requirements for system capabilities, conditions, and constraints, and describe the system interfaces and the system interface requirements for ACES The SRS must document the baseline software requirements and their allocation to developmental software configuration items for use in the design, development, deployment, operations and maintenance, and support of ACES.

within 30 days of any software release that impacts or relates to requirements.

A002 Version Description Document (VDD) Document reviewed and updated to be consistent with the current software version The VDD must document the content of the associated release to include system enhancements as well as defect corrections.

Provided to the COR within 30 days of any software release.

A003 Configuration Management Plan (CMP) Document reviewed and updated. Manage configuration items throughout the program in accordance with the plan.

The CMP must define configuration management standards and responsibilities for ACES including the technical and administrative methods employed in the project for implementing, tracking, and controlling work products.

Provided to the COR within 30 days of any changes to configuration management standards and responsibilities.

A004 System Security Plan (SSP) Document reviewed and updated. Support the implementation and test of security features in accordance with the security requirements established in the SyRS.

The SSP must document DoW RMF Process supporting security A&A of ACES.

Provided to the COR within 30 days of any changes to configuration management standards and responsibilities.

A005 Monthly Performance and Cost Report Document the activities accomplished during the reporting period, status of ongoing actions, projected activities for the next reporting period, incurred costs, cumulative costs, status of funds, purchase of materials, transfer of materials to the Government, cost and technical status including earned value reporting, planning information, status of on-going concerns and any other issues/concerns for ACES, as well as any other pertinent information at a level designated by DTRA as described in SOW section 5.1.1.

Delivered to PM monthly by the tenth business day of the next month.

A006 Source Code Provide Source Code after each interim release.

Delivered to PM within 30 days of each ACES release in which ACES code was changed.

A007 Help Content Material reviewed and updated to be consistent with the current software version. The Help Content must provide user guidance, available within the ACES application, on the use of the system.

Help content updated within ACES application within 30 days of each release.

A008 Continuity of Operations Plan (COOP) Document reviewed and updated.

The COOP must document the overall ACES availability and recovery strategy, discuss COOP policies and procedures, and provide instructions for system failover and restoration of service.

Provided to the COR within 30 days of contract award.

A009 Support Transition Plan (to complement a 60-day transition period to a potential new performer or hand-off to the Next-Gen ACES contractor)

Provided to the PM 180 days prior to contract end date.

A010 Government Property Inventory Report Report provided within 30 days of contract award.

A011 Government Furnished Property (GFP) Report Provided Annually at the end of the PoP.

The contractor shall deliver all products for review and acceptance by the Government;

the government will have ten (10) business days to conduct its review of completed products. On receipt of comments, the contractor shall have ten (10) business days to prepare revisions and to submit and post final versions of the products.

3.6 Key Personnel

The following position is considered key personnel.

Program Manager – Experience managing mid-size software development and operations and maintenance efforts. Knowledge of the conventional and strategic arms control treaties and agreements supported and of the ACES framework and tools. Accordingly, prior to substituting the Contractor Program Manager, the Contractor shall notify the DTRA COR as soon as it becomes aware of the possibility of a change in personnel. The Contractor shall also notify the DTRA of any replacement personnel and demonstrate that the incoming Contractor PM has the requisite skills to manage this effort.

3.6.1 Other Personnel

The following positions are not considered key personnel but shall meet the stated qualifications.

Subject Matter Expert – Extensive knowledge of the ACES application and how it supports the various treaties and agreements. Extensive knowledge of the ACES supported conventional and strategic arms control treaties and agreements and a solid understanding of the roles, responsibilities and organizational structure of our customers.

Senior Applications Developer – Extensive knowledge of the ACES programming frameworks and tools to include Java, JBoss, Enterprise Java Bean (EJB), XML, and Web Services. Extensive knowledge how ACES supports the various treaties and agreements and of the conventional and strategic treaties and agreements and a solid understanding of the roles, responsibilities and organizational structure of our customers

Senior Systems Administrator – Extensive experience with the Linux operating systems, the NIST RMF, the use of eMASS, and experience with Microsoft Exchange email.

3.7 Travel

Contractor shall provide a detailed estimate of any required travel:

• All travel shall be approved by the COR in writing via memorandum or email prior to the Contractor incurring any travel expenses prior to any departure.

Short-notice trips may be approved verbally, with e-mail follow-up immediately thereafter. Contractor may be required to travel to multiple locations throughout the National Capital Region (NCR), Continental United States (CONUS) and Outside of Continental United States (OCONUS) during the performance of this contract.

• Local travel to and from their corporate office or to/from DTRA Ft. Belvoir or

DTRA Dulles shall not be reimbursed.

• Any required travel to and from customer locations in the Washington D.C.

metro area shall be reimbursed at cost with no fee.

• Travel may include two (2) customer site trips per year to various military sites in Germany (any travel between sites will be via land – either government provided rental, or contractor rented vehicle). Military sites visited would likely be EUCOM Headquarters (Stuttgart), USAREUR-AF HQ (Wiesbaden), and USAFE HQ (Ramstein). Germany trips will be for four nights in Germany with a day each of travel to and from. Both Germany trips would be for one or possibly two people.

3.8 Security Requirements

DoD Contract Security Classification Specifications Requirements DD Form 254:

Contractor personnel performing work under this contract must be U.S. citizens and require a minimum of a DoD Secret Clearance at the time of the proposal submission and shall maintain the level of security required in order to provide the required support.

3.9 Place of Performance

The place of performance will be primarily at the contractor facility (or telework location(s) per contractor guidance) and periodically at the Defense Threat Reduction Center (DTRC) on Fort Belvoir. When on-site at the DTRC, there will be workstations in the Global Threat Reduction (GT) Directorate allocated for ACES contractor personnel working on this contract. Occasionally, as available, work may also be performed at the DTRA Dulles Airport office location where there will be unclassified and classified workstations available as well.

3.10 Section 508

This requirement is exempt from ICT accessibility standards due to the nature of the military mission it supports and due to the planned decommissioning of the system in the coming years because of the on-going development of the Next-Gen ACES system.

3.11 Government Furnished Property and/or Equipment (GFP/GFE)

The Contractor shall be provided GFP. There will be some GFP transferred from the current contract. The Contractor shall submit a GFP and CAP inventory report in accordance with CDRL A011.