Attach 3 Sample SON 1 E-Exam 3.docx

FA3002-10-R-0045

Attachment 3

AIR UNIVERSITY

AIR EDUCATION & TRAINING COMMAND (AETC)

STATEMENT OF NEED (SON)PERFORMANCE WORK STATEMENT (PWS) ADDENDUM

FOR

SYSTEM ACCREDITATION OF E-EXAM (VERSION 3)

29 JANUARY 2010

1.0 DESCRIPTION OF NEEDTASK ORDER SERVICES:

1.1 Headquarters Air University Director of Education Logistics and Communications (AU/A4/6) requires contractor support to complete the certification and accreditation of E-exam version 3 under the Air Force implementation of DoD Information Assurance Certification and Accreditation Process (DIACAP), to include all requirements pertaining to the Security, Interoperability, Sustainability, Supportability, and Usability (SISSU) process to obtain Approvals to Operate (ATO) and Authorities to Connect (ATC). The contractor will require access to the Enterprise Information Technology Database Repository (EITDR) which requires a minimum of a national agency check (NAC).

2.0 GENERAL DESCRIPTION OF AETC ATOs AND ATCs.

2.1 E-exam is a Government off-the-shelf (GOTS) computer-based testing system used to administer proctored course examinations to students. E-exam version 2 has been used since 2004 to administer tests to enlisted Airman enrolled in Career Development Courses (CDCs) as a mandatory component for upgrade training to the 5 and 7 skill level. It has also been used by enlisted and commissioned Airmen enrolled in Professional Military Education (PME) distance learning programs. The E-exam application (CD-ROM) is mailed to and installed/configured locally at test control facilities in standalone mode (single PC) or network configurations (multiple PCs). Test updates are downloaded and imported by testing facilities on a bi-monthly basis. Student testing data is batched using a separate application (Answer Sheet Manager) and then sent to HQ AU using a web upload site. Received data is processed by the backend piece of the program (E-exam Data Manager) which is installed on a server at Maxwell AFB and the data is routed to the Course Development Student Administration Registrar (CDSAR)CDSAR and/or the Air University Student Information System (AUSIS) AUSIS for updating student records. The E-exam Data Manager program produces test item analysis reports and test item challenge exports on an automatic and as-needed basis. To ensure tests are not compromised, the E-exam program is password protected, is fully encrypted, and utilizes profile-specific access (managers, students, etc.). The E-exam program is installed at over 600 Air University testing locations worldwide ([421 AF, 66 Army, 51 Navy, 13 Marine, and 3 Coast Guard (including deployed locations)]) and approximately 16,000 E-exam tests are administered per month. Updates made to E-exam version 3 make the program compliant with Federal Desktop Core Configuration (FDCC-AF) as mandated by the Air Force Enterprise Configuration Management Office (AFECMO) and offer significant enhancements to proctors, students, and test owners.

2.2 AETC ATOs and ATCs consist of the following components:

2.2.1 Authority to Operate (ATO) for E-exam version 3: Provide type accreditation under DIACAP for E-exam version 3 and Answer Sheet Manager version 7 to be installed at all designated Department of Defense education and training testing facilities. This approval will also include the E-exam Data Manager program that is installed and operated exclusively by HQ Air University at Maxwell AFB and Gunter Annex which receives and processes student test data received from field testing locations. Provide Approval to Operate according to Air Force Policy Directive 33-2, Information Assurance Program. This includes all documentation, coordination, and implementation required to operate on government networks.

2.2.2 Authority to Connect (ATC) for E-exam version 3: Provide type accreditation under DIACAP and SISSU sub-processes for computers used to administer course exams using E-exam version 3 and computers used to batch test data using Answer Sheet Manager version 7 to connect to the Air Force GIG and . Also for computers using E-exam Data Manager to connect to the Air Force GIG. Provide Authority to Connect according to Air Force Policy Directive 33-2, Information Assurance Program. This includes all documentation, coordination, and implementation required to operate on government networks.

3.0 SCOPE/DELIVERABLES:

3.1 Contractor will complete the C&A of E-exam version 3, Answer Sheet Manager version 7, and E-exam Data Manager to include all requirements pertaining to the SISSU process to obtain ATOs and ATCs as appropriate.

3.2 The contractor will develop and maintain documentation that meets or exceeds DoD Information Security requirements for system deliverables IAW DoDI 8510.01 DIACAP, AFI 33-202, Network and Computer Security Vol. 1, and Identity Management Vol. 6, and AF IT Lean Guidebook v5.07 (or later) including the 4first three phases activities (Define Need, Design, and Build and Test and Release/Support).

3.3 The contractor shall execute and update a Security Implementation Plan (SIP), conduct validation activities, and compile validation results in EITDR to retrieve a DIACAP scorecard. During the period of performance the contractor shall develop a Plan of Action and Milestones (POA&M) IAW DODI 8500.2.

3.4 The contractor shall provide an Information Support Plan (ISP) and related services. This shall include conducting initial certification tasks, periodic review of security configurations, and reviewing policy and procedure changes. The contractor shall complete the DIACAP Implementation Plan, answer all applicable IA controls, create and/or complete required security artifacts to include but not limited to the architectural framework views and upload into the EITDR system.

3.5 The contractor shall provide support required to achieve Federal Information System Management Act (FISMA) validation. FISMA support will be provided by the contractor to satisfy quarterly and annual reporting guidance requirements in accordance with the Air Force Chief Information Officer (CIO) 7 April 2007 memo and subsequent released guidance. FISMA requirements listed in this memorandum shall meet or exceed minimum standards as required by the program manager/system owner or the Quality Assurance Personnel (QAP). Cooperation between the contractor and the system owner shall ensure the appropriate FISMA questions in EITDR are answered and meet minimum solution requirements listed within the database. FISMA minimum requirements must be met or an appropriate Plan of Action and Milestones (POA&M) schedule shall be produced if it should fail.

3.6 The contractor shall work/coordinate with representatives from Air University and AETC and HQ Air Force Network Integration Center Air Force Communications Agency (AFCANIC) in obtaining information/documentation required for the completion of the C&A documentation required for receiving ATOs and ATCs from AFNICCA and Air Force Network Operations (AFNetOPs).

3.7 The contractor shall support the HQ AU E-exam program manager in responding to any questions, attending meetings, and/or any other activities/tasks facilitating the development of the C&A documentation to include travel for testing and evaluation. Trip reports and/or meeting minutes detailing formal interactions will be required and supplied by the contractor, and included in a Monthly Status Report.

3.8 The contractor shall provide a schedule for completion of all tasks/activities required for receiving the ATO and ATC within five business days of contract. Due to the urgency in getting the DIACAP completed, the contractor is requested to base timelines on minimum time required to complete. The ATO and ATC are required NLT 1 May 2010.

4.0 GENERAL/AMINISTRATIVE INFORMATION

4.1 For additional information, please contact:

Douglas McCarty, DSN 596-3622, HYPERLINK "mailto:e-exam@maxwell.af.mil"e-exam@maxwell.af.mil Natalia Davenport, DSN 596-4367, HYPERLINK "mailto:Natalia.davenport@maxwell.af.mil"Natalia.davenport@maxwell.af.mil