PWS_AFFIRST_27_Dec_17.pdf

PERFORMANCE WORK STATEMENT (PWS)

Air Force Family Integrated Results & Statistical Tracking (AFFIRST)

PART 1

GENERAL INFORMATION

1. General Information: This is a non-personnel services contract for Air Force Family Integrated Results & Statistical Tracking (AFFIRST). The government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn, is responsible to the government.

1.1. Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, tools, materials, supervision, and other items and non-personal services necessary to perform AFFIRST requirements as defined in this PWS except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract. The contractor shall have access to Xtendable Server software license in order to successfully meet the requirements of this PWS as AFFIRST is developed against this software platform.

1.2 Background: The Air Force Personnel Center (AFPC), Joint Base San Antonio (JBSA) Randolph, TX under the direction and control of the Chief, Airman and Family Division (AFPC/DPFF), is responsible for providing a viable, outcome based, customer case management system for field Airman, Family Readiness Centers (A&FRC). AFFIRST is a web-based, data gathering, service delivery system that provides timely information about daily activities, outcome-based results (readiness and retention), and return on investment of A&FRC services throughout the Air Force (AF). The system is used by all A&FRC Staffs, MAJCOM, AFPC, and Air Staff counterparts.

1.3 Objective: The purpose of this PWS is to obtain hosting (load/maintain the web-based AFFIRST application on network servers to be accessible by Active Duty, Guard and Reserve installation A&FRC and Higher Headquarters users), required maintenance, technical support, and system enhancements needed to provide effective use of the AFFIRST management information system currently used by all field A&FRCs since the spring of 2004.

1.3.1 AFFIRST availability should normally be uninterrupted, however some unforeseen interruptions such as network, power, etc., could occur and expect the contractor system administrators to respond and mitigate them to ensure interruptions in system availability are minimized.

1.4 Scope: The contractor shall provide uninterrupted hosting (implement backup hosting system when regular system goes down), maintenance, technical support, and enhancement services in support of the AFFIRST System. To ensure successful implementation of the scope of this requirement, the Contactor shall have an in-depth knowledge of the Xtendable software coding platform that AFFIRST is developed on and general knowledge of the A&FRC mission and methods of service delivery. These requirements are critical as the system is in the midst of a re-design that will remove the need for the current Xtendable based platform by re-coding the program using "Open Source" programming techniques. This will also drive a system Information and Assurance (IA) re-Certification & Accreditation (C&A) requirement/effort which will again require the contractor to have an in-depth knowledge of the system architecture, hosting and security requirements based on how AFFIRST is currently configured/hosted and the new "open source" configuration hosting requirements.

1.5 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and one

(1) 12-month option year.

1.6 General Information

1.6.1 Quality Control: The contractor shall be responsible for establishing, implementing, and maintaining a current QCP. The contractor’s QCP will identify the standards, processes, procedures, and checklists for all tasks performed. The plan shall become a compliance document after acceptance by the CO upon contract award. The contractor shall monitor quality processes and perform technical audits and reviews in accordance with the QCP to verify adherence to organizational standards, processes, and procedures. Changes to the QCP during contract performance shall be submitted to the CO for acceptance not later than 10 business days prior to implementation. The Contractor shall establish and provide a qualified workforce capable of performing the required tasks. The Contractor shall monitor work performance, measure results, ensure delivery of contracted product deliverables and solutions, support management and decision-making and facilitate communications. The Contractor shall ensure that instances of misinformation or inaccurate answers identified by the Government (via evaluation or customer feedback) are addressed. Upon being notified of an instance of misinformation or an inaccurate answer provided to a customer, the Contractor shall have 5 business days to submit a Misinformation Report (Attachment 4) to both the COR and the Contracting Officer detailing the actions taken to correct the cause and provide the correct answer to the customer.

The Contractor's quality inspection documentation (i.e., metrics, reports, etc.) shall be made available to the COR or CO with two (2) business days after request, if requested. The reports should provide information on the methods of inspection, what was inspected, discrepancies found, and actions taken to correct and preclude recurrence.

1.6.2 Quality Assurance (QA): The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not required to perform services on the below listed holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 7:30 a.m. and 4:30p.m. Central Standard Time, Monday thru Friday, except Federal holidays or when the government facility is closed due to local or national emergencies, administrative closings, or similar government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: The work to be performed under this contract will be performed at the contractor’s facility.

1.6.6 Security Requirements:

1.6.6.1 Pass and Identification Items. The Host Unit shall ensure the following pass and identification items required for contract performance are obtained for employees and non-government owned vehicles:

a. Installation Access Pass (IAP) (DBIDS), Visitor/Vehicle Pass (AFI 31-113), used for contracts for less than one year to include one-day visits (i.e. warranty work).

b. Installation Access Card (IAC) (DBIDS), Civilian Identification Card (AFI 31-113), used for contracts for more than one year or more which do not require access to controlled areas or government computer systems.

c. Department of Defense (DoD) Common Access Card (CAC), (AFI 36-3026), used for contracts for more than one year and a requirement exists for access to the government computer systems and software. CAC applications are accomplished by Trusted Agents via the Trusted Agent Sponsorship System (TASS).

1.6.6.2. Suitability Investigations. For IT-Level III contractor personnel shall complete, as a minimum, a Tier 1 background investigation (formerly known as a NACI), before being issued a CAC and operating government furnished workstations. The contractor shall comply with the DoD 5200.2-R, Personnel Security Program, AFMAN 33-152, User Responsibilities and Guidance for Information Systems, and AFI 33-200, Cybersecurity Program Management, requirements. Tier 1 investigations requests are initiated using the Standard Form (SF) 85 and are submitted to the installation Information Protection Office through the using agency’s Unit Security Manager within five days of contract start. Tier 1 investigations are provided by the government at no additional cost to the contractor.

1.6.6.3 Listing of Employees. The contractor shall maintain a current listing of employees. The list shall include employee's name, social security number, and date of investigation if service work involves unescorted entry to AF restricted or other sensitive areas designated by the installation commander. The list shall be validated and signed by the company supervisor, and provided to the CO prior to the contract start date.

Updated listings shall be provided when an employee's status or information changes.

1.6.6.4 Freedom of Information Act Program (FOIA). The contractor shall comply with DoD Regulation 5400.7-R/AF Supplement, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material. The contractor shall comply with AFI 33-332, AF Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall remove or destroy official records only in accordance with AFMAN 33-363, Management of Records, or other directives authorized in AFI 33-364, Records Disposition—Procedures and Responsibilities.

1.6.6.5 Reporting Requirements. The contractor shall comply with AFI 71-101, Volume- 1, Criminal Investigations, and Volume-2, Protective Service Matters, requirements. Contractor personnel shall report to an appropriate authority, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information.

Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

1.6.6.6 Additional Security Requirements. In accordance with DoDM 5200.01 and AFI 16-1404, Air Force Information Security Program, the contractor shall comply with AFMAN 33-152, User Responsibilities and Guidance for Information Systems ; AFI 33-200, Cybersecurity Program Management; applicable AFKAGs, AFIs, and AFSSIs for Communication Security (COMSEC); and AFI 10-701, Operations Security (OPSEC).

The contractor will comply with DoD Standard 22/Force Protection Condition Measures, DoD Standard 25/Level I-AT Awareness Training, and associated tasking contained in AFI 10-245, Antiterrorism (AT) standards. Level I AT Awareness training is available for contractor personnel and can be requested by calling installation Antiterrorism Office.

1.6.7 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, Contracting Officer’s Representative (COR), and other government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.8 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract:

perform inspections necessary in connection with contract performance: maintain written and oral communications with the contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including government drawings, designs, specifications: monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.9 Contractor Travel: Contractor will be required to travel to JBSA-Randolph one time during the performance of this contract to meet with the COR at a mutually agreeable time/date. The contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires government approval/authorization and notification to the COR. The travel shall not exceed $5,000.00 dollars

1.6.10 Other Direct Costs: N/A

1.6.11 Data Rights: The government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be government owned and are the property of the government with all rights and privileges of ownership/copyright belonging exclusively to the government. These documents and materials may not be used or sold by the contractor without written permission from the CO. All materials supplied to the government shall be the sole property of the government and may not be used for any other purpose. This right does not abrogate any other government rights.

PART 2

DEFINITIONS & ACRONYMS

2. Definitions and Acronyms:

2.1 Definitions

2.1.1 Contractor. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2 Contracting Officer. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3 Contracting Officer’s Representative (COR). An employee of the U.S. Government appointed by the CO to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4 Defective Service. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5 Deliverable. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6 Key Personnel. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7 Physical Security. Actions that prevent the loss or damage of government property.

2.1.8 Quality Assurance. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9 Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10 Quality Control. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11 Subcontractor. One that enters into a contract with a prime contractor. The government does not have privity of contract with the subcontractor.

2.1.12 Work Day. The number of hours per day the contractor provides services in accordance with the contract.

2.1.12 Work Week. Monday through Friday, unless specified otherwise.

2.2 Acronyms:

ACOR Alternate Contracting Officer's Representative AFARS Army Federal Acquisition Regulation Supplement AFFIRST Air Force Family Integrated Results & Statistical Tracking (AFFIRST) AFPC Air Force Personnel Center A&FRC Airman & Family Readiness Center AR Army Regulation ATT Application Transition Tool C&A Certification & Accreditation CCE Contracting Center of Excellence CFR Code of Federal Regulations CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DMDC Defense Manpower Data Center DOD Department of Defense eMASS Enterprise Mission Assurance Support Service FAR Federal Acquisition Regulation HIPAA Health Insurance Portability and Accountability Act of 1996 IATT Interim Authority to Test KO/CO Contracting Officer OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RMF Risk Management Framework TE Technical Exhibit

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. Government Furnished Items and Services:

3.1 Services: N/A

3.2 Facilities: N/A

3.3 Utilities: N/A

3.4 Equipment: The government will provide a laptop to the contractor with VPN access to an AF Network domain for the purpose of accessing the Enterprise Mission Assurance Support Service (eMASS) system (eMASS must be accessed from a .Mil network domain) to document C&A actions.

3.5 Materials: N/A

PART 4

SPECIFIC TASKS

4. Specific Tasks:

4.1 The contractor shall provide overall system administration support and system security which entails monitoring and facilitating website availability and application responsiveness, maintenance and technical support for the AFFIRST system that includes the following:

4.1.1 Monitoring and facilitating system availability and responsiveness: The contractor shall monitor the system on a daily basis using the contractor’s automated network system performance monitoring tools to ensure maximum application availability and responsiveness. Responsiveness shall be monitored every three minutes. Should a possible issue be detected, tests shall commence to run every minute until it is determined that the system is responding correctly. The contractor shall provide a monthly report to the COR that indicates network server uptime for the subject period. The contractor shall also ensure that servers, associated storage systems, and peripheral equipment are operational, and systems are backed up on a daily basis and restored when necessary. Should a possible issue be detected and the irregularity/system error persist for greater than five minutes to initiate corrective action, the contractor shall notify their system administrators in person, by telephone or by e-mail.

4.1.2 The contractor shall respond to application bug fixes (i.e., security patches, system error codes, etc.) and system enhancement inquiries through the system and support AFFIRST users with any other system issues (i.e., user locked out of system, application errors, data errors) encountered within 24 hours.

4.1.3 The contractor shall provide help desk point of contacts within five work days after contract award to the the Contracting Officer via email to handle system problem (application bugs, system interruptions, etc.)

reports, answer questions, and provide telephone assistance and troubleshooting.

4.1.4 The contractor shall on a daily basis review/analyze AFFIRST Feedback management system for system issues/problems and network server/system error logs and, when necessary, design, develop, and deploy the appropriate solution to correct problems within 24 hours, or for more complex issues provide an estimated date of completion to the to the COR within 48 hours

4.1.5 The contractor shall conduct system testing within 24 hours of application bug fixes/enhancements to ensure the solution developed corrects the identified problem.

4.1.6 The contractor shall conduct beta testing support to facilitate in-depth testing of the proposed solutions prior to implementing the solution on the production system. The COR must approve all proposed solutions prior to implementation on production servers. Approval/disapproval will be provided within 3 work days from receipt of proposal.

4.1.7 The contractor shall have 125 system maintenance hours per month (unused maintenance hours roll over the following month and so forth) to cover unforeseen changes to the system that are identified during the performance period.

4.1.8 Maintenance and technical support includes two (normally two work day) site visits to AFPC/DPFF during contract performance period to discuss status of maintenance, technical and enhancement issues and provide demonstrations of AFFIRST enhancements under development. The contractor shall coordinate with COR and AFPC/DPFF IT Team Chief to schedule dates and times of site visits at least 30 calendar days prior to visit.

4.2 The contractor shall work with the COR to transition hosting AFFIRST from the current hosting facility in San Diego, CA, to the government contracted Cloud Hosting (GovCloud) hosting environment. This includes the following tasks:

4.2.1 The contractor shall assist the COR with completing necessary migration technical documentation for entry into the 13 task areas of the Application Transition Tool (ATT) Cloud Migration checklist database. Note:

Much of this documentation can be derived from the existing C&A documentation required by this PWS.

4.2.2 The contractor shall provide the core Interim Authority to Test (IATT) artifacts required to test the application in the GovCloud test environment. Note: Much of this documentation can be derived from the existing C&A documentation required by this PWS.

4.2.3 Provide support to the COR and GovCloud technical POCs in installing and testing AFFIRST in the GovCloud test environment.

4.2.4 The contractor shall make necessary changes to the AFFIRST architecture/code as a result of testing the system in the GovCloud test environment to ensure successful operation in the cloud.

4.2.5 The contractor shall assist in initial AFFIRST application migration and final migration actions.

4.3 The contractor shall accomplish the following Assessment and Authorization (A&A)/Software Certification tasks in order to secure/maintain an approved Authority to Operate (ATO):

4.3.1 DoD has mandated the transition from the current DoD Information Assurance Certification and Accreditation Program (DIACAP) C&A process to the Risk Management Framework (RMF) A&A process based on National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems, and NIST SP 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations (NIST Publications: www.CSRC.NIST.gov/publications), or most current version. The AF is complying and has implemented the change in accordance with the DoD identified 1 Oct 2016 date for this transition to take full effect. Therefore, there will be a period of time where both the DIACAP C&A and RMF A&A processes will be required during the transition period from the DIACAP C&A and RMF A&A processes that will fully transition by 1 Oct 2016. This will be required due to the continuation of DIACAP support for systems already at Step 2, Implement & Validate Assigned IA Controls, when the transition is put into effect. As the AF transitions to the Risk Management Framework (RMF), performance of tasks as identified in paragraph 5.3.2.6 and its subparagraphs below will be required.

4.3.2 Project Management. The level of effort required shall depend on: (a) the size and complexity of the information system; (b) the security category of the system; (c) the security controls employed to protect the system; and (d) the specific methods and procedures used to assess the security controls in the system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system in accordance with the latest guidance governing the DIACAP C&A process AFI 33-210, AF Certification & Accreditation (C&A) Program (AFCAP) (http://www.e-publishing.af.mil), RMF A&A process, and AF and DoD accepted software certification processes. The contractor shall:

4.3.2.1 Provide a project plan template within 7 business days following contract award in sufficient detail for conducting information system security C&A /A&A tasks (to include annual security assessments/reviews) and software certification to accurately track progress and shall include, but is not limited to, specific tasks, milestones, and delivery schedule. Meet delivery schedule or coordinated tasked suspense’s with no more than 3 errors.

http://www.csrc.nist.gov/publications

4.3.2.2 Make corrections and updates to the project plan weekly showing both the estimated completion date of each required task along with the actual percentage of each task completed to date.

4.3.2.3 Hold and/or attend initial task kick-off meetings and weekly meetings as required by the government representative to present project status.

4.3.2.4 Provide a monthly status report on the current activities . The report is due 7 business days following end of the month. The report shall include, but is not limited to:

4.3.2.5.1 List of status and estimated completion date.

4.3.2.5.2 Major issues affecting system accreditation and/or authorization and software certification with description, impact and recommended solution.

5.3.2.5.3 Any changes to requirements with description of issues that impact ability to execute/perform responsibilities as outlined.

4.3.2.5.4 Any conflict of interests and mitigation efforts/plans that impact ability to execute/perform responsibilities as outlined.

4.3.2.2.5 Hold and/or attend program reviews monthly to present monthly status report.

4.3.2.6 Certification and Accreditation (C&A) Support (DIACAP). Meet delivery schedule or coordinated tasked suspense’s with no more than 3 revisions to documents reporting changes to the AO to support a C&A or A&A decision. For continued DIACAP C&A support the contractor shall:

4.3.2.6.1 Complete actions associated with the initiation phase consisting of three tasks: (a) preparation; (b) notification and resource identification; and (c) system security plan analysis, update, and acceptance. The purpose of this phase is to ensure that the AFPOA Information System Owner (ISO) and AFPOA Information System Security Manager (ISSM) are in agreement with the contents of the system security plan, including the system’s documented security requirements, before the Security Control Assessor (SCA) begins the assessment of the security controls in the information system.

4.3.2.6.1.1 Confirm the information system has been fully described and the security controls (either planned or implemented) for the information system have been documented in the system security plan or equivalent document.

4.3.2.6.1.2 Confirm the potential threats that could exploit information system flaws or weaknesses, and that flaws or weaknesses in the information system that could be exploited by potential threat sources have been identified and documented in the system security plan, risk assessment, or equivalent document.

4.3.2.6.1.3 Confirm the risk to operations, assets, or individuals has been determined and documented in the system security plan, risk assessment, or an equivalent document.

4.3.2.6.1.4 Document assigned impact values with respect to the potential loss of confidentiality, integrity, and availability consistent with actual mission requirements.

4.3.2.6.1.5 Document identified vulnerabilities in the information system and the resulting risk to operations, assets, or individuals. Update the system security plan based on the results of analysis and findings and make recommendation(s), if appropriate.

4.3.2.6.2 The security certification phase consists of two tasks: (a) security control assessment (SCA); and (b) security certification documentation. The purpose of this phase is to determine the extent to which the security controls in the information system are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. This phase also addresses specific actions taken or planned to correct deficiencies in the security controls and to reduce or eliminate known vulnerabilities in the information system. Upon successful completion of the phase, the AF Authorizing Official (AO) shall have the information needed from the security certification to determine the risk to operations, assets, or individuals – and thus, shall be able to render an appropriate security accreditation decision for the information system. The contractor shall:

4.3.2.6.2.1 Develop cybersecurity-related documentation and assemble any other required documentation and supporting materials necessary for the assessment of the security controls in the information system, to include previous assessment of security controls, review the findings, results, and evidence.

4.3.2.6.2.2 Assist in the selection of appropriate methods and procedures to assess the management, operational, and technical security controls in the information system.

4.3.2.6.2.3 Prepare the final Security Assessment Report (SAR).

4.3.2.6.3 Update the system security plan and risk assessment based on the results of the security assessment and any modifications to the security controls in the information system.

4.3.2.6.4 Develop and prepare the Plan of Action and Milestones (POA&M) based on the results of the security assessment.

4.3.2.6.5 Develop and assemble the final security accreditation package and submit to the SCA after Program Manager (PM), AFPOA ISSM & ISO coordination.

4.3.2.6.6 The security accreditation phase consists of two tasks: (a) security accreditation decision; and (b) security accreditation documentation. The purpose of this phase is to determine if the remaining known vulnerabilities in the information system (after the implementation of an agreed-upon set of security controls) pose an acceptable level of risk to operations, assets, or individuals. Upon successful completion of this phase, the ISO shall have; (a) authorization to operate (ATO) the information system; (b) an interim authorization to operate (IATO) the information system under specific terms and conditions; or (c) denial of authorization (DATO) to operate the information system. The contractor shall:

4.3.2.6.6.1 Develop cybersecurity-related documentation and assemble any other required documentation and supporting materials necessary for the assessment of the security controls in the information system; if these documents include previous assessment of security controls, review the findings, results, and evidence.

4.3.2.6.6.2 Assist in the selection of appropriate methods and procedures to assess the management, operational, and technical security controls in the information system.

4.3.2.6.6.3 Prepare the final security assessment report.

4.3.2.6.6.4 Update the system security plan (and risk assessment) based on the results of the security assessment, any modifications to the security controls in the information system and the final determination of risk to operations, assets, or individual.

4.3.2.6.7 The continuous monitoring phase consists of three tasks: (a) configuration management and control;

(b) security control monitoring; and (c) status reporting and documentation. The purpose of this phase is to provide oversight and monitoring of the security controls in the information system on an ongoing basis and to inform the authorizing official when changes occur that may impact the security of the system. Documenting information system changes and assessing the potential impact those changes may have on the security of the system is an essential aspect of continuous monitoring and maintaining the security accreditation. The activities in this phase are performed continuously throughout the life cycle of the information system. Reaccreditation occurs when there are significant changes to the information system affecting the security of the system or periodically in accordance with Federal, DoD, AF and AFPOA policy. The contractor shall:

4.3.2.6.7.1 Inform the Program Manager, AFPOA Information System Owner (ISO) and AFPOA Information System Security Manager (ISSM) the information system requires security certification and accreditation support.

4.3.2.6.7.2 Use established configuration and control procedures to document proposed or actual changes to the information system (including hardware, software, firmware, and surrounding environment).

4.3.2.6.7.3 Analyze the proposed or actual changes to the information system (including hardware, software, firmware, and surrounding environment) to determine the security impact of such changes and make recommendation(s), if appropriate.

4.3.2.6.7.4 Monitor the security controls for the information system on a continuous basis.

4.3.2.6.7.5 Assess the security controls for the information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

4.3.2.6.7.6 Update the system security plan based on the documented changes to the information system (including hardware, software, firmware, and surrounding environment) and the results of the continuous monitoring process.

4.3.2.6.7.7 For criteria established by the ISO for identified security controls, monitor changes to the information system at the frequency identified and provide a security impact analysis. Frequency is based on priorities and importance of the information system to operations, assets, or individual.

4.3.2.6.7.8 Document the result of continuous monitoring and report on a recurring basis, IAW DoD and AF guidance, but no less than quarterly. The continuous monitoring results shall be considered with respect to any necessary updates to the system security plan and to the plan of action and milestones.

4.3.2.6.7.9 Update the Plan of Action and Milestones (POA&M) with any changes affecting the security control in a way to make the security control non-compliant or not applicable or to address or update status of a non-compliant security control. The contractor shall also update other documentation as applicable based on the documented changes to the information system (including hardware, software, firmware, and surrounding environment) and the results of the continuous monitoring process. Ensure the POA&M:

4.3.2.6.7.9.1 Reflects progress made on the current outstanding items listed in the plan. Contractor shall follow-up with action OPRs on documented milestone fix actions to determine adherence to identified schedules.

4.3.2.6.7.9.2 Addresses vulnerabilities in the information system discovered during the security impact analysis or security control monitoring.

4.3.2.6.7.9.3 Describes how the information system owner intends to address those vulnerabilities (i.e., reduce, eliminate, or accept the identified vulnerabilities).

4.3.2.6.7.10 Conduct a post-accreditation review and assessment at least annually for all AFPOA managed systems/networks, except for AFPOA systems/networks undergoing certification and accreditation actions at the time post-accreditation review and assessment is due.

4.3.2.6.7.10.1 The contractor shall conduct a review of all applicable IA controls and perform validation procedures on those controls as identified in the annual Federal Information Security Management Act (FISMA) reporting requirements (FISMA: https://www.whitehouse.gov/sites/default/files/omb/memoranda/2015/m-15- 01.pdf).

4.3.2.6.7.10.2 As needed, the contractor shall update the system security plan, POA&M and other cybersecurity-related documentation as described in this PWS.

4.3.2.6.7.10.3 Systems/networks having undergone significant changes since the certification and accreditation decision may warrant reaccreditation actions. The contractor shall inform the PM, AFPOA ISSM and ISO that the information system requires security certification and accreditation support.

4.3.2.6.7.11 Report the security status or any identified security issues of the information system to the PM, AFPOA ISSM and ISO.

4.3.2.7 Assessment and Authorization (A&A) Support RMF. Meet delivery schedule or coordinated tasked suspense’s with no more than 3 revisions to documents reporting changes to the AO to support a C&A or A&A decision. For systems requiring RMF A&A support, the contractor shall:

4.3.2.7.1 The contractor shall provide assistance in the Information System Categorization process using Committee on National Security Systems (CNSS) Instruction No. 1253, Security Categorization and Control Selection for National Security Systems (https://www.cnss.gov/CNSS/issuances/Instructions.cfm), and Federal Information Processing Standards Publication (FIPS PUB) 199 lhttp://csrc.nist.gov/publications/fips/fips199/ FIPS-PUB-199-final.pdf), Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/PubsSPs.html), as a part of the RMF activities for each application or system during their performance of Assessment and Authorization for these systems.

4.3.2.7.2 Using the most recent RMF guidance provided in National Institute of Standards and Technology Special Publication (NIST SP) 800-37, ( Revision 1) Guide for Applying the Risk Management Framework to Federal Information Systems (http://csrc.nist.gov/publications/PubsSPs.html), contractor shall assist in the selection of common security controls, if required, and the preparation of a comprehensive Security Plan to support a continuous monitoring strategy.

4.3.2.7.2.1 The contractor shall use the most recent NIST SP 800-53 (Revision 4), Security and Privacy Controls for Federal Information Systems and Organizations, and NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans (http://csrc.nist.gov/publications/ PubsSPs.html), overlays to apply the appropriate security controls to the system and document the implementation of these controls in the System Security Plan.

4.3.2.7.2.2 System Security Plan. The system security plan provides an overview of the security requirements for the information system and describes the security controls in place or planned for meeting those requirements.

The plan can also contain as supporting appendices or as references, other key security-related documents for the information system such as the risk assessment, Privacy Impact Assessment (PIA), Contingency Plan, Incident Response Plan (IRP), Configuration Management (CM) plan, security configuration checklists, and any system interconnection agreements. The contractor shall provide inputs to the approved security plan by updating documents within the contractor’s span of control and providing inputs to other/new documents as required.

4.3.2.7.3 The contractor shall assist the RMF Team in the assessment of selected security controls to support the Security Control Assessor (SCA) preparing a complete Security Assessment Report (SAR). This includes preparation of a Vulnerability Assessment Report (VAR) containing the results of all Security Test and Evaluation (ST&E) testing, Security Technical Implementation Guides (STIGs), and Retina/Security Content Automation Protocol (SCAP) Tool findings. Contractor shall prepare a comprehensive VAR with well documented mitigations for any unfixable non-compliant findings.

http://www.whitehouse.gov/sites/default/files/omb/memoranda/2015/m-15-01.pdf) http://www.whitehouse.gov/sites/default/files/omb/memoranda/2015/m-15-01.pdf) http://www.cnss.gov/CNSS/issuances/Instructions.cfm) http://csrc.nist.gov/publications/fips/fips199/%20FIPS-PUB-http://csrc.nist.gov/publications/fips/fips199/%20FIPS-PUB-http://csrc.nist.gov/publications/PubsSPs.html) http://csrc.nist.gov/publications/PubsSPs.html) http://csrc.nist.gov/publications/%20PubsSPs.html),

4.3.2.7.3.1 Security Assessment Report. The security assessment report provides the results of assessing the security controls in the information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the system security requirement. The security assessment report should also contain a list of recommended corrective actions.

4.3.2.7.3.2 The contractor shall then assist the RMF Team in conducting any required initial remediation actions.

4.3.2.7.4 POA&M. The POA&M describes the measures that have been implemented or planned: (a) to correct any deficiencies noted during the assessment of the security controls; and (b) to reduce or eliminate known vulnerabilities in the information system.

4.3.2.7.4.1 The contractor shall document all identified non-compliant controls into a POA&M to support submission of the complete Security Authorization Package (System Security Plan, VAR, SAR and POA&M) to the Authorization Official (AO).

4.3.2.7.4.2 Once the AO signs the authorization decision, the contractor shall support continuous monitoring actions for the system (Annual Reviews) and determine impact of any changes to the system and its environment that might generate an update to the A&A.

4.3.2.7.4.3 The contractor shall also provide needed updates as necessary to the Security Plan, SAR and POA&M to support reporting security status to the AO.

4.4.1 The contractor shall complete the sustainment work for the AFFIRST system as follows:

4.4.1.1 Contractor shall complete data mapping and migration of all existing legacy data from the existing (current) database tables to the new related database tables in the sustainment version in preparation for system roll-out. System roll-out date will be mutually set by COR and contractor PM for a date estimated NLT (barring any unforeseen circumstance) Jun-Oct18. The contractor shall conduct/complete all activities needed to successfully deploy the system production servers. The contractor shall adhere to all C&A requirements as prescribed in Para 5.4 – 5.4.2.7.4.4 of this PWS while re-coding/architecting the system using "Open Source" programming language.

4.4.1.2 Contractor shall create a report interface for the purpose of generating the Office of Secretary of Defense (OSD) Annual Family Services Report. The report will include approximately 31 manual data entry fields and approximately 520 fields that the system will need to automatically calculate figures based on applied filters. Filter options shall include at a minimum: Report Start and End Date and Military Component. The report shall have the ability to be exported into MS Excel. The OSD Annual Report format will be provided to the contractor within the first 15 calendar days of contract award.

4.4.1.3 Contractor shall add the capability to have AFFIRST notify an AFFIRST User via their e-mail address (located in their User account profile) when their account is about to lock due to inactivity (35 days without logging in). The feature should allow a HQ level user account to set the default date(s) a user is notified of the pending lock of their user account.

4.4.1.4 Contract shall add the capability for a user to unlock their own user account should it become locked via answering a minimum of four security questions (enter by the User during account creation). The security questions to be used for this feature will be provided by the COR with the first 30 days of award of contract.

4.4.1.5 Create a MS Excel Templates for the following program areas that can capture data for bulk upload into AFFIRST. The template shall be available for download/upload in the module it is designed for (Note: Similar to how a Budget worksheet can be downloaded as a spreadsheet and provided to customer for completion and upon return uploaded into AFFIRST):

4.4.1.5.1 Workshop Sign-up Roster Template with the following data elements: Name of Workshop, Date of Workshop, Customer Name, DODID and Date added to workshop. Ability to download and upload the completed template shall be available from the Workshop Management module.

4.4.1.5.2 New Customer Record Data Upload Template with the following data elements: Last Name, First Name, DODID, Date of Birth, Gender, Marital Status, Branch of Service, Military Component, Rank, Work Phone, Home Phone, Email Address. Ability to download and upload the completed template shall be available from the Headquarters Dashboard module.

4.4.1.5.3 Deployment Data Template with the following data elements: Deployment Type, Location, Briefing Date, TDY/Deployment Phone Number, TDY Deployment Start Date, Projected Length of Deployment, Anticipated Return date, Pre-Deployment Briefing Date and Spouse Attended Pre-Deployment briefing. Ability to download and upload the completed template shall be available on the A&FRC AFFIRST Management page.

4.4.2 Contractor shall create an automated customer consultation follow-up feature that sends an e-mail with a link to default follow-up survey questions (entered into the system by users with HQ role permisions at the Air Force Personnel Center (AFPC) Airman & Family Readiness office) in AFFIRST that when answered by the customer are saved to the database table that (will) supports the feature. Note: This feature is similar to the current Transition Assistance Post Separation follow-up feature on legacy AFFIRST system.

4.4.2.1 On the HQ dashboard have a link to the customer consultation follow-up feature management page.

The feature management page shall include the following capabilities:

4.4.2.1.1 Ability for HQ staff to create consultation follow-up questions for customer to answer via link in automated e-mail they receive.

4.4.2.1.2 Ability for HQ staff to create the default body text of consultation follow-up e-mail that is sent to the customer.

4.4.2.1.3 Ability for HQ staff to enter number of days that will be available for selection in a drop down field on the customer record Track Visit Screen until automatic follow-up e-mail is sent to customer (i.e., 10 days, 20 days, 30 Days, etc.). Provide ability to select one of the values entered into the drop down field to be the default value that is displayed on the Track Visit page (see 5.4.4.1.4).

4.4.2.1.4 Place a drop down field on the Track Visit page for the A&FRC consultant to select the number of days (i.e., 10 days, 20 days, 30 Days, etc.) before automatic consultation follow-up e-mail is sent to customer.

4.4.2.2 Have system send the consultation follow-up e-mail with a link to questions based on the date the Track Visit entry was made plus the number of days selected in the field described in 5.4.4.1.4. In the automatic e-mail have the system automatically enter the date of the Track Visit entry that necessitated the follow-up combined with to be determined text (example: 1 Jun 2018, Airman & Family Readiness Center Visit Service Follow-up). Additionally, have the Primary, Secondary and Tertiary service codes that were selected for the visit note appear in the e-mail body text so the customer is reminded of the reason for the visit that triggered the automated follow-up. The same follow-up questions should appear for each service code selected on the Track Visit page so the customer can respond to each category of service they were provided.

4.4.2.3 Create a report Interface that provides data based on all fields in the database that relate to the consultation follow-up feature with the same look and feel (Filter section, Fields to Display Section and Results section with ability to export results to MS Excel) and capabilities as the other available AFFIRST reports.

4.5 Contractor Management Reporting (CMR): Contractor shall complete the CMR requirements using the Enterprise Contractor Manpower Reporting Application (ECMRA) application within 30 days of completion of the contract PoP.

PART 5

APPLICABLE PUBLICATIONS

5. Applicable Publications (Current Editions):

5.1 The contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

PUB NO. TITLE Date Change

ENTERPRISE ARCHITECTURE

Air Force Policy Directive (AFPD) 17-1

Information Dominance Governance and Management (SUPERSEDES 33-4, FINAL, 17

JAN 2013)

http://static.e-publis…