Attachment_09b_-_Task_Order_01-Transition_and_Sustainment_Performance_Work_Statement.docx

FA4600-19-R-A001

Attachment 09b -- Task Order 01 – Transition and Sustainment Performance Work Statement

TECHNOLOGY APPLICATION DEVELOPMENT AND SUSTAINMENT (TADS)

TASK ORDER 01

TRANSITION AND SUSTAINMENT

PERFORMANCE WORK STATEMENT

Attachment 09b 24 June 2019

1.0 Introduction

This PWS specifies systems sustainment functions required to support Air Force Weather (AFW). The Government identifies systems sustainment functions that return systems identified in Exhibit C to operations are corrective maintenance. Corrective maintenance occurs when a technician discovers a problem while completing a preventive maintenance action, completing an inspection, or performing a return-to-service action. Corrective maintenance identifies, isolates, and rectifies a fault so that the equipment, machine, or system can be restored to operations. The contractor shall provide all personnel, equipment, tools, materials, supplies, parts, test equipment that the Government does not provide, and supervision to meet sustainment requirements. The contractor shall accept subsystems and sub-baselines into sustainment according to agreed to criteria. The contractor’s performance shall be evaluated on the basis of agreed to performance measurements. The measurements focus on desired outcomes and not interim process steps. Each appropriate paragraph is marked with the symbol ME for mission essential.

2.0 Information Systems (IS) (Sustainment)

2.0.1 (ME) The contractor shall sustain the AFW enterprise as defined in Exhibit C – Performance Requirements Summary. The contractor approach shall address hardware and software maintenance processes, cybersecurity requirements, license requirements, system availability rates and response times to meet operational capability needs. All anomalies and problems associated with sustainment shall be documented and monitored using Government designated tool and established 557th Weather Wing (557 WW) procedures. The contractor shall follow the Government identified change management process (e.g. CCR, Configuration Control Board and WIMM) and ensure any and all production system, development system and test system changes are coordinated and approved.

2.0.2 (ME) The contractor shall ensure the system capability of all specified hardware and software meets or exceeds established standards as specified in Exhibit C. The contractor shall provide duty hours technical support as well as 24x7 on-call support (to include weekends and all holidays) for all systems included in Exhibit C unless such support is specified as “Duty Hours”. “Duty Hours” support is defined in the Services Summary.

2.0.3 Annual hardware/software audits will be performed with the Government to include location of assets. The contractor shall deliver all trouble shooting aids, guides, tools, after action reports when requested, and data accession list in performing system sustainment.

2.0.4 The contractor shall utilize Government designated tool to keep current the status of mandatory directives. Mandatory directives include Notices to Airmen, Time Compliance Network Orders, Maintenance Tasking Orders, USCYBERCOM Tasking Orders, Operation Orders, Information Assurance Vulnerability Alerts and Bulletins, or other such directives IAW AF policy and requirements. Results of software baseline scanning must be submitted to the Government.

2.1 Program Management

2.1.1 Personnel shall possess necessary professional certifications commensurate with tasks assigned. The contractor shall continually monitor and report Funds and Man-Hour Expenditures (CDRL A034) for this task order and immediately notify the Contracting Officer and the Government’s Contracting Officer Representative (COR) of any problems noted. The contractor shall report cost data using the Contract Work Breakdown Structure (CWBS) and CWBS dictionary.

2.1.2 The contractor shall communicate status information and issues to the COR. The contractor shall provide the daily status to the Government of all return to service and corrective actions in progress. The contractor shall provide a monthly status of progress toward meeting task order objectives and operational availability.

2.2 System Administration

2.2.1 (ME) The contractor shall perform normal and return to service system administration support for all systems as identified in Exhibit C. The systems administration support shall be available on-call 24x7x365 with response times as defined in the Services Summary below. The contractor is responsible for systems on the Unclassified, Secret, and Top Secret SCI networks and the systems transferring data between Unclassified, Secret and SCI.

2.2.2 (ME) The contractor shall perform all software and operating system installations, patches, maintenance, and performance tuning for changes requiring elevated contractor-controlled system account privileges. The contractor shall configure newly acquired information systems in accordance with applicable security technical implementation guides (STIG) and maintain those STIGs throughout the systems lifecycle. The contractor shall verify and document configuration by accomplishing appropriate security scan with DISA approved vulnerability scanning tool(s) prior to implementation. The contractor shall upload accomplished scan into the Government designated tool. The contractor shall answer all identified vulnerabilities along with mitigating, resolving, and creating and maintaining plan of action and milestones (POA&M) against scanned assets. Adjudication of answers will be provided by the Government.

2.2.3 (ME) System administration requirements shall include but not be limited to backups, password and account management, system health monitoring and reporting, implementations and updates as required, file maintenance, assistance in the collection of data for metrics on the system, and restoring systems to operations. The contractor shall provide information for updates in support of the Information System (IS) Assessment and Accreditation for configuration changes made to each IS.

2.2.4 (ME) The contractor shall create, delete and maintain user accounts and provide within 2 duty days reports to the Government as to who has access to all systems. The contractor shall track privileged users for the systems they are responsible for and undergo a regular review with the Government to meet mandatory directives, all requirements promulgated by law and government policy, or at a minimum annually. The contractor shall document all operating system accounts, security and system accounts, shared user accounts, application user/group accounts and any group accounts not previously listed. The contractor’s documentation will undergo a regular review with the Government to meet mandatory directives, all requirements promulgated by law and government policy, or at a minimum annually. The results of account audits will be provided to the Government. Auditing shall be implemented on each system in Exhibit C and logs shall be sent to the designated tool.

2.3 IT Infrastructure/Network Maintenance Support

2.3.0 Systems Analysis Services

2.3.0.1 The objective and the limit of systems analysis services is to identify the cause and restorative actions required to return systems to required operations performance, either actual or anticipated degradation. The contractor shall conduct studies and analysis to identify and recommend corrective action for deficiencies, either manifested or identified. The contractor shall perform failure causes and effects analysis, reliability and maintainability trends analysis, and defect analysis. The contractor shall analyze and assess Government operational mission modifications to existing systems. The products of systems analysis may be impact assessments, sustainment requirements identification, operational evaluation as appropriate, or lessons learned when requested. The contractor shall attend technical reviews to provide root cause analysis and recommend solutions.

2.3.0.2 The Contractor shall provide technical expertise in system analysis/programming in maintaining software to the 557 WW to include the 14 WS. Maintenance includes identifying the source of processing problems, recommending corrections and suggesting improvements. The Contractor will provide expertise in software maintenance to assist Government personnel with sustainment of Government controlled software baselines.

2.3.1 Configuration Management Services

(ME) The Contractor shall develop, implement, and maintain the Configuration Management (CM) process for corrected software in sustainment.

2.3.1.1 The configuration status accounting shall adequately define, capture, store, and provide access to all configuration information needed to manage the assigned configuration baselines. The Contractor shall ensure that all data including version description documents are maintained to the current configuration. Maintenance of the documents including updates, corrections or integration of existing formats or contents of this documentation is subject to Government approval. The Contractor shall adhere to documented Government processes, in submitting baseline changes to the Government for approval.

2.3.1.2 (ME) The Contractor shall prepare configuration change requests (CCR) and appropriate documentation for corrective changes to configuration baselines. The CR, or accompanying documentation, will address changes to all system and software documentation.

2.4.1 IT Infrastructure Hardware/Equipment Maintenance

2.4.1.1 (ME) The contractor shall perform hardware maintenance to include all actions, parts, and equipment necessary for repairing or restoring operations in accordance with Exhibit C, routine and 24x7, and in accordance with MPTO 00-33A-1001, Chapters 2, 5 and 6. The contractor shall provide total maintenance to include, but not limited to, all inspections, diagnostics, preventive and corrective maintenance, cleaning, servicing, lubricating, replacing parts, troubleshooting, repairing, bench checking, reassembling, testing, calibrating, and conducting of operational checks to correct malfunctions and verify the adequate and proper serviceable condition of any component, system, or subsystem.

2.4.1.2 The contractor shall establish criteria to determine periodic maintenance requirements. The contractor may establish service agreements. To ensure operability of any replacement components, the contractor shall perform system testing. All maintenance actions shall be IAW Government approved technical documentation. If parts are replaced with other than identical, then the contractor shall update the appropriate drawings as part of the sustainment action. The contractor shall document all maintenance actions taken in the Government designated tool.

2.4.1.3 (ME) For equipment under manufacturer’s warranty, the contractor shall place all maintenance calls to the hardware vendor, be the Government’s point of contact with the hardware vendor, and be responsible for all security while the maintenance vendor is performing maintenance actions

2.4.1.4 The contractor shall develop and maintain a material/supply chain management and tracking system to track all maintenance actions, and spares/repair parts. The contractor shall provide the records upon expiration of the contract. Any item that currently is assigned a National Stock Number (NSN) shall be managed by the Government (Item Manager). The contractor will be provided Military Standard Requisitioning Procedures authority. The contractor shall establish an active program to continually monitor equipment and parts, to include COTS, to ensure availability. The contractor shall be responsible for the replenishment, management, calibration, update, and maintenance of all Government provided, contractor operated support equipment.

2.4.2 IT Infrastructure Software License Support Services

2.4.2.1 (ME) The contractor’s sustainment activities shall include obtaining licenses and agreements on third-party software, software drivers, all non-applications software, and diagnostic software site licenses and any vendor support for all systems designated in Exhibit C and other commercial licenses purchased for the 557 WW and the 14 WS. The contractor shall maintain the master record of these licenses and updates. The contractor shall purchase all hardware and software subscription services to maintain the COTS hardware and software at the latest vendor revision level. The contractor shall deliver each fiscal quarter a listing of and a rough order of magnitude cost estimate for each license and support agreement required for the next fiscal quarter including the most recent purchase price. The listing shall include the name, associated number designation if any, original manufacturer, numbers of licenses/support agreements, associated systems and renewal date for each license and support agreement. The contractor shall provide the Government annually a list of hardware and software items that are within 18 months of end of life. The contractor shall not obtain licensing, update services, and vendor support without notifying the Government Contracting Officer in sufficient time to allow the Government to respond prior to the purchase. The contractor shall use only software that has been approved by the IS Authorizing Official (AO) and the IS Information System Security Manager (ISSM).

2.4.2.2 (ME) All changes considered mandatory by the vendor shall be incorporated with approval of the Government. The contractor shall use AF-wide license agreements whenever available. The contractor shall assure all contractor and tasked Government hardware and software meet current Air Force certification and accreditation requirements, Air Force Computer Emergency Response Team (AFCERT) requirements, Defense Intelligence Agency certification and accreditation requirements, and any other mandatory requirements as directed by the Government.

2.4.3 IT Infrastructure Management

2.4.3.1 (ME) The contractor shall perform network management, and maintenance of the infrastructure components supporting the unclassified, Secret and SCI enclaves during duty hours and after duty hours via an on-call notification system. The contractor shall provide services for development, test and production enclaves. The contractor shall monitor the network infrastructure to identify real-time and potential overloads and bottlenecks. The contractor shall submit recommended corrective actions and alternatives, and lifecycle cost avoidance steps.

2.4.3.2 (ME) The contractor shall install and configure network switches, routers, and network security devices IAW DISA STIG and provide results to the Government. The contractor shall test and validate all proposed modifications to the existing infrastructure in the test laboratory, document results and provide findings to the Government for final review/approval. The contractor shall design, install and test modifications to the cable plant which includes the creation, reparation, replacement and installation of copper and fiber optic cabling. The contractor shall configure and use network management tools to diagnose network anomalies, outages and slowdowns. The contractor shall receive, inventory, warehouse (557 WW provided space), and ship as required network and test bed components.

2.4.4 Other IT Infrastructure Support

2.4.4.1 The contractor shall prepare drawings including updates to existing drawings documenting configuration and connectivity changes. Drawings maintained include floor layouts, assembly drawings, connection diagrams, drawing trees, network/system topology, and parts lists. The contractor shall revise drawing markups, create drawings including parts lists, connection diagrams and wire lists, and draft redraws for electronic format from existing drawings.

2.4.4.2 The contractor shall perform equipment custodian responsibilities. The contractor shall use sound business practices to control, protect and maintain Government property and materials used in the performance of this contract. The contractor shall use the Defense Property Accountability System for Government designated equipment. The contractor shall mark all equipment using Item Unique Identifier (IUID) labeling IAW DFARS 211.274.-2 and DFARS 252.211-7003. The contractor shall sign custody records. The contractor shall be responsible for repairing or supplying replacements for missing, unserviceable or damaged items by 60 days prior to the end of the contract performance period. If any item is not repaired or replaced in the required time period, or if the contractor has not returned everything to a serviceable condition by that time, the Contracting Officer may initiate action to have the items repaired or replaced at contractor expense.

2.4.4.2.1 The contractor shall submit requests for replacement, additions, and deletions of Government-provided equipment to the Government’s CORs for processing. Such requests shall specify the reason for the replacement request. All materials purchased by the contractor for use in meeting tasked requirements become the property of the Government at the end of the contract.

2.4.4.2.2 The contractor shall inspect and ensure the calibration and repair of all Government provided, contractor operated Test, Measurement, and Diagnostic Equipment used in the performance of the contract. The contractor shall report any repair or replacement required to Government provided, contractor operated test equipment to the Government’s CORs. The contractor shall track and maintain all calibration and repair actions.

2.4.4.2.3 The contractor shall immediately report lost, stolen, damaged, or destroyed Government property, maintained in the contractor’s property management system to the Government’s CORs. A Report of Loss shall be prepared by the contractor and forwarded to the Government’s CORs along with written explanation. The contractor shall participate in the survey investigation.

2.4.4.3 The contractor shall maintain the UPS to be operationally available per Exhibit C.

2.5. Cybersecurity Maintenance Management

2.5.1 (ME) Assurance activities conducted during maintenance and sustainment processes should mitigate and minimize attacks (e.g. threat assessment and modeling, attack surface analysis, architecture and design reviews, application of static and dynamic code assessment tools and services, validation of 3rd party software/libraries, and penetration testing) that the information system is likely to face during operations.

2.5.2 (ME) The Contractor shall verify configuration by accomplishing appropriate security scan with DISA vulnerability scanning tool(s) prior to implementation. The Contractor shall upload accomplished scan into the Government designated tool. The Contractor shall answer all identified vulnerabilities along with creating and maintaining POA&Ms against scanned assets. Adjudication of answers will be provided by the Government.

2.5.3 Cybersecurity Compliance Operations and Tracking

(ME) Any STIG/SRG findings and any Static Application Security Test (SAST)/Dynamic Application Security Test (DAST) findings introduced as part of, or resulting from, sustainment activities shall be considered potential vulnerabilities impacting the security posture of the AFWWS. Category definitions shall be governed by DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT). Findings introduced as part of sustainment activities shall be identified as deficiencies and resolved as part of the original sustainment activity. Corrections will comply with Maintenance and Procedures Technical Order 00-33A-1109, para 2.5.3. The contractor shall update RMF documentation for sustainment actions.

2.5.4 Follow-on Cybersecurity Test and Evaluation

(ME) The Contractor shall include detailed test procedures for test and evaluation of cybersecurity relevant features and controls as part of any testing that occurs for a given sustainment action. Test procedures shall include cybersecurity requirements, test methodology and metrics, test procedures, and test resources required. Cybersecurity test reports shall also include test results in terms of vulnerabilities identified, demonstrated/estimated operational effects, residual risk on no technical or procedural solution is identified, potential risk mitigations, and residual risk once technical or procedural solution is applied.

2.5.5 Cybersecurity and IT Certification and Accreditation

The Contractor shall ensure that software maintained under this agreement does not compromise the security posture of the Air Force Weather Weapons System (AFWWS). The Contractor shall create, modify, or update POA&M, STIG and RMF documentation as directed to support and maintain the accreditation of the IS.

2.5.6 Machine to Machine Certificates

The Contractor shall implement and maintain valid machine to machine certificates for systems identified in Exhibit C. The contractor shall download, test and implement certificates before the certificate expiration date to ensure no impacts to operations. The Contractor shall assist the Government in its certificate maintenance program.

2.6.1 Routine Fixes and Deficiency Correction

2.6.1.1 (ME) The contractor shall perform corrective maintenance of software baselines identified in Exhibit C, routine and 24x7, to include middleware upgrades and patches. The contractor shall provide system analysis/programming expertise in troubleshooting existing software.

2.6.1.2 (ME) The Contractor shall perform corrective software maintenance in accordance with a Secure Software Development Life Cycle (S-SDLC) model. The Contractor is expected to define, develop, trouble-shoot, and resolve problems during maintenance and sustainment. Maintenance shall include, but not be limited to, correction and/or mitigation of identified system/network/interface software vulnerabilities, database management functions, installation of COTS and GOTS packages, and system software revisions. The Contractor shall update technical documents as necessary and as part of each sustainment action.

2.6.2 Mandatory Directives

2.6.2.1 The Contractor shall perform all mandatory directives as directed to remain in compliance with laws and policy.

2.7 Transition

2.7.1 Phase-In

The period between the transition start date and the full performance start date constitutes the contract phase-in period. During the phase-in period, the contractor shall prepare to meet all task order requirements and ensure all incoming personnel are trained and qualified on the full performance start date. Prior to start of full performance, the contractor, the incumbent contractor, and the Government will conduct a joint inventory of all facilities, equipment, and materials to be used in contract performance. All Government facilities, equipment, and materials will be accessible to the Technology Applications, Development, and Sustainment contractor during the phase-in period.

2.7.2 Phase-Out (only for the last exercised option period)

2.7.2.1 In the event follow-on sustainment requirement is awarded to another contractor the contractor shall cooperate fully to the extent required to permit an effective, orderly, and successful transition that will maintain mission continuity. This is the phase-out period and will allow for orderly turnover of facilities, equipment, and records and will help to ensure continuity of service to the Government. An observation period shall occur during which personnel of the successor contractor workforce may observe operations and performance methods of the contractor. At the completion of contract performance, the contractor shall return the property provided for performance of this contract to the Government.

2.7.2.2 During the contract Phase-out period, the contractor, the successor contractor and the Government shall conduct a joint inventory of all facilities, equipment, and materials that were used in contract performance. All files, manuals, charts, records, drawings, and other documentation generated in meeting this contract’s performance requirements are the property of the Government and shall remain on location for use by the Government or successor contractor at the time of contract expiration, termination, or during any period of suspension of this contract. The contractor shall allow the successful offeror access to the contractor’s facilities to review spares, support equipment, technical data, and software documentation. The contractor shall provide all orientation, training, and equipment/system familiarization required to the successor.

3.0 Services Summary

The Government will use the Services Summary items below (Table 1) to evaluate the contractor’s performance. Bilateral contract modification shall be required for all Performance Objectives added, changed, or deleted.

Table 1 Services Summary

99% without failures Assessed monthly by Government implementation reports.

100% submitted before or on due date Assessed monthly by Government reviewer comments.

Note: Mandatory directives implementation or POA&M submission due date is defined as either the Government suspense identified in Government designated tool or two weeks after the contractor is notified of the request, whichever date is later, unless otherwise coordinated with the COR and authorized Government personnel and documented accordingly.

Operational Availability*

Mean Down Time for the production system shall not exceed 6 hours monthly total to include scheduled and unscheduled events .

Hardware maintenance, system administration, and license management services for the UPS in Bldg 185.

Maintenance will include remedial and preventive maintenance.

On-call response

NOTE: Operational Availability, Mean Down Time, On-Call Requests, and On-Site Responses shall be calculated and reported monthly within the period of performance.

Operational Availability (AO) and Operational Dependability (DO) are defined as:

Where MTBDE is Mean Time Between Downing Events, MDT is Mean Downtime, MTBCF is Mean Time Between Critical Failure, and MTTRF is Mean Time to Restore Function (IAW AFPAM 63-128).

Since AO includes both scheduled and unscheduled downing events, the DO percentage will always be greater than or equal to the AO percentage.

If scheduled downing events exceed their advertised length, the additional downtime counts as an unscheduled downing event.

4.0 Hours of Support

(ME) The contractor shall provide the necessary personnel to meet the requirements identified in this PWS during duty hours and 24/7 as identified in Exhibit C. Duty hours are 0730 to 1630 each work day 5 days per week except Federal Holidays.