Attachment_1_FINAL_HISS_PWS_13_Sep_17.docx

PERFORMANCE WORK STATEMENT

FOR

AIR FORCE RESERVE COMMAND AND AIR NATIONAL GUARD

HEALTH INFORMATION AND READINESS SYSTEMS

SUSTAINMENT

13 SEPTEMBER 2017

1.0 INTRODUCTION

1.1 Background. The Air Force Reserve Command (AFRC) and Air National Guard (ANG), also referred to as Air Reserve Component (ARC), have a requirement to ensure the Readiness of assigned Service Members. Each organization is responsible for adjudication of service connection claims to facilitate timely receipt of benefits and entitlements and medical dispositions for fitness and continued service conditions. The Department of Defense Armed Forces Electronic Health Record (EHR), satisfies a Presidential goal of ensuring the AF Medical Services have an electronic record by 2015, accomplishing the Air Force Reserve mission for managing members’ Force Health Readiness assessments. The Air Force Reserve Component Electronic Case Tracking (ECT) program is the authoritative system for Line of Duty (LOD) determination process and medical case evaluations for each supported agency; ECT effort supports both AFRC and ANG. The DoD system is an interoperable, globally-accessible, protected, and always available EHR for Uniformed Services members. The DoD EHR provides healthcare providers access to data about members’ conditions, prescriptions, diagnostic tests and additional information essential to providing quality care. ECT is a web based application that provides the ARC, its subordinate organizations, with an automated tool to administer and manage cases; thereby ensuring timely receipt of medical treatment and benefits for eligible service members. The ECT web application was designed to help the user process prompt investigations, manage cases by reporting significant information obtained from various sources, and document those occurrences on various forms. It is a comprehensive, Web accessible, tool used to initiate and complete documents required for ECT investigations.

1.2 Organization. The AFRC organization with primary responsibility for this requirement is the Directorate of Health Services, Health Services Management Division.

1.3 Scope. The HQ AFRC Directorate of Health Services (SG) requires Information Technology services in support of the Air Force Reserve Command and Air National Guard.

1.3.1 The contractor shall provide all management, tools, supplies, equipment, software licenses/subscriptions and maintenance support, qualified labor with the necessary technical skills and experience to operate, modify and maintain the following Programs/Systems:

1.3.1.1 Defense Health Agency (DHA), Air Force Medical Service (AFMS) for AFRC.

1.3.1.2 Air Force Reserve Command Health Services Directorate (AFRC/SG) Information Technology (IT) systems, Electronic Case Tracking (ECT), and program analysis for the AFRC and ANG, see table 2 page 3.

1.3.2 The Contractor shall provide support for the maintenance, specific modification to support ANG, configuration administration, and functional operation to include user training, application help support, creating and managing accounts of DHA/AFMS/AFRC SG systems (i.e. AHTLA/Citrix, Genesis, CHCS, DICE, ECT, etc.) utilized by the Air Force Reserve and ECT for the ARC. The Government owns all developed, modified, or converted source modules, processes, programs, scripts, operating instructions, databases, system files, documentation, test files and test conditions used to develop each approved system change request executed according to schedules. The contractor shall provide any of the above items upon completion (or upon request by the government) of each item, and any that are in progress at conclusion of the contract.

1.3.3 In accordance with (IAW) Software Life Cycle Management Support (4.1.2.8), contractor will scope/plan, design, develop and implement system modification to integrate ANG into ECT.

The contractor shall maintain the current system and provide software change and problem fixes as required. The contractor shall provide to the Government all developed, modified, or converted source modules, processes, programs, scripts, operating instructions, databases, system files, documentation, test files and test conditions used to develop each approved systems change request.

2.0 SERVICES SUMMARY

Performance Standards Table. The table below identifies the performance standards that will be measured by the government. The contractor shall have these elements as part of their Quality Control Program and may have others, as necessary, to meet contractor quality standards.

Performance Objectives

PWS Para

Performance Threshold

100% compliance with complete, accurate and timely deliverables and reporting. Report shall be delivered to the (COR) no later than the 10th day of each month

3.0 GOVERNMENT PROPERTY, FACILITIES, AND INFORMATION

3.1 Installation Support. The Government will provide the on-site Contractor personnel with office space, computers, telephone communications, internet access, printers, and access to appropriate Government files, databases and common access cards for use in the performance of this requirement. Use is limited to official government business related to the performance of the requirements in this contract.

3.2 Government System(s). The Government will provide Contractor personnel access to system(s) necessary to perform tasks under the contract/order. Upon completion/termination of the contract/order or transfer/termination of Contractor personnel, the system account(s) will be closed.

4.0 TECHNICAL REQUIREMENTS

4.1 Specific Requirement(s)/Description of Service(s)

4.1.1 Systems Sustainment. The contractor shall provide application, business data analyses and program administrative services; necessary to operate and maintain systems/applications for the electronic processing that support sustainment, development, migration and integration, as well as web services and netcentric data services for legacy systems, content delivery and presentation services, and new mission applications that operate in netcentric enterprise environments and exploit AF infrastructures. The Contractor shall provide to the Government all sustained, modified, or converted source modules, processes, programs, scripts, operating instructions, databases, system files, documentation, test files and test conditions used to sustain each approved systems change request. Systems sustainment requirements must comply with applicable documents and standards specified see Table 3 (CDRLA001 DI-AVCS-80700)

4.1.1.1 Maintain existing systems and environments IAW disciplined engineering practices and sustain applications, databases, and interfaces in compliance with applicable AF/DoD standards

4.1.1.2 Support system sustainment activities to include maintaining existing legacy systems and environments and to sustain applications, databases, and interfaces

4.1.1.3 Provide application services to support, maintain, and operate systems or services

4.1.2 Operation and Maintenance (O&M). The Contractor shall perform operation and maintenance of DHA, AFMS and AFRC/SG Information Technology (IT) systems. Systems operations/services requirements must comply with applicable documents and standards specified in table 2.

4.1.2.1 Network Systems Operations & Management Support

4.1.2.1.1 The Contractor shall provide planning, analysis, troubleshooting, integration, installation, operations, training, documentation, and systems administration services. The Contractor shall ensure optimal system performance and access to the application at all times, 99% uptime with no critical mission impact and <2 second screen response time, by providing the following network support functions to include, but are not limited to, the capability to:

4.1.2.1.1.1 Provide administration and technical assistance, as required, in support of IT systems/application.

4.1.2.1.1.2 Provide server-based application installation, as required.

4.1.2.1.1.3 Configure, integrate and troubleshoot support for servers, PC-based microcomputers, scanners, and associated software applications, which includes in-house applications, COTS, and newly written utilities and application software. 98% effective handling and resolution within 48 hours, remaining 2% resolved within 2 days of scheduled date.

4.1.2.1.1.4 Coordinate with DHA/INOSC/AFRC A6 personnel or contractors to address interoperability and connectivity issues for the enterprise network, including recommendations on re-configuration of LAN/WAN equipment to meet operational requirements.

4.1.2.1.1.5 Coordinate and track job requests to ensure that all customer requests are handled expeditiously while keeping Government apprised of significant changes in workload status.

95% promptly logged, responded to and resolved within 48 hours, remaining 5% resolved within 3 days of scheduled date.

4.1.2.1.1.6 Test user interfaces that transparently integrate with systems/applications. Plan and perform data conversion/system migrations; and establish data conversion and data validation routines.

4.1.2.1.1.7 Maintain inventory control and location records of Government-owned Federal Information Processing (FIP) equipment/software.

4.1.2.1.1.8 Provide support services to maintain file/application backup capability, security, operational data storage and retrieval application resident on diverse computer platforms, such as networks and client-server environments.

4.1.2.1.1.9 Perform network-based detection of viruses and unauthorized software and facilities to counter/eliminate/control.

4.1.2.1.1.10 Manage and administer user id, password and security keys (public/private, unique); and administer domain addresses as required.

4.1.2.2 Information System Security (ISS) Support

4.1.2.2.1 Security for application/system. The Contractor shall apply DoD and Air Force network security protocols to provide security for the application/system. The Contractor shall provide, at a minimum, the following information security capabilities:

4.1.2.2.1.1 Operational and analytical support related to security for file servers, network security, and LAN information assets.

4.1.2.2.1.2 The contractor shall perform analysis and evaluation of new and emerging security technologies as well as vendor security products for their applicability and feasibility of use for LANs and networks.

4.1.2.2.1.3 Create back-up storage and protection plan. Ensure complete daily, weekly, and monthly backups, both electronic and manual in accordance with the back up plan created by the contractor. Conduct quarterly testing and restoration of stored data. 100% successful archive and restoration with no degradation in data integrity.

4.1.2.2.1.4 Perform required tasks to remedy existing security weakness. Conduct network security monitoring to detect intrusions. Conduct electronic vulnerability assessments of systems. Conduct electronic vulnerability assessments of web sites. <2.49 vulnerabilities per each assigned server; Once a solution/fix is created, Category 1 (CAT I) vulnerabilities will be eliminated within 24 hours of the created solution/fix.

4.1.2.2.2 Computer Security Awareness. The Contractor shall provide computer security awareness. The contractor support includes, but is not limited to, the capability to provide the Information Systems Security Officer (ISSO) with guidance and research for presentation of the course/briefing and provide advice on security policies, procedures, and techniques.

4.1.2.2.3 Computer Security Incident Response. The Contractor shall provide computer security incident response support. The Contractor support includes, but is not limited to, the capability to:

4.1.2.2.3.1 Perform research on system vulnerabilities, conduct system penetration analysis and recommend computer security incident response tools.

4.1.2.2.3.2 Monitor the application/system to detect intrusions. Correlate information on network intrusion incidents; create incident reports, brief AFRC/SGSI management, ARC security personnel, law enforcement and/or counterintelligence organizations on the incidents.

4.1.2.3 Information Services. The contractor shall provide application and content presentation services that identify and exploit existing services, create new Service-Oriented Architecture (SOA)applications and data services, create presentation services, define, align and register vocabularies, expose information assets for discovery in the Metadata Environment (MDE) for Communities of Interest (COI), provide wrapping services, and provide data layer connectivity.

4.1.2.3.1 Development of New SOA Applications and Data Services

4.1.2.3.1.1 Expose authoritative data, as defined, by re-engineering a business process, identifying the sources for the authoritative data, and establishing user roles and permissions for information access as directed by COI.

4.1.2.3.1.2 Support lifecycle management of new SOA-based applications that encapsulate business logic to provide new functional/operational mission capabilities

4.1.2.3.2 Create Aggregation Services

4.1.2.3.2.1 Create aggregation services that deliver capabilities by coupling multiple core data services to construct new information assets.

4.1.2.3.2.2 Avoid duplication of data available from other authoritative sources, performance permitting.

4.1.2.3.2.3 Invoke enclave security services to mitigate security issues from aggregating data from multiple Authoritative Data Sources (ADS).

4.1.2.3.2.4 Create repositories for new authoritative data generated from aggregation services.

4.1.2.3.2.5 Create services through which content can be creatively combined, searched, and/or correlated.

4.1.2.3.3 Create Presentation Services

4.1.2.3.3.1 Create presentation services that are required to display information unique to a specific set of users and to deliver specific mission capabilities.

4.1.2.3.3.2 Develop these presentation services to be available from the SOA infrastructure to provide content on-demand.

4.1.2.3.4 Specify Information Assets for Exposure

4.1.2.3.4.1 Generate specification for exposing authoritative data as information asset payloads.

4.1.2.3.4.2 Create semi-automated services that enable the specification of information assets by editing, sorting, filtering, and translating.

4.1.2.3.4.3 Utilize applicable data definitions and standards for information assets to be exposed.

4.1.2.3.4.4 Create schema/documentation for organizations to register for use throughout the DoD enterprise.

4.1.2.3.5 Registering Services. Support the registration of ADS exposure services, aggregation services, and presentation services.

4.1.2.3.6 Web Services. Create and maintain web services using standards as defined within the Enterprise Architecture to enable sharing of data across different applications in an enterprise.

4.1.2.3.7 Service Lifecycle Management. Generate necessary design and implementation artifacts that will support lifecycle management, defined as service development, testing, certification, registration, sustainment, and evolution aligned.

4.1.2.3.8 Vocabulary Management

4.1.2.3.8.1 Support the development of vocabularies.

4.1.2.3.8.2 Create and maintain Web Ontology Language (WOL) vocabularies and schemas.

4.1.2.3.8.3 Verify vocabularies do not overlap and/or contradict other ADS vocabularies.

4.1.2.3.8.4 Resolve discrepancies and eliminate redundancies of vocabularies.

4.1.2.3.9 Register Vocabularies. Support the alignment, articulation and registration of vocabulary artifacts.

4.1.2.3.10 Data Stores

4.1.2.3.10.1 Create and maintain data stores.

4.1.2.3.10.2 Provide services such as data cleansing, redundancy resolution, and business rule validation.

4.1.2.3.10.3 Monitor and maintain these data stores to ensure data availability, accuracy, precision, and responsiveness.

4.1.2.3.11 Information Exposure Services

4.1.2.3.11.1 Provide application services.

4.1.2.3.11.2 Prepare and standardize data retrieved from legacy information sources.

4.1.2.3.11.3 Modify the information source’s interface, data, and/or behavior for standardized accessibility.

4.1.2.3.11.4 Transform communication interfaces, data structures and program semantic alignment. Provide standardized communication/program wrapping services, data language translation, etc.

4.1.2.3.11.5 Employ configuration management plan of existing legacy baseline code and data exposure code.

4.1.2.4 Database Administration

4.1.2.4.1 The Contractor shall provide database deployment and administration for systems/applications and internal control management program. Database deployment and administration includes the definition, design, maintenance, security requirements, programming and testing stages of deployment. The Contractor shall provide a project plan with milestones, and a database design to include, at a minimum, the following elements: Process flows, forms, inputs, outputs, inquiries. These documents shall be submitted to the COR for acceptance, COR has 10 business days to review/approve. (CDRL A002 DI-IPSC-81437A)

4.1.2.4.2 The Contractor shall provide Database Administration support including but is not limited to, the following:

4.1.2.4.2.1 Program database needs assessments and design recommendations as needed.

4.1.2.4.2.2 Present commercial, off-the-shelf (COTS) software or Government off-the-shelf (GOTS) alternatives prior to establishing a new ARC database or web application.

4.1.2.4.2.3 Address the impact of new releases/version updates on existing databases and provide recommendations on how to mitigate the impacts.

4.1.2.4.2.4 Update the software in systems/databases in a manner that limits disruptions for system/database users. 95% of scheduled upgrades and/or maintenance executed according to schedule, remaining 5% completed within 2 days of scheduled date.

4.1.2.4.2.5 Document changes to database operation resulting from software version upgrades and installations. Follow-up on the updates to ensure integrity and functionality of the database is maintained and new features are working correctly.

4.1.2.4.2.6 Recommend and maintain procedures to test and monitor system security to ensure only authorized individual’s access files and application resources.

4.1.2.4.2.7 Record and notify Government representatives of any security-related events on the system(s) or the application(s).

4.1.2.4.2.8 Maintain existing standard operating procedures (SOP) for application database and write new SOPs, as required, for maintenance of the application.

4.1.2.4.2.9 Maintain baseline records to identify significant parameters, chronology of changes and reason for the changes related to the application.

4.1.2.4.2.10 Maintain records to identify database system demand and usage. Recommend to the COR capacity adjustments based on the records.

4.1.2.4.2.11 Ensure all interfaces function properly.

4.1.2.4.2.12 Add or delete user accounts. Maintain records of user account changes. Maintain all other accounts, e.g. administrator.

4.1.2.4.2.13 Monitor and maintain information security using provided tools and notify appropriate personnel upon discovery of security breaches.

4.1.2.4.2.14 Advise COR when services are unavailable, what the difficulties are and when services can be expected to resume.

4.1.2.5 Help Desk The help desk is the central point for users with computer problems. Operational hours are Monday – Friday, 0730 -1630 and on call for each UTA weekend, two weekends per month. The Contractor shall provide Tier 1, Tier 2, and Tier 3 help desk support including, but are not limited to, capability to:

4.1.2.5.1 Effectively assist customers; telephonically, in person and via email.

4.1.2.5.2 Log trouble calls for problems utilizing appropriate ticket tracking system.

4.1.2.5.3 Reset passwords and personal identification numbers.

4.1.2.5.4 Update and maintain application help desk instruction binder.

4.1.2.5.5 Tier 1 – Basic application software and/or hardware support.

4.1.2.5.6 Tier 2 – More complex support on application software and/or hardware.

4.1.2.5.7 Tier 3 – Subject matter expertise, support on complex programmatic, hardware and OS software issues.

4.1.2.6 System/Application Recovery Support

4.1.2.6.1 The Contractor shall ensure application/system recovery capability that supports ARC goals and objectives. The Contractor shall provide the capability for recovery of all critical data, software programs and sensitive Government information. The requirements for system recovery support services include an analysis of strategic planning factors; the strengths and weaknesses of the system, as obtained through threat assessment and risk analyses; and cost and benefit trade-offs. The Contractor shall provide the capability to:

4.1.2.6.1.1 Detail and diagram hierarchical access and storage systems.

4.1.2.6.1.2 Ensure continuity of operations for Government systems.

4.1.2.6.2 Disaster Recovery, Continuity of Operations, and Contingency Planning. The Contractor shall provide disaster recovery, continuity of operations, and contingency planning support for application/system. The Contractor shall also provide the capability to perform appropriate risk analysis, develop disaster recovery and continuity of operations plans and implement mitigation plans.

4.1.2.7 Virus Detection, Elimination, and Prevention Support. The Contractor shall provide virus detection, elimination, and prevention support including, but is not limited to, the capability to utilize computer security tools such as virus detection, elimination and establish prevention guidelines for use before and during incidents.

4.1.2.8 Software Life Cycle Management Support

4.1.2.8.1 The Contractor shall provide resources to support any or all phases and stages of software life cycle management, including planning, analysis, troubleshooting, integration, acquisition, installation, operation, maintenance, training, documentation, and administration.

4.1.2.8.1.1 Software configuration management. Conduct feasibility studies, risk analyses, and prepare decision papers to justify the need for procuring COTS software or implementing new/redesign of existing applications. The study, analysis, and decision paper shall include, at a minimum, an executive summary, information on the criticality/sensitivity of data, and detail documentation to support the decision for a future system implementation.

4.1.2.8.1.2 Identify the software requirements for system modifications/enhancements. This task includes the definition, design, security requirements, programming, and testing stages of development. The Contractor shall develop a project plan with milestones, and system requirements to include database design, process flows, forms, inputs, outputs, and inquiries. This plan shall be submitted to the COR within five business days for approval and acceptance. (CDRL A003 DI-MGMT-81797)

4.1.2.8.1.3 The Contractor shall prepare system documentation related to the software life cycle that captures functional, interface, integration, data, security, and internal control requirements, data sensitivity and criticality description, system/subsystem or modules, program, database design, security and internal control specifications. The Contractor shall be required to develop user, computer operations and program maintenance manuals, and plans for training, testing, quality assurance, contingency operations, backup, recovery, and restart procedures. (CDRL A003 DI-MGMT-81797

4.1.2.8.1.4 Software support for data conversion, implementation, user and maintenance of the application. The Contractor shall be required to develop and/or execute a conversion and implementation plan and strategies, develop standard operating procedures, and participate in post-implementation reviews. (CDRL A003 DI-MGMT-81797)

4.1.2.8.1.5 Maintain the system operating environment. The Contractor shall prepare disaster recovery risk assessments and configuration management plans, including, acquisition and management of software licenses, subscriptions and/or maintenance agreements; management of software releases and related program changes; investigation of program problems; review and evaluation of application change requests for impacts. (CDRL A003 DI-MGMT-81797)

4.1.2.8.1.6 Performance Measurement. The Contractor shall conduct periodic performance measurement and evaluation activities to reengineer existing applications for improved productivity, changes in functional and technical requirements, etc. The Contractor shall prepare documentation for developed software application. The contractor shall perform appropriate optimization unit level visit. (CDRL A003 DI-MGMT-81797)

4.1.2.8.1.7 The contractor shall conduct user level training, education and program support on the practical application and use of all systems, applications and programs. Training will be performed via Group Event (Class Room Style), Site Visit (Class Room/Over-the-shoulder) and distance learning (Over the phone and Defense Connect Services). (CDRL A003 DI-MGMT-81797)

4.1.2.9 Enterprise Information Technology Data Repository (EITDR) or Information Technology Investment Portfolio Suite (ITIPS) and Enterprise Mission Assurance Support Service (eMASS): The Contractor shall be responsible for maintenance of required accreditation, certification, and security documentation in EITDR/ITIPS and eMASS.

4.1.2.10 Risk Management Framework (RMF)

4.1.2.11 The system/application infrastructure components are fully certified and accredited under the RMF Comprehensive Package. The Contractor shall ensure that all components of the applications’ and infrastructure components are regularly monitored using the information assurance best practices.

4.1.2.12 The Contractor shall be responsible for the maintenance of the RMF and all its appendices and related accreditation documentation.

4.1.2.13 The Contractor shall evaluate the impact of new requirements or application changes for its impact on the RMF and provide recommendations to the COR. If approved, the Contractor shall implement the new requirement, system changes or updates. The Contractor shall provide all pertinent artifacts of the ECT RMF Comprehensive Package. (CDRL A004 DI-IPSC-81427A

4.1.2.14 Customer Complaints. The Contractor shall ensure that a customer complaint process is established and advertised to systems/applications users. The Contractor shall track and report to the COR on the resolution of customer complaints. (CDRLA008 DI-QCIC-81722)

4.1.2.15 Remote Access Management. The Contractor shall maintain remote clients (configured by AFRC) to administer software code, patches, and troubleshoot the systems/applications. The Contractor shall comply with AFRC/A6 requirements to acquire a LAN and Administrator account to remotely manage the system.

4.1.2.16 Training Materials Maintenance. The Contractor shall be responsible for maintenance and updates to the existing web-based Computer Based Training (CBT) videos. The CBT videos depict step-by-step instructions for users of the systems/applications.

4.2. ENGINEERING REQUIREMENTS

4.2.1 Systems Engineering

4.2.1.1 Life-Cycle Systems Engineering. The contractor shall employ disciplined systems engineering processes including, but not limited to, requirements development, technical management and control, system/software design and architecture, integrated risk management, configuration management, data management, and test, evaluation, verification and validation practices throughout the performance of this contract.

4.2.1.2 Systems Engineering Process (SEP). If applicable, the contractor shall follow and refer to the Air Force Program Executive Office (AFPEO) Business Enterprise Systems (BES) SEP website for common plans, procedures, checklists, forms, and templates that support system life cycle management and systems engineering processes as it applies to Defense Acquisition, Technology, and Logistics tailored to Capability Maturity Model Integrated (CMMI) disciplines, or be able to demonstrate comparable processes and artifacts. The contractor shall develop solutions that employ principles of open technology development and a modular open systems architecture for hardware and software as described in the DoD Open Technology Development Guidebook and Net-Centric Enterprise Solutions for Interoperability (NESI) body of knowledge. The contractor’s systems engineering plan and design activities shall also adhere to the DoD Information Sharing and Net-Centric Strategies published by the DoD CIO, and the engineering body of knowledge and lessons-learned accumulated in NESI.

4.2.1.3 Reliability, Availability, Maintainability (RAM) – RISE Manual/Handbook. The contractor shall employ the practices prescribed and defined in the RISE Handbook to address RAM in their programs. The RISE Handbook sections provide information on recommended RAM activities and processes to be undertaken in each of the four main acquisition life cycle phases: Materiel Solution Analysis Phase, Technology Development Phase, Engineering & Manufacturing Development Phase, and Production & Deployment Phase. The RISE Handbook is intended to provide acquisition managers insight into RAM activities and products so that they can staff their programs with the necessary RAM subject matter experts who will develop these products and provide the inputs required at each milestone review.

4.2.1.4 Service Development and Delivery Process (SDDP). The contractor shall utilize and follow the SDDP as guidance when it has been approved for the definition, design, acquisition, implementation and delivery of warfighter capabilities. The SDDP is applicable to large and small scale problems and can be used to implement IT capabilities of all sizes and types across all mission areas and all security domains. The SDDP is captured in AFMAN 10-606 and implements AF Policy Directive 10-6, Capabilities-Based Planning & Requirements Development and AF Instruction 10-601, Capabilities-Based Requirements Development, by providing guidance for developing and implementing Doctrine, Organization, Training, Materiel, Leadership, Personnel and Facilities DOTMLPF requirements, including IT capabilities.

4.2.2 Architecture and System Design. The contractor shall support the design and development of systems and applications and their integration into the overarching enterprise architecture. The contractor shall provide all required design and development documents, and supporting architectural documentation, for any frameworks as identified in this contract.

4.2.2.1 Department of Defense Architectural Framework (DoDAF) Guidance. The contractor shall provide all required design and development documents, and supporting architectural documentation in compliance with the latest Department of Defense Architectural Framework (DoDAF) Enterprise Architecture guidance version 2.02 established in August 2010.

4.2.2.2 Capabilities Integration Environment (CIE). The contractor shall make considerations for any development, integration, and testing that needs to successfully complete the CIE process for information technology solutions and standardized DOD target infrastructures. The CIE provides a compliant capability with a set of enterprise services in support of proofs of concept, development, integration, and test activities in an accredited environment.

4.2.2.3 Federal Desktop Core Configuration (FDCC). All services provided under this Contract shall function and be in compliance with the Federal Desktop Core Configuration (FDCC).

4.2.3 Configuration Management. The contractor shall accomplish Configuration Management (CM) activities, coordinate for government approval within five days of identified need for a change or update. CM activities include baseline identification, change control, status accounting, and auditing. 100% compliance, the contractor shall establish and maintain a configuration management process as prescribed by AF procedures and participate in a Configuration Control Board (CCB) meeting, which is chaired by the Government. The CCB will control changes to the software/hardware configuration and record and report change processing and implementation status. (CDRL A014 DI-SESS-80858C)

4.2.4 Testing. The contractor shall conduct rapid testing and deployment of Core Data Services and Aggregation and Presentation Layer Services using distributed testing environments. The contractor shall develop dynamic testing environments to support C&A and functional testing.

4.2.4.1 Product/System Integration Testing. The contractor shall perform testing and inspections of all system services to ensure the technical adequacy and accuracy of all work, including reports and other documents required in support of that work. The contractor shall conduct on-site testing when requested. When specified by the Government, the contractor shall participate with the Government in testing the complete system or application which may include premise equipment, distribution systems or any additional telecommunications equipment or operating support systems identified in the contract. After appropriate corrective action has been taken, all tests including those previously completed related to the failed test and the corrective action shall be repeated and successfully completed prior to Government acceptance. Pre-cutover audits will consist of verification of all testing completed by the contractor such that the system is deemed ready for functional cutover. As part of this audit, any engineered changes or approved waivers applicable to the installation will be reviewed and agreed upon between the contractor and the Government. Post-cutover audits will verify that all post-cutover acceptance testing has been performed satisfactorily IAW the standard practices and identify those tests, if any, which have not been successfully completed and must be re-tested prior to acceptance. Testing shall be performed in two steps: operational testing, then system acceptance testing. The contractor shall provide a logical test process that minimizes interruptions and avoids sustained downtime and presents a contingency procedure to be implemented in the event of systems failure during testing.

4.2.4.2 Simulated Operational Testing. The contractor shall conduct testing ranging from data entry and display at the user level combined with system loading to represent a fully operational system. The contractor shall accomplish operational testing IAW the Government-approved test plan as specified in the contract. The plan shall consist of a program of tests, inspections and demonstrations to verify compliance with the requirements of this Contract. The contractor shall document test results in the test report(s). The contractor shall furnish all test equipment and personnel required to conduct operational testing. During the installation/test phase, the Government reserves the right to perform any of the contractor performed inspections and tests to assure solutions conform to prescribed requirements. The contractor shall be responsible for documenting deficiencies and tracking them until they are resolved. The Government will not be expensed for correcting deficiencies that were the direct result of the contractor’s mistakes. (CDRL A010DI-IPSC-81438A)

4.2.4.3 Acceptance Testing. The contractor shall provide on-site support during the acceptance-testing period. Acceptance testing shall be initiated upon acceptance of the operational test report and approval of the acceptance test plan. If a phased installation concept is approved in the Systems Installation Specification Plan (SISP), acceptance shall be based on the increments installed IAW the SISP. This on-site support shall be identified in the acceptance test plan. (CDRL A009 DI-QCIC-80553A)

4.2.4.4 System Performance Testing. The contractor shall provide system performance testing. The acceptance test will end when the system or application has maintained the site-specific availability rate specified in this contract. In the event the system or application does not meet the availability rate, the acceptance testing shall continue on a day-by-day basis until the availability rate is met. In the event the system or application has not met the availability rate after 60 calendar days, the Government reserves the right to require replacement of the component(s) adversely affecting the availability rate at no additional cost. (CDRL A009 DI-QCIC-80553A)

4.2.5 Information Assurance. The contractor shall ensure that all system or application deliverables meet the requirements of DoD and AF Information Assurance (IA) policy. Furthermore, the contractor shall ensure that personnel performing IA activities obtain, and remain current with, required technical and/or management certifications.

4.2.5.1 System IA. For those solutions that will not inherit existing network security controls, and thus integrate an entirely new application system consisting of a combination of hardware, firmware and software, system security assurance is required at all layers of the TCP/IP DoD Model. The contractor shall ensure that all system deliverables comply with DoD and AF IA policy, specifically DoDI 8500.2, Information Assurance Implementation, and AFI 33-200, AF Cybersecurity Program Management. To ensure that IA policy is implemented correctly on systems, contractors shall ensure compliance with DoD and AF Certification & Accreditation policy, specifically DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology, and AFI 33-210, Air Force Certification and Accreditation Process (AFCAP). The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.2.5.2 Application IA. For those solutions that will be deployed to Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or similar environments, and thus inherit existing network security controls, application security assurance is required at the Application layer of the TCP/IP DoD Model. The contractor shall ensure that all application deliverables adhere to Public Law 111-383, which states the general need for software assurance. Specifically, the contractor shall ensure that all application deliverables comply with the Defense Information Systems Agency (DISA) Application Security & Development Security Technical Implementation Guide (STIG), which includes the need for source code scanning, the DISA Database STIG, and a Web Penetration Test to mitigate vulnerabilities associated with SQL injections, cross-site scripting, and buffer overflows. The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.2.5.3 Personnel IA. Personnel performing Information Assurance (IA) activities are required to obtain, and remain current with, technical and/or management certifications to ensure compliance with DoD 8570.01-M, Information Assurance Workforce Improvement Program.

4.3 Portfolio Management and Certification/Accreditation Processes

4.3.1 RMF Comprehensive Package Updates. The Contractor shall submit to the COR all pertinent artifacts of a RMF Comprehensive Package as new requirements are incorporated or application changes occur. Update and maintain required Information Assurance and other certification-related documentation and supporting coordination for ECT. (e.g., FISMA, NDAA, C&A, RMF, etc.). 100% compliance; no late reporting or documentation submission, delinquent updates nor lapse in authorization to operate. (CDRL A004 DI-IPSC-81427A)

4.3.2 The contractor shall support the program manager in the execution of the portfolio management process and the certification and accreditation process by generation of artifacts and conducting annual test and review of security controls.

4.3.3 The contractor is responsible for assuring that the IA requirements have been identified and included in the design, acquisition, installation, operation, upgrade, or replacement of all AFRC Information Systems. As stated in DoD 8500.01E, DoD Information System is a set of information resources organized for the collection, storage, processing, maintenance, use, sharing, dissemination, disposition, display, or transmission of information. Information Assurance compliance includes AIS applications, Standalone Systems, Enclaves Environments, Outsourced IT-based processes, SOA Services, Platform IT interconnections and IT Products Services & Applications CDRL A011 DI-IPSC-81439A)

4.3.4 AFRC IT system procurements and IT services contracts in support of systems require an approved Acquisition Information Assurance Strategy defined in DoD Instruction 8580.1. The Acquisition Information Assurance Strategy will include the deployment and documentation of IA controls commensurate with those defined for each of the Mission Assurance Categories (MAC) in accordance with DoD Instruction 8500.2.

4.3.5 All Government Off-The-Shelf (GOTS) and Commercial Off-The-Shelf (COTS) IA or IA-enabled products incorporated into DoD information systems must comply with the evaluation and validation requirements of NSTISSP No. 11. Such products must be satisfactorily evaluated and validated either prior to purchase or as a condition of purchase. Evidence shall include a vendor's warrant, in their responses to a solicitation and as a condition of the contract, that the vendor's products will be satisfactorily validated within a period of time specified in the solicitation and the contract of purchase. Purchase contracts shall specify that product validation will be maintained for updated versions or modifications by subsequent evaluation or through participation in the National IA Partnership Assurance Maintenance Program or the Common Criteria Recognition Arrangement Assurance Maintenance Program.

4.4 Enterprise Architecture capability will be established within functional areas to develop a federated, capabilities-based architecture comprised of views, methods, data, and relationships to ensure AFR business processes are fully documented and aligned with Air Force Reserve strategic goals and objectives.

4.5 AFR contractors delivering software solutions to AFR will support the development of EA products to provide a more complete definition of the AFR current (baseline) or desired (target) operational process and enabling environment. Such architectural documentation is required to facilitate effective decision making, drive transformation, justify expenditures, support Information Assurance (IA) requirements, and reveal opportunities for future efficiencies. Roles and responsibilities are described in Table 1.

Table 1 Roles & Responsibilities

· Provide access to required documentation and subject matter experts for information collection to adequately develop DoDAF products

· Develops and/or updates architectural products in support of AFR capabilities, systems, or initiatives in accordance with AFR architectural standards

· Leverages existing AFR architecture artifacts to meet AFR architecture requirements

· Creates or leverages applicable product deliverables (Process Maps) to adequately describe capability

· Ensures the AFR architecture is of appropriate completeness and accuracy to federate with the AF/ EA.

· Creates and/or update EA Artifacts which will include, but are not limited to:

· AV-1: Overview and Summary Information

· AV-2: Integrated Dictionary

· CV-1: Vision

· CV-3: Capability Taxonomy

· DIV-1: Conceptual Data Model

· DIV-2: Logical Data Model

· OV-1: High Level Conceptual Graphic

· OV-2: Operational Resource Flow Description

· OV-3: Operational Flow Resource Matrix

· OV-5a: Operational Activity Decomposition Tree

· OV-5b: Operational Activity Model

· OV-6c: Event-Trace Description

· SV-1: Systems Interface Description

· SV-2: Systems Resource Flow Description

· SV-4: Systems Functionality Description

· SV-5a: Operational Activity to Systems Function Traceability Matrix

· SV-5b: Operational Activity to Systems Traceability Matrix

· SV-6: Systems Resource Flow Matrix Service Development will include, but is not limited to:

· SvcV-1: Service Context Description

· SvcV-2: Services Resource Flow Description

· SvcV-3a: System-Services Matrix

· SvcV-3b: Services-System Matrix

· SvcV-4: Services Functionality Description

· Provides inputs to program overviews/leadership briefings

· Provides updates to architectural products to reflect changes to capability, system, or initiative

The contractor shall deliver all architecture documents in accordance with DoD Architecture Framework version 2.0 (DoDAF 2.0). All architectural artifacts/documents shall be generated in IBM Rational System Architect or compatible format.

4.6 System Oriented Architecture (AFR SOA Environment)

4.6.1 AFRC utilizes a community SOA Environment as a means of data exposure and writing reusable services as opposed to building and embedding multiple copies of business logic in to applications. All vendors working on AFRC code/systems are expected to embrace and leverage the AFRC SOA environment both for the consumption of standard services and data elements and for the fielding of standard services that may be consumed and re-used by others. Specifically the Contractor shall provide technical advice to the Government on how to leverage the AFRC SOA environment for services-based data sharing and/or an AFRC SOA services fielding.

4.6.2 The contractor shall utilize and exploit the technologies and tools. (i.e. libraries, repositories, and/or registries for interface definitions, semantics, vocabularies, metadata, as well as discovery services) provisioned in the AFRC SOA Environment to the maximum extent possible in meeting the deliverables of this contract

4.7 Support to ECCB: AFRC uses an Enterprise Configuration Control Board to govern software requirements approval and software code testing and release processes. The contractor shall support the program manager in the ECCB process for configuration management of AFRC code.

4.8 Commercial Computer Software and Computer Software Documentation. The contractor shall submit computer software and/or computer software documentation acquired for performance of this requirement to the COR. Pursuant to DoD policy set forth in Defense Federal Acquisition Regulation (DFARS) Part 227.7202-3, the Government will only have the rights specified in the commercial license under which the commercial computer software or commercial computer software documentation is obtained. (CDRL#A001 DI-AVCS-80700)

4.9 Inspections. The contractor shall keep records of inspections which will be made available to the COR electronically throughout the contract performance period and through final settlement of any claims under this contract.

4.10 Period of Performance. This is a D-type requirements contract. The initial ordering period is six months, with four one-year ordering periods thereafter. A specific period of performance will be cited for each task order issued.

4.11 Place of Performance. On-site Contractor personnel shall perform at the office of the Command Surgeon (SG), Robins AFB GA, Bldg. 549; 78 MDG, Bldg. 700 Rm 1064 and AFRC Network Operations Support Center (NOSC), HQ AFRC/A6NS Robins AFB GA 31098, Bldg. 210.

4.12 Normal Work Hours. The on-site Contractor’s will be available to the government from 0730 until 1630 (local time), Monday through Friday, excluding federal holidays. The Government reserves the right to change the hours at any time. The Contractor shall support all Unit Training Assemblies (UTAs), two weekends of the month, remotely.

4.13 Federal Holidays. The Contractor shall not have staff present at the government installation facilities on federal holidays.