Attachment 1 - Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT (PWS)

for

HILL ENTERPRISE DATA CENTER SUSTAINMENT, MODERNIZATION AND

CONSOLIDATION

14 January 2020

75TH AIR BASE WING (75 ABW) COMMUNICATIONS DIRECTORATE

Hill AFB, UT 84056-5825

DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.

Table of Contents

1 INTRODUCTION

1.1 PURPOSE

1.2 SCOPE OF WORK

1.3 PERIOD OF PERFORMANCE

2 CORE DUTIES

2.1 SYSTEMS ENGINEERING

2.2 ARCHITECTURE AND SYSTEM DESIGN

2.3 AIR FORCE COMMON COMPUTING ENVIRONMENT (AF CCE)

2.4 FEDERAL DESKTOP CORE CONFIGURATION (FDCC)

2.5 REQUIREMENTS MANAGEMENT SYSTEM

2.6 CONFIGURATION MANAGEMENT

2.7 CHANGE MANAGEMENT PROCESSES

2.8 TESTING

2.9 PRODUCT/SYSTEM INTEGRATION TESTING

2.10 OPERATIONAL TESTING AND VULNERABILITY MITIGATION

2.11 CYBERSECURITY

2.12 SYSTEM CYBERSECURITY

2.13 CONTRACTOR CYBERSECURITY AND INFORMATION ASSURANCE

TRAINING AND CERTIFICATION

3 CONTRACTOR TASKING REQUIREMENTS

3.1 FIRM FIXED PRICE MINIMUM TEAM COMPLEMENT (FFP MTC)

3.2 UNANTICIPATED WORKLOAD REQUIREMENTS

EXPEDITED REQUIREMENTS

OVER AND ABOVE REQUIREMENTS

EMERGENCY SERVICES

3.3 HILL ENTERPRISE DATA CENTER CAPACITY PLANNING

3.4 HILL ENTERPRISE DATA CENTER HOSTING SUSTAINMENT

3.5 HILL ENTERPRISE DATA CENTER ADVANCED SERVICES

3.6 EVOLVE APPLICATIONS AND ARCHITECTURE ON HEDC HOSTING

PLATFORMS

3.7 ORACLE

3.8 MICROSOFT

3.9 IBM

3.10 VMWARE

3.11 RED HAT

3.12 BMC SOFTWARE

3.13 DELL EMC

3.14 HEWLETT PACKARD ENTERPRISE (HPE)

3.15 F5 NETWORKS

3.16 SIEMENS

3.17 INTEL

3.18 CISCO

3.19 OTHER TECHNOLOGIES

3.20 SUBJECT MATTER EXPERTS (SME)

3.21 DESIGN, IMPLEMENT, AND OPTIMIZE ENTERPRISE ARCHIVE AND

BACKUP SOLUTIONS FOR ON-PREMISE AND CLOUD

3.22 CONSOLIDATE SYSTEMS ADMINISTRATION AND ORACLE DATABASE

ADMINISTRATION

3.23 PRODUCTION OPERATIONAL SUPPORT

3.24 PORTABLE OPERATING DATA CENTERS (POD)

3.25 DATA ANALYTICS AS A SERVICE (DAaaS)

3.26 MODERNIZATION, STANDARDIZATION, CONSOLIDATION AND

OPTIMIZATION

3.27 CONSOLIDATE APPLICATIONS TO HEDC APPLICATION HOSTING

PLATFORMS

3.28 SYSTEM ONBOARDING

3.29 HEDC BUSINESS OFFICE

3.30 HEDC INFORMATION TECHNOLOGY INFRASTRUCTURE LIBRARY (ITIL)

PROCESS OWNER

3.31 IMPLEMENT ENTERPRISE MONITORING, SERVICE LEVEL AND

SHOWBACK REPORTING

3.32 IMPLEMENT AND SUPPORT PRODUCTION DIELECTRICALLY COOLED

CONTAINERIZED DATA CENTERS (CDC) HARDWARE

4 PROGRAM MANAGEMENT

4.1 GOVERNMENT PROGRAM MANAGEMENT (GPM)

4.2 GOVERNMENT CONTRACT OFFICER

4.3 CONTRACTOR PROGRAM MANAGEMENT

4.4 CONTRACTOR PROGRAM MANAGER

4.5 CYBERSECURITY PROJECT MANAGER

4.6 SUSTAINMENT PROJECT MANAGER

4.7 INFRASTRUCTURE PROJECT MANAGER

4.8 ONBOARDING PROJECT MANAGER

5 CONTRACTUAL REQUIREMENTS

5.1 HOURS OF OPERATION

5.2 ACCESS TO GOVERNMENT FACILITIES AND PROPERTY

5.3 GOVERNMENT FURNISHED FACILITIES

5.4 USE OF GOVERNMENT PROPERTY EQUIPMENT, MATERIALS, AND

SOFTWARE

5.5 CONTRACTOR REPRESENTATION AND PRESENTATION

5.6 SERVICES SUMMARY

5.7 ORDERING PROCEDURES

5.8 GOVERNMENT PROVIDED SERVICE PLAN

5.9 DOCUMENTATION AND DATA MANAGEMENT

5.10 RECORDS, FILES, AND DOCUMENTS

5.11 CONTRACTOR EMPLOYEES

5.12 MANPOWER REPORTING

5.13 PERSONNEL SECURITY

5.14 TRAVEL

5.15 INHERENTLY GOVERNMENT FUNCTIONS/PERSONAL SERVICES

5.16 NON-PERSONAL SERVICES

5.17 MEETINGS

5.18 MONTHLY STATUS REPORT

5.19 PROGRAM MANAGEMENT REPORT AND PROGRAM MANAGEMENT

REVIEW

5.20 DATA CALLS

5.21 DATA RIGHTS

5.22 DATA RIGHTS AND NON-COMMERCIAL COMPUTER SOFTWARE

5.23 CYBERSECURITY TRAINING AND ACCESS

5.24 CONFIDENTIALITY

5.25 QUALITY ASSURANCE MONITORING AND OBSERVATIONS

5.26 CONTRACTING OFFICER REPRESENTATIVE (COR)

5.27 RECORDS

5.28 PARTICIPATION AND GOVERNMENT ACTIVITIES

5.29 TRAINING

5.30 CONTINUING TRAINING

5.31 GOVERNMENT PROVIDED TRAINING

5.32 ADHERENCE

5.33 SECTION 508 OF THE REHABILITATION ACT

5.34 CONTINUATION OF CONTRACTOR SERVICES

5.35 PHASE-IN PERIOD

POST-AWARD CONFERENCE

5.36 PHASE-OUT PERIOD

6 PHYSICAL SECURITY AND SAFETY REQUIREMENTS

6.1 PHYSICAL SECURITY REQUIREMENTS

6.2 DAMAGE TO GOVERNMENT FACILITY OR PROPERTY

6.3 MAJOR MISHAP

6.4 INVESTIGATION

6.5 SUBCONTRACTOR COOPERATION

6.6 ACCESS TO THE BASE NETWORK

6.7 REQUIRED NETWORK TRAINING

6.8 DISABLING ACCOUNTS

6.9 COMPUTER CONNECTIVITY

6.10 VIRTUAL PRIVATE NETWORK (VPN)

6.11 CHECKLISTS

6.12 VOLUNTARY PROTECTION PROGRAM (VPP)

6.13 OCCUPATIONAL SAFETY AND HEALTH ACT (OSHA) COMPLIANCE

6.14 SUBCONTRACTOR FLOW DOWN

6.15 FREEDOM OF INFORMATION ACT (FOIA)

6.16 NON-DISCLOSURE

6.17 OPERATIONS SECURITY

OPSEC TRAINING

7 APPLICABLE STANDARDS AND REFERENCES

7.1 PUBLICATIONS

7.2 INTERNAL OPERATING PROCEDURES

7.3 RECORDS, FILES, DOCUMENTS AND WORK PAPERS

7.4 ENVIRONMENTAL PROTECTION AND SAFETY

8 SERVICES SUMMARY

8.1 SERVICES SUMMARY

9 DATA DELIVERABLES

9.1 Contract Data Requirements List (CDRLs)

9.2 GENERAL MARKING INSTRUCTIONS

9.3 RECORD RETENTION

APPENDIX A

APPENDIX B

APPENDIX C

APPENDIX D

1 INTRODUCTION

1.1 PURPOSE

The purpose of this effort is to provide Information Technology (IT) Professional Subject Matter

Expertise (SME) in Enterprise Architecture, Engineering, and Services support including engineering, infrastructure architecture design, product councils, modernization, consolidation, hosting, Business Case Analysis (BCAs), Economic Analysis (EA), Analysis of Alternatives

(AOAs), Conference Room Pilots (CRPs), cybersecurity, and technical and program/project management support services to the 75th Air Base Wing Communications and Information

Directorate (75 ABW/SC) at Hill Air Force Base (HAFB), Utah and 16 other Continental United

States (CONUS) Hill Enterprise Data Center (HEDC) Wide Area Network (WAN) Point of

Presence (PoP) Portable Operating Data Center (POD) locations for HEDC workload. The HEDC is comprised of world-class data centers managed by the 75 ABW/SC hosting over 2000 physical and virtual servers servicing 250+ applications.

This effort also provides IT Professional Support and Engineering Services for modernization efforts for the 309th Maintenance Complex at HAFB. The IT Directorate is responsible for facilitating the installation and implementation of the commercial off-the-shelf (COTS) Depot

Maintenance and Logistics system Modernization effort within the HEDC.

This effort includes, but not limited to: the creation/update and implementation of management policies, organizational structure, systems and procedures necessary to support the Department of

Defense (DoD) onboarding, administration, performance tuning, disaster recovery planning, enterprise networking, and technical management necessary to support current customer applications in the following: HEDC and HEDC-Classified networks, hosted cloud environments, designated cloud environments, or a hybrid of both hosted and designated cloud environments when course of action (COA) is approved. For purposes of this PWS “cloud” is defined as “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

1.2 SCOPE OF WORK

The scope of this contract is to provide engineering, continual architecture design and sustainment, application onboarding, operations support, and program/project management services to continue

HEDC Lifecycle support and evolve the HEDC’s current application hosting Platform-as-a-

Service (PaaS), Software-as-a-Service (SaaS), traditional and cloud native application on-boarding, architecture design, engineering modernization, and quality and configuration management in both the classified and unclassified enclaves.

Service requirements include, but not limited to, Subject Matter Expertise in the following areas:

VMware Server Virtualization & Cloud Infrastructure, storage area networks, Windows and Linux operating system engineering, Oracle and Windows database engineering, Red Hat Enterprise

Virtualization (RHEV), and Agile methodologies. The HEDC hosting environment supports applications, database systems, file, print, and web services for a wide variety of Air Force customers, including depot maintenance and logistics operations customers. These services host and sustain a variety of functional platforms and systems in both classified and unclassified enclaves.

Enforcement of National Defense Authorization Act (NDAA) 2012, Public Law 112-81, has forced compliance to consolidate applications per the Office of Management and Budget (OMB) directives of Cloud First, Cloud Smart, and Federal Data Center Consolidation Initiative (FDCCI).

With the closure and consolidation of under-performing data centers and the optimization of the data centers remaining in the Federal inventory, considerable funds will be saved. The Data

Center Optimization Initiative (DCOI) established in OMB Memorandum M-16-19 supersedes the

FDCCI and fulfills the data center requirements of the Federal Information Technology

Acquisition Reform Act (FITARA). The DCOI requires agencies to:

Develop and report on their data center strategies

Transition to more efficient infrastructure, such as cloud services and inter-agency shared services

Leverage technology advancements to optimize infrastructure

Provide quality services for the public good.

The contractor shall document how activities meet these DCOI requirements.

As the certified Hill AFB Installation Processing Node (IPN), the HEDC must continually develop plans for the onboarding and consolidation of applications and systems for these new customers.

The routine Task Orders (TO) based on this Performance Work Statement (PWS) will facilitate contractor cost estimates for new customer application/system onboarding and consolidation requirements on premises and in any potential cloud environment as determined by HEDC requirements. Over and Above work will be determined by government requirement and is detailed in section 3.2 of this PWS.

1.3 PERIOD OF PERFORMANCE

The total potential Period of Performance (PoP) for the HEDC SMaC will be 7 years. The basic

HEDC SMaC contract will have an ordering period of 5 years and a 6 year PoP. It will include a 1-year option to extend the ordering period and PoP.

2 CORE DUTIES

The Contractor shall provide full time equivalency (FTE) personnel so that Engineering services are provided concurrently with other services, including but not limited to: onboarding, sustainment, and project management.

2.1 SYSTEMS ENGINEERING

The contractor shall employ disciplined systems engineering processes including, but not limited to, requirements development, technical management and control, system/software design and architecture, integrated risk management, configuration management, data management, and test, evaluation, verification and validation practices throughout the period of performance (POP) of

TOs in accordance with Air Force Instruction (AFI) 20-1401, Integrated Lifecycle Management and the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-160, Systems Security Engineering. The contractor shall provide reengineering capabilities to examine structures, systems and roles for the purpose of executing a ground-up redesign for achieving long-term, full-scale integration required for the DoD Information Network (DODIN). The contractor shall diagnose software failures and develop and implement solutions in coordination with the PM, implement and ensure security preventative measures are fully functioning, and monitor and enhance system performance.

2.2 ARCHITECTURE AND SYSTEM DESIGN

The contractor shall support the design and development of systems and applications and their integration into the overarching enterprise architecture. The contractor shall provide all required design and development documents, and supporting architectural documentation, for any frameworks as identified in the TO PWS.

2.3 AIR FORCE COMMON COMPUTING ENVIRONMENT (AF CCE)

All services provided under this Basic PWS shall function and be in compliance with the Air Force

Common Computing Environment (AF CCE) or its successors.

2.4 FEDERAL DESKTOP CORE CONFIGURATION (FDCC)

All services provided under this Basic PWS shall function and be in compliance with the Federal

Desktop Core Configuration (FDCC) or its successors.

2.5 REQUIREMENTS MANAGEMENT SYSTEM

The approved Automated Information System (AIS) the Contractor shall use is the 75 ABW/SC system of choice (currently BMC Remedy) for customer requirements or “system enhancements” in the form of work orders and “bugs” in the form of incidents to clearly document, manage, obtain approval, and track them throughout the requirement life cycle. The COR will track performance delivery of customer requirements and resolution of incidents in accordance with IAW the Service

Summary Table 8-1 in this PWS.

2.6 CONFIGURATION MANAGEMENT

The contractor shall develop and maintain a configuration baseline consistent with established 75

ABW/SC configuration management plan for hardware, software, and infrastructure incorporating all development, testing, and change processes, and configuration changes. CM activities include, but are not limited to: baseline identification, change/configuration control, status accounting and auditing. (CDRL A/B/C/D007)

The contractor shall maintain and report all source codes, scripting, software licenses, use restrictions, maintenance agreements, user manuals, and configuration documentation in the 75

ABW/SC designated repository. (CDRL A/B/C/D012)

2.7 CHANGE MANAGEMENT PROCESSES

The Contractor shall manage and track all change activities. All new customer requirements and configuration changes shall be submitted into the approved AIS for submission to the appropriate review board for approval prior to development, testing, and implementation following the 75

ABW/SC change control process. Contractor personnel will participate in requirement review boards, configuration control boards, software and technical review boards, and Agile standup/review meetings to obtain approval for all configuration changes to the environment prior to proceeding with work. (CDRL A/B/C/D007)

2.8 TESTING

The contractor shall conduct rapid testing and deployment of Core Data Services, Aggregation, Presentation Layer Services, and other required services using distributed testing environments.

The contractor shall develop dynamic testing environments to support customer acceptance and functional testing. The contractor shall test COTS software for vulnerabilities and draft No

Security Impact (NSI) letters for HEDC Information System Security Manager (ISSM) approval and signature to allow software use on HEDC enclave.

2.9 PRODUCT/SYSTEM INTEGRATION TESTING

The contractor shall perform testing and inspections of all system services to ensure the technical adequacy and accuracy of all work, including reports and other documents required in support of that work. The contractor shall conduct on-site testing when required by the Government. When specified by the Government, the contractor shall participate with the Government in testing the complete system or application which may include, but not limited to: premise equipment, distribution systems or any additional telecommunications equipment or operating support systems identified in the TO. After appropriate corrective action has been taken, all tests including those previously completed related to the failed test and the corrective action must be successfully re-completed prior to Government acceptance. The contractor shall provide a logical test process that minimizes interruptions, avoids sustained downtime, and presents a contingency procedure to be implemented in the event of systems failure during testing.

2.10 OPERATIONAL TESTING AND VULNERABILITY MITIGATION

The contractor shall conduct testing ranging from data entry and display at the user level combined with system loading to represent a fully operational system. The Contractor shall perform operational testing with the user to verify software and external interface functionality. Contractor shall ensure customer verification, validation and approval of any system changes prior to any changes being deployed to the production environment. Any bug, flaw, vulnerability, or known attack surface identified during security scans shall be documented and mitigated IAW 75

ABW/SC processes and security policies prior to deployment of changes to the production environment.

2.11 CYBERSECURITY

The Contractor shall ensure that all system or application deliverables meet the requirements of

DOD and AF Cybersecurity policy.

The Contractor shall ensure that all Cybersecurity requirements are identified and included throughout the lifecycle of systems to include acquisition, design, development, developmental testing, operational testing, integration, implementation, operation, upgrade, or replacement of all

IT supporting the transport, receipt, processing, and/or storage of DOD Controlled Defense

Information (CDI). Minimally, all DOD owned IT contain sensitive, non-publically releasable information typically referred to as Controlled Unclassified Information (CUI).

Cybersecurity must be fully integrated into system life cycles so that it is a visible element of organizational, joint, and DOD Component architectures; capable of identification and development processes, integrated testing, IT portfolios, acquisition, operational readiness assessments, supply chain risk management, System Security Engineering, and operations and maintenance activities.

Cybersecurity requirements for this effort include, but are not limited to

1. Program Management - Cybersecurity personnel staffing, Cybersecurity training for program office personnel, specialized cybersecurity training/certifications/background investigations for cybersecurity staff, Executing the Risk Management Framework

(RMF) IAW DoD Instruction 8510.01, Executing the Cybersecurity Framework IAW

NIST Special Publication 800-171, Cybersecurity incident response implementation.

2. Systems Security Engineering - Cyber/Information Technology Information/System

Owner; Cybersecurity requirements evaluation; Cyber-attack surface characterization;

Interaction with the intelligence community for threat assessments; Conduct trusted systems and networks analysis (including criticality analysis); Development of the program protection plan (including cybersecurity strategy); Support on RMF compliance tasks/documents (security assessment plan.); Develop system-level cybersecurity architecture; Design, develop and implement cybersecurity controls;

Develop approaches to mitigate cybersecurity system vulnerabilities; Ensure the design of hardware, operating systems and software applications adequately address cybersecurity requirements for the system; Cybersecurity support to technical reviews;

Trade space analysis between security controls, system functional performance requirements, and costs of affordable/risk acceptable mitigations; and Cybersecurity configuration management including baseline management, asset valuation, configuration item (CI) tree development maintenance and sustainment.

3. Test and Evaluation - Cooperative vulnerability identification;Adversarial cybersecurity developmental test and evaluation; Cooperative vulnerability and penetration assessment; Adversarial assessment; Cybersecurity compliance tracking and reporting;

Software assurance (e.g., secure coding testing, vulnerability scanning); Hardware assurance; Malware scanning; detection and prevention; Cybersecurity test infrastructure planning/usage; Mission-based cyber risk assessments (e.g., cyber table tops).

4. Logistics - Supply chain risk management, Patch and vulnerability management, RMF reauthorization, Continuous monitoring, periodic security control assessment, Disposal

(e.g., media sanitization, destruction) IAW the RMF Knowledge Now

(www.rmfks.osd.mil) security controls explorer defined quantities and timelines, unless otherwise designated and approved within the eMASS package by the appropriate DoD

Authorization Official (AO). For example, Air Force Assess Only Platform IT products or services package requirements as defined in the Air Force Component

Workspace, Documents section.

5. Certification - Appropriate Level 3 certification requirements for the Cybersecurity

Maturity Model Certification (CMMC) Guide v.06 within 12 month of mandate.

2.12 SYSTEM CYBERSECURITY

The Contractor shall ensure that all system deliverables comply with DOD and AF Cybersecurity and Information Assurance policies, specifically Department of Defense Instruction (DODI)

8500.01, Cybersecurity; DoDD 8570.01-M and updated 8140.01 for IAT, IAM, IASAE, and CND, and AFI 17-130 Cybersecurity Program Management; and, NIST SP 800-39. The Contractor shall protect system information and resources according to established security policies and procedures and ensure systems are updated with the latest security patches to minimize security vulnerabilities. The Contractor shall provide documentation and confirm that system changes comply with the DoD security policy and are properly certified and accredited in accordance with the current DODI 8510.01; Risk Management Framework (RMF) DOD IT. Shall ensure consistency with established disciplines and best practices for effective systems engineering, systems security engineering, and program protection planning outlined in the current DODI

5000.02. The Contractor shall provide documentation to support RMF authorization and accreditation (CDRL A/B/C/D003). The 75 ABW/SC will review all RMF documentation for possible non-security impact approval. The Contractor shall implement procedural countermeasures and Government-issued technical advisories including STIGs, Notices to Airmen

(NOTAM), Time Compliance Network Order (TCNO), Field Engineering Notices (FEN), System

Advisory Notices, Heads Up Messages (HUM), Air Force Computer Emergency Response Team

(AFCERT) notices, Time Compliance Technical Order (TCTO), Information Condition

(INFOCON) Changes, service packs and security patches according to AFCERT or Automated

System Security Incident Support Team (ASSIST) guidance within the timeframe specified. The

Contractor shall report monthly completion of all Government-issued technical advisories as described in this paragraph to the Government Program Manager (GPM), Government Information

Systems Security Manager (GISSM) and COR (see AFGM2018-17-02 for further information).

(CDRL A/B/C/D003)

2.13 CONTRACTOR CYBERSECURITY AND INFORMATION ASSURANCE

TRAINING AND CERTIFICATION

The Contractor employees shall receive initial cybersecurity and information assurance awareness orientation as a condition of access, and thereafter must complete annual cybersecurity and information assurance refresher awareness. The Contractor shall ensure that personnel accessing Information

Systems have the proper training and current cybersecurity authorization to perform cybersecurity functions IAW DoDI 8500.01, Cybersecurity. The Contractor shall meet the applicable cybersecurity authorizations and approval requirements, including DoD-approved cybersecurity workforce certifications appropriate for each category and level as listed in the current version of DoDI 8500.01;

and appropriate operating system credentials for cybersecurity technical positions as required by

DoDI 8500.01

Upon request by the Government, the Contractor shall provide documentation supporting the cybersecurity authorization and approval status of all personnel performing cybersecurity functions.

Contractor personnel who do not have proper and current certifications shall be denied access to

DoD information systems.

3 CONTRACTOR TASKING REQUIREMENTS

The Contractor shall provide IT Professional, Economic Analysis (EA), engineering, continual architecture design and sustainment, application onboarding, operations support, and program/project management services to continue HEDC Lifecycle support and evolve the HEDC’s current application hosting Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), traditional and cloud native application on-boarding, architecture design, engineering modernization, and quality/configuration management in both the classified and unclassified enclaves.

The Contractor shall furnish professional and technically qualified personnel to perform assigned tasking.

Tasks include, but are not limited to: tasks related to continuous PaaS, SaaS, Data Analytics as a Service

(DAaaS), application hosting, systems, storage, virtualization, and network support that will continue through the term of the contract. In addition, to those tasks required to sustain the level of service provided to current and future customers. HEDC utilizes extensive capabilities based on software

Enterprise License Agreement (ELAs) to provide securely managed software-defined application service offerings at the central HEDC sites and PODs managed by the central site. Specific Subject Matter

Expertise, extensive, proficient knowledge and experience is required in leading-edge and emerging technologies supporting all disciplines of Enterprise Applications hosted in a hybrid physical, virtual, and cloud environment.

3.1 FIRM FIXED PRICE MINIMUM TEAM COMPLEMENT (FFP MTC)

Utilizing only regular rates, the MTC will establish the labor mix, labor hours, and number of personnel required for effective performance on each TO. Based on the TO PWS, the Government and contractor may negotiate the MTC, which will consist of any or all of the following labor categories: Senior Manager, Program Manager, Subject Matter Expert, Sr. Admin Assistant, Principle software Engineer, Sr. Software Engineer, Software Engineer, Cybersecurity Analyst, Sr.

Systems Engineer, Systems Engineer, QA/Configuration Mgmt. Engineer, Professional Support

Staff, Jr. Professional Support Staff, Systems Analyst, Cybersecurity Manager. The contractor shall ensure the MTC specified in any applicable TO is maintained throughout each TO POP. The objectives of each TO MTC is a fully manned workforce on day one, and through the duration of the TO POP. This pertains to training, qualifications, proficiency, security clearance, background investigation and all other requirements in the TO and all associated requirements documents.

3.2 UNANTICIPATED WORKLOAD REQUIREMENTS

Due to the nature of the HEDC workload, the Government requires the flexibility to utilize

Expedited CLINs (0003, 1003, 2003, and 3003) or Over and Above CLINs (0004, 1004, 2004, and

3004) in order to meet unanticipated requirements after TO award. As HEDC workload fluctuates, the Government may require the contractor to perform services in support of mission critical, short suspense situations, outside normal sustainment and onboarding requirements, and as defined by the Government. These unanticipated requirements may utilize surge rates, overtime rates, regular rates, or a combination. Surge rates will be utilized when additional labor hours are performed by personnel not included in the current MTC. Overtime rates will be utilized when additional labor hours are performed by FTE personnel included in the current MTC. Regular rates will be utilized when additional labor hours are performed by non-FTE personnel included in the current MTC.

The proposal will be subject to negotiation of labor hours and labor mix. The Government will allow the contractor appropriate ramp up time for additional staffing when necessary and as defined within the TO PWS.

EXPEDITED REQUIREMENTS

Expedited requirements are defined as a government-directed need to accelerate the schedule by reducing TO PoP. The contractor shall be notified by the CO when an expedited situation is realized by the Government. The contractor shall provide a proposal to accomplish the expedited requirements. During an expedited requirement the original PoP will be modified to reflect the new accelerated schedule and TO PoP. Any billable performance from the original TO that is beyond the new TO PoP shall not be invoiced. The additional labor hours required to accomplish the accelerated schedule shall be placed on the expedited CLIN for invoicing.

OVER AND ABOVE REQUIREMENTS

Over and above requirements are defined as additional work discovered during the course of performance. The contractor shall be notified by the CO when an over and above situation is realized by the Government. The contractor shall provide a proposal to accomplish the over and above requirements. All over and above requirements and negotiations shall be conducted IAW DFARS Clause 252.217.7028.

EMERGENCY SERVICES

On occasion, services may be required to repair system outages or support network operations outside the normal duty hours. The contractor’s responsibilities for emergency support will be defined by the Government at the task order level and will be based on need.

During emergency services, contractor personnel shall shift normal duty hours to hours that will cover support for the outage or downtime. Any shifted hours caused by an emergency outage will be performed at the regular rate. When unplanned outages occur, the Contractor will provide an After Action Report to the COR within 3 business days to describe the issue, root cause and short and long term solutions to prevent the outage from occurring again

(CDRL A/B/C/D005).

3.3 HILL ENTERPRISE DATA CENTER CAPACITY PLANNING

The contractor shall develop a baseline and maintain a capacity planning strategy to support sustainment, modernization, and onboarding activities. Contractor shall ensure the HEDC will be able to meet the workload demands of its current and future customers. Capacity planning includes, but is not limited to: computing resources, power load, footprint, and cooling capacity.

The contractor shall perform capacity planning in accordance with the IT Infrastructure Library

(ITIL) Capacity Management Process. This includes, but is not limited to an initial Capacity

Baseline survey of the HEDC and Capacity Planning reports on a quarterly basis, (CDRL

A/B/C/D013), and white papers/studies to determine resource requirements and limitations (CDRL

A/B/C/D009).

3.4 HILL ENTERPRISE DATA CENTER HOSTING SUSTAINMENT

The Contractor shall use Agile processes and activities to complete the following requirements supporting secure hosting for existing customers:

1. Continuously refine architecture, engineering and sustainment of current cloud infrastructure to implement both a virtual and physical environment for large, complex application workloads supporting Enterprise Resource Planning (ERP), Product Lifecycle

Management (PLM), Enterprise Asset Management (EAM), Enterprise Performance

Management (EPM), Enterprise Portfolio and Performance Management (EPM/EPPM), Business and IT Service Management (BSM/ITSM), complex Maintenance Repair and

Overhaul (cMRO), and other COTS and Government Off The Shelf (GOTS) applications with their supporting technology stacks, vendor relationship management.

2. Continually improve, scale out, and refresh application systems to support End of Life

(EOL) End of Service (EOS) replacement.

3. Strategize proper architecture/configuration/optimization for the continued growth of the enterprise platforms, associated technology stacks, and applications in a non-disruptive upgrade and operations mode.

4. Ensure seamless inter-operability between all elements of the technology stack that comprise the platform through the integration and automation through the entire lifecycle including remediation of security vulnerabilities where possible.

5. Continuous engineering and testing of the application platform to reside across multiple availability zones (multiple data centers) so as to provide work load survivability, elasticity, and mobility while security policies are automatically enforced at all locations.

6. Maintain a continuous improvement cycle that supports constant, demonstrable improvement of the application platform and the application services provided to our customer. In particular, this cycle must address quantifiable improvements in security, time-to-value, performance, and reduced application latency while reducing costs.

Follow industry-recognized quality assurance methods to perform regular data-driven analysis of processes, including regular benchmarks that do full-depth tests of system performance and recoverability including Central Processing Unit (CPU), memory, disk, network connectivity, application performance, Recovery Time Objectives (RTO), Recovery Point Objectives (RPO) and responsiveness to users while compliance is being met for applicable Service Level Agreements (SLAs). Testing will be conducted in coordination with application owners and common service providers.

7. Document and diagram architecture plans and system configurations. Artifacts must be produced through policy-driven automation and enforcement provided by elements of the technology stack.

8. Engineer the best solution to fit the unique customer and DoD requirements utilizing industry best practices and Air Force/DoD regulatory guidance such as Defense

Information Systems Agency (DISA) Security Technical Implementation Guide (STIG)

Compliance. This process involves re-factoring customer systems to be successfully deployed into the HEDC PaaS, a designated cloud environment, or a hybrid of the two.

This will provide a reasonable balance between expedient system deployment, application modernization, and unwavering security continuous compliance.

9. Set up application systems for safe and rapid deployment into new or existing HEDC controlled engineered environments while those environments are continually improved, scaled out, and refreshed to support EOL and EOS replacement.

3.5 HILL ENTERPRISE DATA CENTER ADVANCED SERVICES

The Contractor shall provide advanced services to current hosted applications that require a higher level of support for sustainment. Advanced services include, but are not limited to:

1. Agile/Rapid Release Upgrade Model

The contractor shall provide resources to support frequent software deployments and upgrades as necessary to meet mission needs. These requirements may be considered beyond the scope of traditional sustainment and will be identified accordingly.

2. Increased Support Resources

The contractor shall provide additional resources for complex and/or labor intensive application support as necessary to meet mission needs. These requirements may be considered beyond the scope of traditional sustainment and will be identified accordingly.

Advanced services requirements may include, but are not limited to: frequent software deployments, continuous server service management requiring frequent administrator interaction, and direct customer support to meet customer demand.

3.6 EVOLVE APPLICATIONS AND ARCHITECTURE ON HEDC HOSTING

PLATFORMS

The Contractor shall provide service for current hosted applications services available in the

HEDC’s continuously evolving service catalog. The Contractor shall provide a comprehensive project team to support the architecture and entire customer service lifecycle. This is referred to as application services and architecture sustainment. Service offerings currently include, but are not limited to:

1. Storage Service

a. Edge/WAN PoP File Services

b. MS SharePoint Service

c. Performance Tier Storage

d. Object Storage

e. Near-Line Tier Storage

f. Archive-Tier Storage

g. Production Tier Copy Data Management (CDM) into minor Tiers (Environment as a Service (EaaS))

2. Backup & Recovery Service

a. Enterprise NetBackup Service

b. Oracle Active Data Guard

c. Oracle Flashback Recovery

d. Snapshot Replication

e. VMware Continuous Data Protection (CDP)

3. Relational Database Service

a. Oracle Database Enterprise Edition

b. Microsoft Structured Query Language (SQL) Server

c. PostgresSQL

d. MySQL

4. Security Service (CDRL A/B/C/D003)

a. Risk Management Framework (RMF) sustainment A&A

b. Security Compliance Engineering to improve security posture of HEDC infrastructure and hosted systems.

c. System categorization of HEDC infrastructure and hosted systems in order to provide appropriate Confidentiality, Integrity, and Availability (CIA).

d. Tailoring cyber security controls to hosted systems.

e. Continuous automated monitoring of compliance to implemented cyber security controls.

f. Risk Assessment

g. Threat and Vulnerability Assessment and Remediation

h. Security Baselines

i. CCRI Preparation

j. Develop Enterprise Security Architecture

k. Static Application Security Testing

l. Dynamic Application Security Testing

m. Penetration Testing

n. Cybersecurity Liaison duties

o. Software Baseline Testing

p. Hardware and Software Baseline Management

q. Security Analytics SecOPs

r. Encryption

i. Format Preserving Encryption (FPE)

ii. Encryption-At-Rest

iii. Encryption-In-Flight

iv. Encryption Key Management

s. Security Incident Handling

5. Analysis Support

a. Analysis of Alternatives (AoA) Service

b. Business Case Analysis (BCA)

c. Economic Analysis (EA)

d. Product Evaluations

e. Business Impact Analysis (BIA)

6. Rapid CRP Proof of Concept (PoC) Service

7. Enterprise Applications Service

a. Business Intelligence Services

b. Enterprise Project and Portfolio Management (EPPM)

c. Data Quality (DQ)

8. Engineered PaaS

a. Microsoft Ecosystem

b. Oracle Enterprise Ecosystem

c. Red Hat Linux

d. Java and Java Virtual Machine

e. Continuity of Operations (COOP)

f. Docker, LXC and other Container Ecosystems

g. Pivotal Cloud Foundry

9. Equipment Purchase and Tracking Support

a. Assist with developing Rough order of Magnitudes (ROMs), Bill of Materials, (BOMs), Brand Name Justifications (BNJs), and Justification and

Authorizations (J&As)

b. Track procurement deliveries and verify completeness

3.7 ORACLE

The Contractor shall monitor, administrate, and ensure recoverability and adherence of Oracle technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of Oracle products, including but not limited to:

Oracle Active Data Guard version 11g and higher

Oracle Advanced Security versions 11g and higher

Oracle Audit Vault and Database Vault Firewall version 12.x and higher

Oracle Business Intelligence Enterprise Edition + version 11.x and higher

Oracle Business Intelligence Publisher version 11g and higher

Oracle Compute Cloud Service

Oracle Database Backup Cloud Service

Oracle Database Cloud Service

Oracle Database Enterprise Edition version 11g and higher

Oracle Database Vault version 11g and higher

Oracle E-Business Suite ERP and verticals versions 12.x and higher

Oracle Enterprise Manager Cloud Control version 12c and higher with Diagnostics, Tuning, Middleware Management, Database Lifecycle Management, Data Masking and

Sub-setting Packs

Oracle EPPM version 16 and higher with Oracle WebCenter Content version 11g and higher

Oracle Forms and Reports version 12c and higher

Oracle Fusion Middleware version 10g and higher

Oracle Hyperion Planning EPM version 11 and higher

Oracle Identity and Access Management Suite version 12c and higher

Oracle Internet Directory (OID) version 11g and higher

Oracle Java Runtime Environment (JRE) and Java Development Kit (JDK) version 6 and higher

Oracle Java Cloud Service 18 and higher

Oracle partitioning versions 11g and higher

Oracle Primavera Portfolio Management (OPPM) version 16 and higher

Oracle Pro-C

Oracle Real Application Clusters version 11g and higher

Oracle Service-Oriented Architecture (SOA) version 11g and higher

Oracle Storage Cloud Service

Oracle Data Integrator 11g and higher

Oracle KeyVault 11g and higher

3.8 MICROSOFT

The Contractor shall monitor, administer, and ensure recoverability and adherence of Microsoft technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of Microsoft products, including but not limited to:

Microsoft Azure Stack version 1-2 and higher

Microsoft Dynamics CRM software versions 2013 and higher

Microsoft Server 2008R2 and higher

Microsoft SharePoint versions 2010 and higher

Microsoft SQL Server versions 2008 and higher

Microsoft System Center versions 2010 and higher

Microsoft Team Foundation Server versions 2012 and higher

Microsoft Windows 10 and higher

Microsoft IIS 7 and higher

Microsoft PowerShell 5 and higher

Microsoft Reporting Service 2008 and higher

Microsoft SCCM 2012 and higher

Microsoft Active Directory 2012 and higher

Microsoft File Service 2008 and higher

Microsoft Cluster Service 2008 and higher

3.9 IBM

The Contractor shall monitor, administer, and ensure recoverability and adherence of IBM technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of IBM products, including but not limited to:

IBM Collaborative Lifecycle Management (CLM) versions 5 and higher

IBM DB2 Advanced Enterprise Edition versions 10 and higher

IBM HTTP Server version 8 and higher

IBM Maximo ERP/EAM software version 8 and higher

IBM MQueue version 8 and higher

IBM Rational version 5 and higher

IBM v840 and Storage Volume Controller

IBM WebSphere Application Server versions 8 and higher

IBM Cognos 10 and higher

3.10 VMWARE

The Contractor shall monitor, administer, and ensure recoverability and adherence of VMWare technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of VMWare products, including but not limited to:

VMWare Cloud Platform (VMC)

VMware vSphere version 6 and higher

VMware products supporting the vCloud Air Network (vCAN) program

VMware NSX

VMware vRealize Suite Cloud Management Platform

VMware Horizon View

3.11 RED HAT

The Contractor shall monitor, administer, and ensure recoverability and adherence of Red Hat technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of Red Hat products, including but not limited to:

Red Hat Atomic LXC/Docker Container environment

Red Hat Enterprise Linux version 6 and higher

Red Hat Identity Policy Audit (IPA) versions 4 and higher

Red Hat JBoss Enterprise Application Platform (JBoss EAP) version 5 and higher

Red Hat OpenShift Platform version 4 and higher

Red Hat Certificate System

3.12 BMC SOFTWARE

The Contractor shall monitor, administer, and ensure recoverability and adherence of BMC technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of BMC products, including but not limited to:

BMC Atrium Core version 9.1 and higher

BMC Client Management version 12.8 and higher

BMC Digital Workplace version 18.02 and higher

BMC Discovery version 11.3 and higher

BMC Remedy Action Request System version 9.1 and higher

BMC Remedy IT Service Management version 9.1 and higher

BMC Remedy Single Sign-On version 18.02 and higher

BMC Remedy with Smart IT version 18.02 and higher

BMC Service Request Management version 9.1 and higher

BMC TrueSight Operations Management version 11.3 and higher

BMC TrueSight Server Automation version 8.9 and higher

3.13 DELL EMC

The Contractor shall monitor, administer, and ensure recoverability and adherence of EMC technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of EMC products, including but not limited to:

EMC Connectrix DS-300B FC Switch (Brocade FC Switches resold by EMC)

EMC Connectrix FC Directors generations 5 and 6 (Brocade FC Directors resold by EMC)

EMC Connectrix G620-G630 (Brocade FC Directors resold by EMC)

EMC DSSD D5 NVMe Fabric Storage Array cluster configuration and storage zoning

EMC Unity including models Unity 350 all-flash array (AFA), Unity 450 AFA, Unity 500, Unity 600 AFA with both FC and IP infrastructure connectivity and with file and block replication services

EMC VNX2 and Unity Storage Arrays with Fibre Channel and IP infrastructure connectivity

EMC VNX2 including models 5200, 5400, 5600, and 5800 with both FC and IP infrastructure connectivity and file replication services

3.14 HEWLETT PACKARD ENTERPRISE (HPE)

The Contractor shall monitor, administer, and ensure recoverability and adherence of HPE technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of HPE products, including but not limited to:

HPE 3PAR Software Suite including Thin Provisioning, Thin Conversion, Thin Persistence, Full Copy, Thin Copy Reclamation, Autonomic Rebalance, System Tuner, Management

Console, Host Explorer, Virtual Copy software, Remote Copy software, Quorum Witness, Reporting Software Suite

HPE 3PAR Storage Array and HPE 3PAR Operating System (OS) Software for 3PAR models

7450 - 9450

HPE 3PAR StoreServ Storage 7450-9450 including implementing vSphere Metro Storage

Cluster using Peer Persistence

HPE Fortify version 17 and higher

HPE Network Security Processor (NSP)

HPE Recovery Manager Central (RMC) version 4

HPE SecureDataVoltage version 5

HPE Server models DL Series

HPE StoreOnce CloudBank version 3

HPE StoreOnce model 6600

HPE StoreOnce Virtual Storage Appliance (VSA)

HPE WebInspect version 17 and higher

3.15 F5 NETWORKS

The Contractor shall monitor, administer, and ensure recoverability and adherence of F5 technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of F5 products, including but not limited to:

F5 BIG-IP Local Traffic Manager (LTM), Access Policy Manager B21(APM), Application Security Module (ASM), Application Firewall Module (AFM), BIG IP DNS version 13 and higher

F5 Big-IP ILX 13 and higher

F5 Viprion application delivery controller model 4800 and virtual edition (VE))

3.16 SIEMENS

The Contractor shall monitor, administer, and ensure recoverability and adherence of Siemens technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of Siemens products, including but not limited to:

Siemen’s TeamCenter PLM software versions 9 and higher

Siemens NX versions 8 and higher

Siemens Applications Workspace (AWS) version 4 and higher

3.17 INTEL

The Contractor shall monitor, administer, and ensure recoverability and adherence of Intel technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of Intel products, including but not limited to:

Intel NVMe Adapters models 750, 3500, 3608, 3700, half-height/half-length (HHHL) and

U.2 form factors

Intel NVMe SSD DC P3700 Series

Intel QuickAssist Technology (Intel QAT) Adaptor model 8950 and on Xeon D-2100

3.18 CISCO

The Contractor shall monitor, administer, and ensure recoverability and adherence of Cisco technical infrastructure and application environments. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of Cisco products, including but not limited to:

Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) model apl-g-k9

Cisco Nexus 3k and 9k leaf/spine IP fabric architecture switches in application centric infrastructure (ACI) mode

Cisco Nexus 7k-5k-2k legacy IP fabric switches

Cisco Tetration Analytics (TA) appliance version 2 and higher, software/hardware sensors

Cisco UCS Server models C Series

3.19 OTHER TECHNOLOGIES

The Contractor shall monitor, administer, and ensure recoverability and adherence of technical infrastructure and application environments comprised of various technologies. The Contractor shall provide personnel who possess specific technical and functional expertise and knowledge of the following products, including but not limited to:

Alation Enterprise Data Catalog

Anark 3D Publishing version 4.5x

Apache HTTP Server

Apache Nifi version 3 and higher

Apache Ranger

Apache Software Foundation Open Source Projects and Libraries

Apache Tomcat

Atlantis/HiveIO Fabric and USX Hyper-Converged Infrastructure (HCI) software version 4-

Amazon Web Services (AWS)

Blancco Secure Erasure Software

Brocade DCX Gen6 - Gen7

Brocade Fabric OS versions 7-8

Cohesity

Elastic Cloud Enterprise (ECE) version 6 and higher including x-packs and machine learning

Horton Works Data Management Platform

Jira/Confluence/BitBucket Atlassian products

Kylo Data Lake Management Software

Microsoft Azure

Nagios System Monitoring Software version 3 and higher

NetScout Network Security Appliances nGenius Infinistream 6980 and Infinistream 9800

(both physical and virtual appliances)

NexSan Storage Array model E18VT, E60VT and BT60

OWASP ZAP 2.x

Patriot Excalibur (ePEX) version 5

QLogic Host Bus Adapter (HBA) models 2742 FCA and 2692 FCA source and target modes

Servers Built for Immersion (SBI) (Custom SuperMicro SOC and Dual-Socket Servers for submersion in dielectric fluid solution provided by GRC)

SolarFlare SolarCapture and SolarSecure software running on XtremeScale HBAs

SolidWorks Enterprise Project Data Management (EPDM) version 2017

SpectraLogic Tape Library models T-Finity and T380 including robotic automation and backup and recovery software integration

Tenable Nessus 6-7 including Security Center 5

Tableau Server and Desktop Data Analytics Tool

Veritas NetBackup version 7.x-8.x including OpsCenter and OpsCenter Analytics, Storage

Lifecycle Policies (SLP), Bare Metal Restore (BMR), Physical to Virtual (P2V) and Instant

Recovery for VMware

3.20 SUBJECT MATTER EXPERTS (SME)

The Contractor shall provide personnel who possess specific technical and functional Subject

Matter Expertise in the following areas:

Data Center Architecture, Engineering & Operations

Cloud Models, Technologies, Migration, and Security

Virtualized Shared Infrastructure

IT Infrastructure Library & IT Service Management (ITIL/ITSM)

Continuity of Operations & Disaster Recovery (COOP/DR)

Data Analytics Methods, Technologies, and Tools

Maintenance, Repair, & Overhaul (MRO)

Material Requirements Planning (MRP)

Product Lifecycle Planning (PLM)

Enterprise Resource Planning (ERP)

Customer Relationship Management (CRM)

3.21…