Redlines AMEND1 - OFC HCM- SaaS IDIQ Shell SOW_28_May_2025.pdf

Statement of Work (SOW) for

Human Capital Management (HCM) Software-as-a-Service (SaaS) 28 May 2025

Prepared by:

Platform Modernization and Integration Branch (AFLCMC/GBHP) Air Force Life Cycle Management Center (AFLCMC)

Joint Base San Antonio-Randolph, TX 78150

Distribution Statement C: Distribution authorized to U.S. Government agencies and their contractors date 14 February 2025. Other requests for this document must be referred to AFLCMC/GBH, 1st Street West, Bldg. 977, Joint Base San Antonio-Randolph, TX 78150.

Destruction Notice – For unclassified, limited documents, destroy by any method that will prevent disclosure of contents or reconstruction of document.

DISCLAIMER - The contents of this document are not to be construed as an official Department of the USAF position unless so designated by other authorized documents. The use of trade names in this document does not constitute an official endorsement or approval of the use of such commercial hardware or software. Do not cite this document for the purpose of advertisement.

This page intentionally left blank

Table of Contents

1.0. Introduction

2.0. Background and Objectives

3.0. Scope of Work:

4.0. Kick-Off Meeting

5.0. Differentiation Between Agile Approach Deliverables and CDRLs

6.0. Agile Development Approach

7.0. Capability-Based Outcomes and User Stories

8.0. Sprints, Epics, and Minimum Viable Products (MVPs)

9.0. Iterative Delivery and Feedback Loops

10.0. Technical and Security Requirements

11.0. Agile Methodology

12.0. Task Order Framework

13.0. Security - Personnel

14.0. Data Rights

15.0. Intellectual Property, Use of Open-Source Software, and Configuration and Script Delivery

16.0. Place of Performance

17.0. National Agency Check with Inquiries (NACI)

18.0. Security Requirements

19.0. Ordering Period (FAR 52.216-22)

20.0. General Requirements

21.0. Deliverables

22.0. Legacy System Sunset Planning

23.0. Contract Line Item Numbers (CLINs)

24.0. Optional CLINs

25.0. Government Furnished Property (GFP)

26.0. Contract Data Requirement List

Appendix A – Glossary

1.0. Introduction

1.1. This document serves as the Statement of Work (SOW) for the pre-priced single award Indefinite Delivery Indefinite Quantity (IDIQ) contract to procure a commercially available Software as a Service (SaaS) solution for the Department of the Air Force’s (DAF) Human Capital Management (HCM) modernization initiative. This requirement stems from a successful Commercial Solution Opening (CSO) evaluation under FA8600-23-S-C056.

1.2. Specific project details, including performance metrics, deliverables, and timelines, will be defined in Individual Task Orders (TOs) issued under this IDIQ. Task Orders will be funded and awarded based on Government need and availability of funds.

2.0. Background and Objectives

2.1. The DAF, which includes the US Air Force and US Space Force, seeks to replace its legacy HCM systems with a modern, cloud-based solution that leverages the capabilities of Oracle Fusion Cloud HCM. This contractor’s solution will streamline HR processes, improve data accuracy and accessibility, and enhance the user experience for DAF employees and HR professionals.

2.2. Objectives: The Contractor shall deliver a secure, scalable and user-friendly Oracle HCM SaaS solution that:

2.2.1. Improves HR Efficiency: Automates and streamlines core HR processes, such as onboarding, benefits administration, and performance management;

2.2.2. Enhances Data Management: Provides a single, authoritative source for HR data, enabling data-driven decision-making;

2.2.3. Empowers the Workforce: Offers employees self-service access to their HR Information and tools; and

2.2.4. Ensures Security and Compliance: Meets all applicable DoD and DAF cybersecurity standards and regulations.

3.0. Scope of Work:

3.1. This SOW governs the full scope of work across the IDIQ ordering period. Each Task Order issued under this IDIQ will contain a distinct Performance Work Statement (PWS) tailored to that order’s deliverables, including but not limited to CLINs 0001-0005. Only the associated Task Order PWS will contain performance specifics tied to delivery schedules, Quality Assurance Surveillance Plan (QASP) metrics, and payment events. To manage risk across the IDIQ, each Task Order shall define checkpoints and risk mitigation strategies for scope volatility, surveillance and funding execution in accordance with Agile principles. This IDIQ encompasses a comprehensive range of HCM capabilities and supporting services, including but not limited to:

3.1.1. Configuration and Deployment: Implementation of Oracle Fusion Cloud HCM modules (specific modules to be defined in Task Orders).

3.1.2. Data Migration and Cleansing: Migration of data from legacy systems, ensuring data integrity and accuracy.

3.1.3. Integrations and Interfaces: Development and implementation of secure integrations and interfaces with authoritative HR databases, including Military Personnel Data System

(MilPDS) and Air Force Integrated Personnel and Pay System (AFIPPS), as well as identity management systems (e.g., OKTA, SailPoint).

3.1.4. User-Centered Design: Enhancement of the user interface (UI) and user experience (UX) to ensure ease of use and accessibility.

3.1.5. Training and Change Management: Development and delivery of comprehensive training programs for end-users and administrators, along with change management support to ensure successful adoption.

3.1.6. Sustainment and Support: Ongoing system maintenance including reliability and maintainability of system, help desk support, and user support services.

3.1.7. Data Encryption and Cybersecurity Compliance: Implementation of encryption and data protection measures in accordance with FIPS 140.3, ensuring compliance with federal cybersecurity standards. The contractor shall design and implement cryptographic modules covering areas such as module specification, interfaces, authentication, software security, operating environment, physical security, sensitive security parameter management, life-cycle assurance, and mitigation of attacks. Expertise in establishing and maintaining compliant data encryption will be critical to ensuring secure operations within the DoD environment.

3.1.8. The solution will leverage Oracle FedRAMP Moderate package and DISA BCAP inheritance paths to accelerate RMF compliance. Artifacts such as PPSM, CONOPS, system topology, and STIG validation scripts shall be templated and submitted NLT Sprint 3 to support interim authority to test (IATT) and ATO acceleration.

3.1.9. API Microservice Architecture and Refactoring: The contractor shall support existing capability refactoring and integration for Application Programming Interface (API) microservice architecture within designated cloud-based platforms. Solutions must enable interactive application development while maintaining system availability, scalability, and performance. The contractor will implement modern microservices architect approaches to enhance modularity, interoperability, and future extensibility across AFLCMC’s enterprise systems.

3.1.10. The immediate customer is the Department of the Air Force, the configured Oracle HCM SaaS solution is designed to be portable across federal agencies with minimal reconfiguration, supporting enterprise scalability in alignment with OPM’s Shared Services Strategy and E-Gov Modernization.

4.0. Kick-Off Meeting

4.1. The Contractor shall coordinate and co-host an HCM SaaS Kick-Off Meeting virtually as approved by the Government no later than five (5) business days after contract award. The meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss management, technical strategy, security requirements, and travel authorization and reporting procedures. At a minimum, the attendees will include Key Contractor Personnel, representatives from the AFLCMC/GBH staff, Program Manager, Engineering/Cybersecurity, Contracting Officer, COR, and other relevant Government personnel (e.g., Product Owner). The Contractor shall provide any presentation materials not later than two (2) business days prior to the kick-off meeting. (CDRL A002)

5.0. Differentiation Between Agile Approach Deliverables and CDRLs In this project a distinction is made between Agile Deliverables and CDRLs. Agile deliverables refer to the tangible outputs produced continuously during the life-cycle process. These include working software, tested features, and user stories that demonstrate functional progress and provide value to the Government in each iteration, driven by the iterative software development process and prioritized within the product backlog. CDRLs are specific formally documented and submitted data items required by the Government as outlined in the Contract Data Requirements List (see Section 25.0). The Contractor shall deliver both Agile deliverables and CDRLs as specified by the SOW and Task Orders.

6.0. Agile Development Approach

6.1. This project will utilize an Agile development methodology with a focus on iterative development, continuous feedback, and close collaboration between the Government and the Contractor. The project will be organized around Sprints, typically two-week periods, during which specific functionalities will be developed and tested.

6.2. Roles and Responsibilities:

6.2.1. Government Product Owner: Responsible for defining and prioritizing the product backlog, ensuring alignment with DAF strategic objectives. The Government Product Owner shall serve as the primary acceptance authority for all agile deliverables under this contract, verifying alignment with the Definition of Done.

6.2.2. Contractor Scrum Master: Facilitates the Scrum process, removes impediments, and ensures the Development Team adheres to Agile principles.

6.2.3. Contractor Development Team: A cross-functional team responsible for designing, developing, testing, and delivering working software increments.

6.3. Agile Ceremonies:

6.3.1. Sprint Planning: Collaborative session to define the Sprint Goal and select user stories from the product backlog for the upcoming Sprint.

6.3.2. Daily Scrum: Short daily meeting for the Development Team to synchronize activities and identify any roadblocks.

6.3.3. Sprint Review: Demonstration of the working software increment to the Product Owner and stakeholders at the end of each Sprint.

6.3.4. Sprint Retrospective: Meeting for the Development Team to reflect on the past Sprint and identify areas for improvement in the development process.

7.0. Capability-Based Outcomes and User Stories

7.1. This project will focus on delivering incremental capabilities aligned with user needs.

Requirements will be expressed as user stories following the format: “As a [user type], I want [capability] so that [benefit].” Examples include:

7.1.1. Epic: Employee Onboarding:

7.1.1.1. “As a new employee, I want to complete my onboarding process electronically so that I can quickly access necessary systems and information.”

7.1.1.2. “As an HR specialist, I want to automate the onboarding process so that I can reduce manual data entry and improve efficiency.”

7.1.2. Epic: Performance Management:

7.1.2.1. “As a manager, I want to easily track employee performance so that I can provide timely feedback and support.”

7.1.2.2. “As an employee, I want to access my performance reviews online so that I can understand my progress and development goals.”

8.0. Sprints, Epics, and Minimum Viable Products (MVPs)

8.1. The project will be executed in a series of Sprints, with each Sprint focused on delivering a working increment of the OFC HCM SaaS solution. Epics represent larger functionalities, which are broken down into smaller, manageable user stories. The initial phase of the project will focus on delivering a MVP, a functional version of the system with core capabilities. Subsequent Sprints will build upon the MVP, adding new features and functionalities based on user feedback and evolving requirements. The Contractor shall prepare an initial Requirements Traceability Verification Matrix (RTVM) per CDRL A005 and provide updates following each Sprint.

9.0. Iterative Delivery and Feedback Loops

9.1. The project will employ an iterative delivery model, with continuous feedback loops from end-users. User feedback will be collected through various channels, including Sprint Reviews, user surveys, and direct interaction with the Development Team. This feedback will be used to refine requirements, prioritize future development efforts, and ensure the solution meets the needs of the DAF.

10.0. Technical and Security Requirements

10.1. The technical and security requirements shall be delivered by the Contractor’s OFC HCM SaaS solution are as follows:

10.1.1. Secure Cloud Computing Architecture (SCCA):

10.1.1.1. Implement a SCCA that is compliant with all applicable DoD and DAF security standards and policies, including DISA STGs, DoDI 8500,01, DoDI

8520.03, AFI 17-101, AFI 17-130, AFMAN 17-1301, NIST SP 800-53A, CNSSI

1253, FedRAMP, and DFARS Clause 252.204-7012.

10.1.1.2. Implement and maintain a robust configuration management process for all security-related Configuration Items (CIs) for SaaS environment.

10.1.1.3. Conduct STIG analysis and implement all applicable STIGs, SRGs, and IAVAs.

10.1.1.4. Develop secure software applications, incorporating security testing and vulnerability assessments throughout the development lifecycle.

10.1.1.5. Implement incident response procedures and maintain updated system artifacts for accreditation.

10.1.1.6. Ensure all personnel performing cybersecurity functions possess required certifications IAW DoD 8570.01-M and DoDM 8140.03.

10.2.2. Legacy System Integration and Interface: Develop seamless data interfaces and maintain secure, real-time data synchronization and automated integrations with existing legacy HR systems, including MilPDS/AFIPPS HR.

10.2.3. Data Migration: Migrate HR data from legacy systems to OFC HCM SaaS, ensuring data integrity and accuracy.

10.2.3.1. Mobile Accessibility: Provide a mobile-friendly user interface and experience.

10.2.3.2. Reporting and Analytics: Implement robust reporting and analytics capabilities within OFC HCM SaaS.

11.0. Agile Methodology

11.1. The Contract shall utilize an Agile development methodology, specifically the Scrum framework, for all work performed under this contract. Key elements of the Agile approach include:

11.1.1. Iterative Development: The project will be executed in time-boxed sprints, with working software delivered at the end of each sprint.

11.1.2. Prioritized Backlog: The Government will prioritize the product backlog, which will be continuously refined and updated throughout the project.

11.1.3. Collaboration and Feedback: The Contractor will work closely with the Government Product Owner and stakeholders to gather feedback and ensure alignment with evolving needs.

12.0. Task Order Framework

12.1. Each Task Order shall define measurable acceptance criteria for deliverables, informed by the Performance Work Statement and the Quality Assurance Surveillance Plan (QASP).

Performance metrics may include sprint velocity user story completion rate, test pass rate, and stakeholder satisfaction thresholds.

Each TO issued under this IDIQ will include:

12.1.1. Detailed PWS: Clearly defining the specific objectives, deliverables, acceptance criteria, and performance standards for the TO.

12.1.2. Agile Deliverables: Specification of sprint or epic-based deliverables, ensuring continuous progress and value delivery.

12.1.3. Payment Structure: Outlining the payment schedule, tied to the achievement of specific milestones and deliverables.

12.1.4. QASP: Defining the Government’s approach to monitoring performance and ensuring quality.

13.0. Security - Personnel

13.1. All contractor personnel performing tasks requiring Privileged Access must have a favorable Single Scope Background Investigation (SSBI) and a Secret security clearance. All contractor personnel performing software engineering, development, and maintenance require a Secret security clearance. All contractor personnel performing Data Spillage response, remediation and reporting tasks must have at a minimum a Secret security clearance.

13.2. All Contractor personnel performing work under this PWS shall comply with the security requirements outlined in this PWS and all applicable DoD and DAF regulations, including DoD Directive 5205.02E, AFI 10-701, DoD Manual 5200.02, and DoD Instruction 1000.13.

Contractor personnel will be required to have the appropriate level of investigation and/or security clearance prior to performing services under this task order. The cost of the associated investigations for contractors will be in accordance with governmental directives at the time of the contract award.

13.3. All Contractors located on military installations will also comply with Operations Security.

(OPSEC) requirements as set forth in DoD Directive 5205.02E, DoD Operations Security Program and AFI 10-701, Operations Security. In accordance with DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP) and DoD Instruction 1000.13, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals.

13.4. Contractor personnel using unclassified automated information systems, including e-mail, will have at a minimum, a completed and favorably adjudicated National Agency Check with Written Inquiries (NACI) (or equivalent or higher) or Tier 1 or higher background investigation.

14.0. Data Rights

14.1. The Government shall retain Government Purpose Rights in all configuration logic, data structures, test artifacts, workflow scripts, user role definitions, training materials, and related documentation developed specifically for the Government under this contract. These items shall be delivered in a non-obfuscated, non-encrypted, and fully documented format, sufficient to support independent validation, sustainment, and audit.

14.2. Any technical data, documentation, or non-commercial software developed exclusively with Government funds shall be delivered with Unlimited Rights in accordance with FAR 52.227-14 and, if applicable, DFARS 252.227-7013.

14.3. The Government does not seek rights in the Contractor’s pre-existing commercial software, Oracle proprietary source code, or licensed third-party tools, except as necessary to enable execution of the Government’s rights under this contract.

15.0. Intellectual Property, Use of Open-Source Software, and Configuration and Script Delivery

15.1. The Contractor shall retain ownership of all pre-existing intellectual property and commercial software used in performance of this contract, provided such items are clearly identified and marked in accordance with FAR 52.227-14 and, if applicable, DFARS 252.227- 7013 or 252.227-7014.

15.2. Deliverables developed exclusively for the Government under this contract shall be the sole property of the Government.

15.3. Deliverables developed with mixed funding shall be provided with Government Purpose Rights, unless otherwise negotiated and agreed in writing by the Contracting Officer.

15.4. No restrictive markings or proprietary claims shall be applied to Government-funded deliverables unless coordinated with and approved by the Contracting Officer prior to submission.

15.5. Use of Open-Source Software (OSS): The Contractor shall not include any OSS components subject to copyleft licenses (e.g., GPL, LGPL, AGPL) in any deliverable under this contract without prior written approval from the Contracting Officer.

15.5.1. If OSS use is proposed, the Contractor shall submit:

15.5.1.1. A risk assessment addressing license type, cybersecurity, and lifecycle support;

15.5.1.2. A license impact statement describing the terms of use and their impact on Government rights; and

15.5.1.3. All OSS used in performance must be compatible with the Government’s intended use and deliverables.

15.6. Configuration and Script Delivery: The Contractor shall deliver all configuration scripts, interface logic, automation tools, testing routines, and related technical artifacts developed under this contract. Deliverables shall:

15.6.1. Be provided in a non-obfuscated, non-encrypted, and fully documented format;

15.6.2. Be compatible with Government systems and accessible without reliance on proprietary tools not otherwise provided;

15.6.3. Include build instructions or execution guides, where applicable; and

15.6.4. Be complete and sufficiently detailed to support Government validation, reuse, and sustainment.

15.7. Deliverables that are obfuscated, encrypted, poorly documented, or reliant on undisclosed proprietary tooling shall not be accepted by the Government.

16.0. Place of Performance

16.1. The primary place of performance for this contract shall be the Contractor’s designated facilities. Any work performed at Government facilities will be coordinated and approved on a Task Order basis.

17.0. National Agency Check with Inquiries (NACI)

17.1. The Contractor employees must be U.S. citizens to perform duties under this contract.

DoD military, civilian, consultants, and Contractor personnel using unclassified automated information systems, including e-mail, shall have at minimum, a NACI or Tier 1 (T1) investigation. The Contractor will be responsible for ensuring employees complete and passes a minimum NACI or Tier I Investigation. No employee will have unescorted access to a military installation or access to automated information systems until at least an Interim NACI is obtained. The Contractor will understand that this process may take up to 30 days for employees not already possessing a NACI Investigation.

18.0. Security Requirements

18.1. The Contractor will provide cleared personnel capable of achieving program requirements within 30 days after contract award and for the duration of the contract. The Contractor will request access to any Government facility through AFLCMC/GBHP. Local Area Network (LAN) user accounts and access to Government-furnished property will be accomplished in accordance with AFLCMC/GBHP policy. The Contractor will be responsible for ensuring that all employees comply with all security requirements imposed by the local commander at all times while the employees are on the installation and shall follow instructions of the local organizational commander pertaining to security. The Contractor will be responsible for compliance with all applicable physical security, computer security, operational security, and communication security requirements. Specific security compliance includes:

18.1.1. Retrieving Identification Media. The Contractor will retrieve all identification media from employees who depart for any reason before the contract expires, e.g., voluntarily leave to different position; terminated for cause; retirement. The Contractor will return these documents to the COR.

18.1.2. Freedom of Information Act Program (FOIA). The Contractor will comply with DoD Regulation 5400.7/Air Force Supplement, DoD FOIA Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material.

18.1.3. Physical Security. Areas occupied by contractor employees will comply with base Operations Plans and instructions for Force Protection Condition (FPCON) procedures, Random Antiterrorism Measures (RAMS), and local search and identification requirements.

The contractor shall safeguard all Government property including controlled forms provided for contractor use. At the close of each work period, Government facilities, support equipment, and other valuable materials shall be secured.

18.1.4. Common Access Card (CAC) Control. The Contractor will ensure its employees do not allow Government issued CACs to be used by personnel other than current authorized contractor employees. Contractor employees will not use CACs to open work areas for personnel other than contract employees engaged in performance of duties, unless authorized by the Government functional area chief. Lost CACs will be reported immediately to the CO.

The Government will provide necessary authorization for replacement CACs.

18.1.5. Traffic Laws. The Contractor and its employees will comply with base traffic regulations.

18.2. For Air Force publications use http://www.e-publishing.af.mil/ and for DoD use http://www.defenselink.mil/pubs/.

19.0. Ordering Period (FAR 52.216-22)

19.1. This IDIQ contract shall have a three-year ordering period from the date of the award.

Each Task Order will define its own period of performance. A task order may be issued on the http://www.e-publishing.af.mil/ http://www.defenselink.mil/pubs/ last day of the three-year ordering period.

20.0. General Requirements

20.1. Commercial-Off-the-Shelf (COTS): The Contractor shall utilize commercially available solutions out of the box capabilities to the maximum extent practicable.

20.2. Innovation: The Contractor is encouraged to propose innovative approaches and solutions that enhance the efficiency and effectiveness of the DAF’s HCM program.

20.3. Communication: The Contractor shall establish and maintain effective communication channels with the Government, providing regular status updates and proactively addressing any issues or concerns.

21.0. Deliverables

The Contractor shall provide Contract Data Item List (CDRLs) as shown in Table 2, informal analyses, papers, opinions, databases, briefings, etc. defined in and generated during the performance of this contract, and other deliverables as detailed in each specific Task Order PWS.

22.0. Legacy System Sunset Planning

The Contractor shall develop a Legacy System Decommissioning Plan that includes archival steps, security safeguards, business continuity overlap timelines, and user migration communications. At minimum, the plan will address MilPDS, COMPASS, WINGS, and any systems replaced by OFC HCM SaaS.

23.0. Contract Line Item Numbers (CLINs)

22.1. The CLINs outlined in the table below (Table 1) are firm-fixed-price (FFP) CLINs designed to support Agile performance-based delivery for the project. The Government will use CLINs as information only CLINS, and sub-Line Item Numbers (SLINs) will be designated for each Task Order as appropriate. SLINs will have priced deliverables which will be traceable to the PWS, QASP, and Milestone for acceptance and payment. SLIN pricing and performance enforcement metrics shall be assigned per Task Order and mapped to deliverables identified in the Task Order PWS. The RTVM (CDRL 0005) is the authoritative requirements tracking mechanism.

23.2. Table 1: CLINs, Descriptions, and Deliverable/Milestone CLIN Title Description Type Deliverable/Milestone

0001 Agile Kickoff & Planning Includes PMP, backlog setup, RTVM, architecture planning

FFP See SLIN on Task Order

0002 MVP Development (Sprints 1–3)

Core HCM configuration, initial integrations, training draft

FFP See SLIN on Task Order

0003 Core Capabilities Delivery (Sprints 4–6)

Delivery of expanded HCM modules, test automation, UAT prep

FFP See SLIN on Task Order

0004 Production Readiness & Final Delivery

System ready for deployment, full UAT, FFP See SLIN on Task Order dashboards, reports 0005 Deployment Support &

Hypercare Post- deployment support, training refinement, feedback monitoring

FFP See SLIN on Task Order

24.0. Optional CLINs

24.1. This IDIQ was awarded as a Commercial Solutions Opening (CSO), where the Government explicitly anticipated innovative solutions, agile execution models, and FFP pricing approaches. Accordingly, Agile-aligned pricing methodologies and iterative delivery models may be incorporated into future task orders. However, the use of any non-FFP mechanism under this CSO and IDIQ are not justified.

24.2. Most work under this IDIQ shall be performed using FFP CLINs tied to defined deliverables and acceptance criteria. The Government will determine the appropriate contract type for each task order based on the nature of the requirement, consistent with FAR and DoD guidance. FFP shall be the default and expected contract type.

24.3. Attachment 1-Pre-Priced Labor Roles and Fully Burdened Rate Table, which details the labor mix and fully burdened rates, was pre-established through a competitive Commercial Solutions Opening (CSO) process to ensure fair and transparent pricing.

25.0. Government Furnished Property (GFP)

25.1. The Government may provide GFP, such as system credential or access to development tools, as specified in individual TOs. The Contractor shall be responsible for the proper use, maintenance, and security of all GFP.

25.2. The Contractor acknowledges that all data within the HCM SaaS system is the property of the Government. The Contractor shall implement appropriate measures to safeguard, maintain, and facilitate Government access to the data, ensuring compliance with relevant data rights provisions and security requirements.

26.0. Contract Data Requirement List

26.1. The CDRLs will be priced on the CLINs identified in Table 2.

26.2. Table 2: CDRLs and Associated CLINs

CDRL

# DID # CDRL Title SOW

Para Applicable

CLIN

A001 DI-MGMT-

80368A Monthly Status Report 11 All CLINS

A002 DI-MGMT-

81605 Presentation Material 19 0001, 0002, 0003, 0004

A003 DI-NDTI-

80809B Test/Inspection Report 19 0002, 0003, A004 DI-ILSS-

80872 Training Materials 19 0004, 0005

A005 DI-MGMT-

82133

Requirements Traceability Verification Matrix (RTVM) 8 0001, 0002, 0003, 0004

Appendix A – Glossary

Acronym Title AFI Air Force Instruction AFIPPS Air Force Integrated Personnel and Pay System AFMAN Air Force Manual AFNET Air Force Network AI Action Item AO Authorizing Official ATO Authority to Operate A&A Assessment & Authorization BCAP Boundary Cloud Access Point BES Business Enterprise Systems CAC Common Access Card CAP Cloud Access Point CCA Oracle Certified Cloud Architect CI Configuration Item CNSSI Committee on National Systems Instruction CONOPs Concept of Operations COR Contracting Officer’s Representative COTS Commercial-off-the-shelf DAF Department of the Air Force DISA Defense Information Systems Agency DNS Domain Name System DoD Department of Defense DoDI Department of Defense Instruction DoDM Department of Defense Manual EDI Electronic Data Exchange FOIA Freedom of Information Act FOUO For Official Use Only FPCON Force Protection Condition GBHP Platform and Integrations Branch HCM Human Capital Management HR Human Resources IA Information Assurance IAVA Information Assurance Vulnerability Alert IAVM Information Assurance Vulnerability Management ID Identification IDIQ Indefinite Delivery Indefinite Quantity IRP Incident Response Plan ISSM Information System Security Manager IT Information Technology JIRA Software Development Tool (Atlassian) LAN Local Area Network MilPDS Military Personnel Data System

MSR Monthly Status Report MVP Minimum Viable Product NACI National Agency Check with Inquiries NIST National Institute of Standards and Technology OFC Oracle Fusion Cloud OKTA Identity and Access Management Platform OPSEC Operations Security PK Public Key PKI Public Key Infrastructure PM Program Manager PMO Program Management Office PMP Program Management Plan POA&M Plan of Action and Milestones PPS Ports, Protocols, and Services PPSM Ports, Protocols, and Services Matrix PWS Performance Work Statement RAMS Random Antiterrorism Measures RMF Risk Management Framework RTVM Requirements Traceability Verification Matrix SaaS Software as a Service SBIR Small Business Innovation Research SCCA Secure Cloud Computing Architecture SR Service Request SRG Security Requirement Guide SBBI Single Scope Background Investigation STIG Security Technical Implementation Guide UI/UX User Interface/User Experience VDSM Virtual Data Management Service VDSS Virtual Data Storage Service