GARDEM 2 PWD Platform Miss App R and D JAN 03.docx

E-1-1567

AIR FORCE RESEARCH LABORATORY

ROME RESEARCH SITE

ROME, NEW YORK

PERFORMANCE WORK DESCRIPTION (PWD)

FOR

GARDEM 2 PLATFORM AND MISSION APPLICATIONS RESEARCH, DEVELOPMENT, ENHANCEMENT & SUSTAINMENT

PCSN E-X-XXXX

03 JANUARY 2023

(Order Number FA8750-23-R-0502)

TABLE OF CONTENTS

· Data and Platform Services: Data and platform services include backend services that enable data management security, and query, data storage, user authentication and authorization, user management, user collaboration tools, job scheduling, and the hosting of end-user facing applications.

· Data Visualization, Dashboards, and Search: Web based capabilities and services packaged into user interfaces that enable users to create, save, and share customizable presentation dashboards, select data sources, perform analysis by creating, saving, and running queries, perform text based faceted and boolean search, and define, create, and edit visualizations. The data visualization and dashboard capabilities enable geospatial and temporal analysis. Visualization and dashboard capabilities are collaborative tools that enable users to save, share, and export the data, visualizations, and products created within the capability.

· Intelligence and Activity Reporting: Serves as a bridge between disparate communities who might not otherwise share data by providing a standardized reporting framework across intelligence and operations disciplines. This common framework allows structured operational and intelligence information to be shared vertically and horizontally as part of a flexible, user-defined workflow process. The tool collects, correlates, aggregates, and exposes information as part of the end-user’s individual information lifecycle requirements. This capability enables manual data entry and supports flexible data structures through the ability to author forms.

· Data Curation and Integration: This capability provides a user interface to connect authoritative data sources, perform retrieval at query time, merge and join data, and create, edit, and save virtual datasets as collections for SQL based and tabular data.

2.1.2 Assemble, integrate, and provide core capabilities and services including interfaces to external data sources and services.

2.1.2.1 Research and develop technology that improves the data management layer that (in general terms) ingests /serves data to applications and users. This data structure and standardization capability will:

· Demonstrate the ability to dynamically replicate the latest updated version of a given data object and provide a means to identify and resolve conflicting data issues

· Create and manage multiple data objects from all sources

· Allow users to customize existing data object and entry forms

· Export data objects and associated object details to MS Office and PDF formats

· Provide customizable and automated data-source, data-integration, and data sciences support to enable applied analytical capabilities.

· Enable the creation of relationships between data objects.

2.1.2.2 Provide a common services interface that allows applications or users secure access to internal and external APIs. These APIs will enable the following, to include, but not limited to:

· Communicating across domains and conducting exchanges of data between instances.

· System-to-system data transfer where exchanges of data are performed via API

· Demonstrate the ability to create and manage subscriptions to desired intelligence products

2.1.2.3 Visualization across the enterprise by leveraging the Data as a Service (DaaS) Platform. Visualizations will include, but are not limited to:

· A workflow tracking and monitoring dashboard (user interface) with data analytics

· Visualization of all data object, object details, object relationships and object status in user-interactive; list, geospatial, temporal, relationship/network, and metrics based graphics;

2.1.2.4 The mission capabilities will include the ability to search data stores and externally stored objects and data:

· Demonstrate the ability to identify and resolve duplicative data

· Demonstrate an ability to conduct a multi-faceted search against data objects from multiple sources

· Demonstrate the ability to discover externally-stored products and objects

· Enable enterprise location-based querying

· Improve enterprise performance by reducing time to discover and retrieve data.

2.1.2.5 Allow for mission capability, developed by transient (external) developers that leverage a government directed Software Dev/Test Factory (hereafter referred to as software factory) for development and must be able to integrate with operational systems.

2.1.2.9 Develop new methods for Identification, Authentication, Authorization, and Data Access capability that enables users to login provide/restrict access to data based on user, group, role-based discretionary access control management, and enforces PKI-based mandatory access control restrictions on data.

2.1.2.10 Demonstrate via integration of chat, commenting, and Alert/Notifications capabilities how the user can provide and view feedback for management of all data objects.

2.1.3 Provide an Open System Architecture (OSA) based design to yield benefits in the form of a modular, interoperable system allowing components to be added, modified, replaced, removed, and/or supported by different vendors throughout the life cycle2.1.4 (U) Leverage and integrate existing or evolving enterprise capabilities.

2.2 Operations & Maintenance - System Engineering and Baseline Enhancements: Manage and maintain the operational enterprise platform and mission applications software baselines that support numerous missions within the Intelligence, Air, Space, and Cyber domains. Support will consist of field service support, training, requirements collection and analysis, and reviewing, recommending changes to and revising intelligence and operations Standard Operating Procedures (SOPs) and Tactics, Techniques, and Procedures (TTPs). Support will include coordination with on-site teams and other component and application developers to identify requirements for enhancements, executing the design and development of the enhancements, and successfully integrate, test, and deploy software baselines. Software enhancements will enable incremental system improvement, functionality, and stability through upgrades of security patches, individual hardware and software modules with newer modular components without redesign of entire system or large portions thereof.

2.2.1 Enhancement Development System Engineering: System engineering includes but is not limited to system installations (para 4.7), testing (para 4.16), documentation (para 4.6), PR/CR management (para 4.2), systems engineering (para 4.5), Configuration Management (4.8), Authorization and Assessment (A&A) (para 4.17), interface management (para 4.4), and integration.

2.2.2 Provide a modular open standards approach to enhancing/modifying applications and architecture changes.

2.2.3 Participate in site exercises and wargames and maintain software during special contingency situations as requested by the Government. The exercise or contingency will be at or near an existing site, overseas, or remote location. Special contingency situations include, war, armed conflict, insurrection, civil or military strife. These services are designated as mission-critical.

Objective

PWD

Reference

Method

4.0 Requirements are successfully completed on-time as defined in the TO Performance Work Description(s) (PWDs) and Work Plan(s) (WPs). Requirements include, but not limited to: Requirements Management, WP Implementation, Software Development, Training, Testing, Configuration Management, and Engineering Operations and Maintenance.

Exceptional = 0 deficiencies; Never late

Very Good = 1-2 deficiencies; late by 3 days or more on 1-2 requirements

Satisfactory = 3 deficiencies; late by 3 days or more on 3 requirements

Marginal = 4 deficiencies; late by 3 days or more on 4 requirements

Unsatisfactory = equal to or more than 5 deficiencies; 5 or more requirements are late by 3 days or more

Customer Complaint, Annual Customer Survey, and/or Periodic Inspection

Satisfactory = 0 deficiencies; 0 security breaches

Unsatisfactory = 1 or more deficiencies; 1 or more security breaches Customer Complaint , Annual Customer Survey, and/or Periodic Inspection

Satisfactory = 0 deficiencies; all personnel are cleared and qualified with no performance issues

Unsatisfactory = 1 or more deficiencies; 1 or more personnel are not cleared or not qualified and performance issues exist

Customer Complaint , Annual Customer Survey, and/or Periodic Inspection

Exceptional = 0 deficiencies; all final documentation fulfills its intended purpose IAW the content required in the CDRL description and Data Item Description

Very Good = 1-2 deficiencies; 1-2 final documents do not fulfill the intended purpose IAW the content required in the CDRL description and Data Item Description

Satisfactory = 3 deficiencies; 3 final documents do not fulfill the intended purpose IAW the content required in the CDRL description and Data Item Description

Marginal = 4 deficiencies; 4 final documents do not fulfill the intended purpose IAW the content required in the CDRL description and Data Item Description

Unsatisfactory = equal to or more than 5 deficiencies; 5 or more final documents do not fulfill the intended purpose IAW the content required in the CDRL description and Data Item Description

Customer Complaint, Annual Customer Survey, and/or Periodic Inspection

Exceptional = 0 deficiencies; Never late

Very Good = 1-2 deficiencies; late by 2 days or more on 1-2 document deliverables

Satisfactory = 3 deficiencies; late by 2 days or more on 3 document deliverables

Marginal = 4 deficiencies; late by 2 days or more on 4 document deliverables

Unsatisfactory = equal to or more than 5 deficiencies; 5 or more document deliverables are late by 2 days or more

Customer Complaint, Annual Customer Survey, and/or Periodic Inspection

Satisfactory = 0 deficiencies; all deliverables received and result in successful and timely build/install

Unsatisfactory = 1 or more deficiencies; 1 or more software deliverables are incomplete delaying or preventing successful build/install

Customer Complaint, Annual Customer Survey, and/or Periodic Inspection

Satisfactory = 0 deficiencies; no more than 2 Category 1 Non-Information Assurance Vulnerability Alert (IAVA) PRs identified in round 1 of any Government Acceptance Test. Zero Category 1 PRs acceptable after round 2

Unsatisfactory = 1 or more deficiencies; more than 2 Category 1 Non-IAVA PRs identified in round 1 of any Government Acceptance Test. One or more Category 1 PRs found after round 2

Customer Complaint and/or Periodic Inspection

Satisfactory = 0 deficiencies; all requirements, schedules, software baselines changes, and details of work performed were shared and communicated as identified in the Associate Contractor Agreement (ACA).

Unsatisfactory = 1 or more deficiencies; 1 or more requirements, schedules, software baselines changes, and details of work performed were not shared and communicated as identified in the ACA.

Periodic Inspection

· Category 1: Prevents the accomplishment of an essential capability or jeopardizes safety, security, or other requirement designated "critical".

· Category 2: Adversely affects the accomplishment of an essential capability and no work around solution is known or adversely affects technical, cost, or schedule risks to the project or to life cycle support of the system, and no work-around solution is known.

· Category 3: Adversely affects the accomplishment of an essential capability but a work-around solution is known or adversely affects technical, cost, or schedule risks to the project or to life cycle support of the system, but a work-around solution is known.

· Category 4: Results in user/operator inconvenience or annoyance but does not affect a required operational or mission-essential capability or result in inconvenience or annoyance for development or maintenance personnel but does not prevent the accomplishment of the responsibilities of those personnel.

· Category 5: Any other effect with less impact.

4.2.6 Each PR/CR shall include the following:

· Description on system problem or enhancement to include title, date, overview of functional requirement, use case, priority and impact

· Customer Point of Contact (POC) to include name, organization, phone number and e-mail address

· US Government customer’s signature

· Total cost estimate to include the labor hours, travel, direct and indirect costs required to design, implement, test, document, and deliver to the Government

· Project schedule to include milestones like design, code, test and delivery phases

· Documentation affected

· PR/CR Software Requirement Specification that shall include the following:

· PR/CR purpose, scope, perspective, functions, user classes and characteristics

· Operating environment parameters and descriptions

· Assumptions and dependencies

· Software modules affected

· Specific requirements to include mock-ups and field tables

· Verification of vendor licenses

· Recommendation for changes/upgrades

· Traffic/Load analyses in support of enhanced network component allocation/design

· DoDAF views to include, but not limited to, Operational View (OV), System Views (SV), and Capability Views (CV)

· Network/communications configuration, systems test/validation, data base administration, workstation configuration (to include hardware/software version control)

· Demonstrate reuse and modularity of software components to DoD test organizations

· Application software modifications and enhancements

· List of deliverables include, but are not limited to:

· Software Design Description (SDD)

· Interface Control Document (ICD)

· System Requirements Specification (SRS)

4.5.2 Continuously analyze existing functional capabilities of the software baseline as well as information display requirements identified but not implemented.

4.6 Management Requirements: Management includes the effective and efficient management, tracking and reporting of all work, travel support, deliverables, financials, and invoices as well as the accountability and security of all personnel. Program Management includes acquisition of hardware, software, and services.

4.6.4 Coordinate TO activities that cross stakeholder organizations and for providing representation on integrated project teams to ensure effective cross-organizational support, coordination, and collaboration.

4.6.5 Schedule, coordinate, and host a Project Kick-Off Meeting within fourteen calendar days of task TO award at a location approved by the Government. At a minimum, the attendees shall include key contractor personnel, representatives from government identified stakeholders, GPMO and the GARDEM Contracting Officer (CO). The contractor shall provide the following at the Kick-Off Meeting; (1) Introduction of contractor team members and capabilities, (2) Overview of the TO scope, schedule, and deliverables Security Overview of the TO scope, schedule, and deliverables, (3) Security requirements/access procedures, (4) Points of contact, (5) Additional issues or concerns, and (6) Draft Program Management Plan.

4.6.6 Develop and administer a Quality Control Plan. Ensure that all assigned products meet their specified design, format, functional and performance requirements. Assure the quality control process is integrated into all activities supported under the contract.

4.6.7 Perform continuous technical management to identify resources required for managing this order, and to resolve technical, system performance, cost, and schedule problems.

· Standard Operation Procedures (SOP)/Working Procedures

· Collection, Collaboration, and Dissemination Process Documentation

· Training/Familiarization Materials

· System Requirements Specification (SRS)

· Interface Control Document (ICD)

· Tactics, Techniques, and Procedures (TTPs)

· Roles and Responsibilities of Agile Product Teams

· Management Plans

4.6.14 Conduct Engineering Design Reviews and System Requirements Reviews as prescribed by the GPMO.

4.6.15 Develop and maintain a Standup Plan which describes the technical approach, organizational resources/staffing and management controls to include quality control, configuration management and risk management to be employed to meet the cost, performance and schedule requirements.

4.7 Software

4.7.1 Deliver all software developed, modified or enhanced under this effort as source and object (executable) code, API, Software Development Kit (SDK) and developer documentation including commented source code on electronic media and to development environments and online software repositories as prescribed by the Government. Ensure all deliverables involving source code contains enough information for the Government to recreate the build environments to include, but not limited to: the compiler, environment variables, Operating System (OS), OS patches, all run-time libraries, middleware, make files, as well as test code (i.e. stubs and scaffolding) and any other dependencies to assure a successful build upon delivery. Commercial tools for which the Government does not own a license need not be included. Source code shall not be delivered outside the Program Management Office (PMO) without written permission of the COR. Forward requests for source code releases to the COR. (See CDRLs, A008, A020, A021, A026, A027, C010, C022, C023, C030, C031, D010, D022, D023, D030, D031, E010, E022, E023, E030, E031, F010, F022, F023, F030, F031, G010, G022, G023, G030, and G031)

4.7.2 Developed, modified and enhanced software under this effort is to be completely maintainable and modifiable with no reliance on any non-delivered computer programs or documentation. (See CDRLs, A028, C032, D032, E032, F032, and G032)

4.7.3 Provide and execute a proven agile methodology (such as Secure Agile Framework for Enterprises, Kanban, Sprints, etc.) for analysis, design, development (including use of prototyping and modeling), coding, integration, testing, demonstration, and installation of development software to support operational sites. The development methodology must be grounded in sound development processes and detailed reviews, ensuring justified progression to the next system engineering phases.

4.7.4 All software and documentation, currently baselined, modified or enhanced, shall be compliant with IC and AF community policies and focus on rapid, agile delivery, enterprise infrastructure, and data management. Ensure all baseline changes are tracked and reproducible from inception to completion.

4.8 Configuration Management (CM)

4.8.1 Provide CM/Requirements Management (CM/RM) in accordance with current Institute of Electrical and Electronic Engineers (IEEE) and Electronics Industries Association (EIA) standards as further defined by DoD and AFRL guidance. Implement an integrated process for managing information and products associated with the deployment, and acquisition of all deliverable software, hardware, and associated documentation. The CM/RM process shall support the full software lifecycle (i.e., System Requirements Analysis, Design, Software Requirements Analysis, Preliminary Design, Detailed Design, and System Integration and Testing). (See CDRL, A008, C010, D010, E010, F010, and G010)

4.8.2 Maintain and enhance CM processes for all software activities within GARDEM. Establish and maintain development, test, and production baselines in accordance with the Government-approved CM process. Coordinate, evaluate, prioritize, and schedule updates to baselines. Administer software and database baseline media library. (See CDRL, A008, C010, D010, E010, F010, and G010)

4.8.3 All program documentation should be created and maintained within Government Owned Tool Suites as prescribed by the Government, to include design review minutes, design checklists; code review minutes, code checklists; unit test results, unit test checklist; software release list; final unit test plan with allocated requirements; test drivers/data, source code, script files, task tracking, and preliminary design data. Review and revise Installation Plans for CM system delivery to support all aspects of the installation to include procedures for verifying that the installation is successful. (See CDRLs, A008, C010, D010, E010, F010, and G010)

4.8.4 Review and revise Installation Plans for CM system delivery to support all aspects of the installation to include procedures for verifying that the installation is successful. (See CDRLs, C026, D026, E026, F026, and G026)

4.18 Adhere to Cloud Computing Requirements. Reference Section I clause DFARS 252.239-7010.

4.18.1 Work on this effort will require or allow Contractor access to Privacy Information. Content contained within the cloud services is subject to the Privacy Act. As such, the Contractor shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a, and applicable agency rules and regulations.

4.18.2 Work on this effort will require or allow Contractor access to Level 2 Public or Non-Controlled Unclassified Information. Content contained within the cloud services is subject to the Freedom of Information Act (FOIA). As such, the Contractor shall adhere to the FOIA regulations, and applicable agency rules and regulations.

4.18.3 Work on this effort will require or allow Contractor access to Level 4 Controlled Unclassified Information, including “Export Controlled,” and “For Official Use Only” data, and non-National Security Systems (NSSs). Content contained within the cloud services is subject to the Freedom of Information Act (FOIA). As such, the Contractor shall adhere to the FOIA regulations, and applicable agency rules and regulations.

4.18.4 Work on this effort will require or allow Contractor access to Level 5: Higher Sensitivity Controlled Unclassified Information, Mission Critical Information, and NSSs. This CUI requires a higher level of protection as deemed necessary by the information owner, public law, or other Government regulations, such as information related to unclassified NSSs.

4.18.5 Work on this effort will require or allow Contractor access to Level 6: Classified Information up to SECRET which includes information that has been determined to be classified national security information or Restricted Data (RD).

4.18.6 Data Ownership. All Government data, Government-related data, and metadata is and shall remain the exclusive property of the U.S. Government.

4.18.7 Disposition. Provide for the transition of data in commercially available, or open and non-proprietary format (and for permanent records, in accordance with disposition guidance issued by National Archives and Record Administration). The Cloud service provider shall ensure that the Government retains access and download capability of all Government data, and Government-related data, on demand within one week of request, in an open format (e.g., ASCII, CSV, XML). “Open format” means platform independent, machine readable, and made available to the public without restrictions that would impede the re-use of that information. (http://www.whitehouse.gov/sites/default/files/omb/egov/digital-government/digital-government-strategy.pdf).

4.18.8 Support applicable inspection, audit, investigation, or other similar authorized activities specific to the relevant types of Government data and Government-related data, or specific to the type of cloud computing services being acquired. Ensure the CSP is able to supply the agency with audit trails, exception reports and transaction logs, if requested.

4.18.9 Support and cooperate with applicable system-wide…