PWS_H98210-15-R-0017.docx

PERFORMANCE WORK STATEMENT (PWS)

Defense Injury and Unemployment Compensation System (DIUCS) Bridge

1.0 INTRODUCTION

The Defense Civilian Personnel Advisory Service (DCPAS) requires support of Oracle Defense Injury and Unemployment Compensation System (DIUCS), Oracle Field Advisory Service (FAS) System and the Electronic Data Interchange (EDI) Process.

2.0 BACKGROUND

DCPAS is involved in the maintenance of civilian personnel information systems. In addition, several production systems are undergoing revision by development contractors under DCPAS direction. A number of these systems have been adopted by non-DoD activities as shared Government software. The primary purpose of this requirement is to provide operations and maintenance support for these systems. Currently, an array of Windows Servers, UNIX Servers, Linux Servers and Linux Clusters provide the common computing environment. Additionally, the DISN is being used to establish a common TCP/IP communications environment within the continental U.S. The current DIUCS, FAS and EDI systems were developed, customized, and using Oracle, Oracle Reports and Oracle forms, Oracle Business Intelligence Enterprise Edition (OBIEE), Oracle Application Server (OAS), Oracle Access Manager (OAM), Web Logic, and Java.

3.0 SCOPE

The Contractor shall provide the personnel, management, and solution necessary to maintain the DIUCS.

4.0 REQUIREMENTS The Contractor shall:

4.1. Provide and implement a Project Management Plan. This plan shall describe the technical approach, organizational resources, and management controls that will be utilized to meet the performance and schedule requirements.

4.2 Provide Systems Administration

4.2.1 Support the management of the DCPAS database servers by providing such services as planning disk space requirements and maintain backup plans, recovery plans, and other system management plans to include:

4.2.1.1 Gathering and maintaining system utilization data such as number of accounts, number of aged accounts and number of active accounts, CPU utilization during peak and normal periods, and I/O utilization. Maintain a log of system changes.

4.2.1.2 Building Windows, UNIX and Linux servers to meet the DoD requirements and setting up and maintaining the Common Access Card (CAC) functionality to access the Oracle applications.

4.2.1.3 Setting-up and maintaining the system security (STIGS). Log changes whenever the system manager makes a change to the operating environment. These changes shall include changes to the default login script, changes to configuration or parameter files, or changes for tuning the system. Scripts such as the add user, delete user, or add printer shall be fully documented with appropriate comments embedded within the code to include the “who, when, and what” that concern the change.

4.2.2 Maintain procedures to create, modify, and delete individual user login accounts. Advise the COR of accounts that appear to be inactive and at the COR’s direction take action to remove the accounts.

4.2.3 Maintain user account management software and maintain other system-related requirements identified by the COR.

4.2.3.1 Perform backups, archiving log files to tape, clearing the temp directories, clearing jammed print queues, copying message of the day files between the systems, and the management of E-Mail routing function.

4.2.3.2 Suggest areas for improvement, to include identification and recommendation of Red Hat or third party peripherals and/or software that may come on the market with the potential to improve operations.

4.2.3.3 Maintain and update scripts for automation of routine tasks:

4.2.3.3.1 May be written in C-Shell, Bourne Shell, Korn-Shell or Perl. JAVA programs may be used when approved by the COR.

4.2.3.3.2 Shall be documented and instruction for the use of these utilities shall be included in the System Administration Guide maintained by the contractor.

4.2.3.4 Document any record system related changes in the DCPAS System Management Change Log.

4.2.4 Implement System Development Life Cycle Standards (SDLC) standards by providing the necessary documentation and system development approaches within the ITSD team. Maintain a check-in and check-out process to the software development process utilizing change management software such as the Oracle Project Management application.

4.3 Provide Security Management.

4.3.1 Install and maintain software and operating system upgrades that will enhance the security of the system.

4.3.1.1 Automate the examination of log files to look for security breaches or attempts.

4.3.1.2 Ensure the system operates at a C2 level of security and identify any deficiencies.

4.3.1.3 Create procedures to validate requirements for new accounts and to revalidate old accounts. The procedures shall be used by the system administrator and the DBA to create UNIX user accounts and Oracle user accounts respectively. These procedures shall be used to prevent unauthorized users from gaining access to the systems. The procedures shall be documented in the System Administration Guide.

4.3.1.4 Maintain an automated process to perform penetration testing using such tools as cops, Satan, or ISS. Provide the results of the penetration testing to the chief of the Operations Branch and the Information Systems Security Officer. This process shall run once a month and the contractor shall work with the Chief of the Operations Branch and the Information Systems Security Officer to correct any deficiencies noted by the penetration testing tool.

4.4 Provide Database Administration

4.4.1 Maintain database administration procedures for the various Oracle databases on the DCPAS Windows servers, Red Hat Linux servers, and the Red Hat Linux Clustered servers.

4.4.1.1 Run production and development copies of the Oracle Database Management System (DBMS) on the DCPAS database servers and install new releases as they are dispensed.

4.4.1.2 Support all development activities conducted by the Government which involve the DCPAS servers.

4.4.1.3 Identify and correct problems that involve the database. Problems needing resolution shall be reported to the appropriate hotline which maintains support for the Oracle RDBMS and the Windows servers, Red Hat Linux servers. Problems shall be tracked and status of problem resolution shall be reported back to the DCPAS end user and to the COR.

4.4.1.4 Work with the system administrator to ensure that the database, Windows operating systems, and Red Hat Linux operating systems are tuned for maximum performance.

4.4.1.5 Use tools such as Oracle's Server Manager or Enterprise Manager (OEM) to monitor system activity and locate system throughput bottlenecks.

4.4.1.6 Provide monthly database use and availability reporting to the COR through the Database Use and Availability section of the monthly Status Report. The Database Use and Availability section of the monthly Status Report shall address the amount of system use by user, amounts of data loaded from each data source, and any Oracle DBMS down time during the preceding month.

4.4.1.7 Produce DBMS-related parts of the System Administration Guide.

4.4.1.8 Support and maintain the FAS, DIUCS, SSA, CMS, NSPS and EDI 3-tier architecture production environment utilizing Linux and Intel/Windows platforms.

4.4.1.9 Assist the Government with the installation and conversion of the Oracle databases and applications from the current version to the most current production software versions as they are released by Oracle within the period of this contract.

4.4.2 Integration of Oracle RAC on a Linux Cluster. Be experience in setting up Oracle Enterprise Manager GRID Control Server to include Oracle Agent, Oracle Management Server, Oracle Grid Repository Instance, and the Application Server. Be experienced in setting up the Grid control to manage the Oracle RAC nodes.

4.4.3 Set up backup and recovery of the Oracle databases using the RMAN tool.

4.4.4 Modify the physical architecture of the DIUCS database to take advantage of Oracle partitioning features for more efficient data processing and to facilitate data archiving.

4.4.4.1 Maintain a detailed POA&M to guide the implementation of the data-partitioning. The POA&M shall address details such as the modification of SQL statements and scripts used by all existing forms, reports, data load, and data backup routines. Implement the POA&M with the assistance of appropriate ITSD staff members.

4.4.4.2 Maintain a detailed data model of the DIUCS database showing the target architecture of the partitioned database. The data model shall show what tables, indexes, views, and table relationships must be modified to implement the target architecture.

4.4.5 Support non-DoD user communities designated by the COR

4.4.6 Provide the expertise to establish a true 24/7 operating environment for the databases maintained under this contract. This shall include the replication of the databases across several Linux \ production servers, automating the backup and recovery procedures to establish a fault tolerant environment that utilizes Linux servers, and Oracle 11G database utilities. Personnel performing these services shall be trained and experienced in Oracle 11g programming and Oracle Certified Oracle 11g database administration. Operation of the utilities that support the fault tolerant environment shall be documented in the System Administration Guide

4.4.7 Assist the Government to manage the database application development change management process by utilizing a central database repository for the different forms and reports developed and supported by the ITSD database development team. Use and maintenance of the software repository shall be documented in the System Administration Guide.

4.5 Provide Maintenance of the Current Production Systems.

4.5.1 Maintain Current Applications including customer changes. Provide continued support to the current functions and links associated with the existing OBIEE reports, forms, and reports. Maintain the customer support tools for the current production databases. This includes maintaining appropriate sections of the Systems Administration Guide and User Guides. Technologies used in the current systems include:

· Oracle Development Suite.

· PLSQL Development.

· UNIX and Linux Shell Scripting.

· Java Server pages (JSP)

· Oracle BI Publisher.

· Object-Oriented Design Development and Life-Cycle Management.

· Microsoft Project to develop timelines and milestones for team members.

· Oracle Access Manager

· Oracle Application Server

4.5.2 Maintain Current Oracle Server Applications. Support the current functions and links associated with current Oracle applications for DPAS. This includes Oracle applications for ICUC, FAS, SSA, and NSPS. This includes maintaining Oracle Middle Tier and Oracle identity management. Both systems run on Windows 2003 and must be upgraded to latest version of Windows. Responsible for setup, maintenance, support and backup of the Oracle application server and Infra-Structure/identity manager and Web enable the ICUC, SSA, FAS, and NSPS applications for ICUC, SSA, FAS, and NSPS customers.

4.5.2.1 The Oracle Middle Tier Administrator shall do the following:

4.5.2.1.1 Oracle Application Server upkeep and Maintenance.

4.5.2.1.2 Oracle Application server backups

4.5.2.1.3 Application of Oracle Critical Patches

4.5.2.1.4 Oracle application software Installation

4.5.2.2 Oracle Identification Server (OID) Administrator shall do the following:

4.5.2.2.1 Oracle user Administration using Identity Manager

4.5.2.2.2 Oracle Identification Server backups

4.5.2.2.3 Application of Oracle Critical Patches

4.5.2.2.4 Oracle Identification Server software Installation

4.6 Provide Maintenance of the Electronic Data Interchange (EDI) Process.

4.6.1 Maintain the Electronic Data Interchange (EDI) Process. Maintain the transmission of information contained on the CA-1 Federal Employee's Notice of Traumatic Injury and Claim for Continuation of Pay form and the CA-2 Federal Employee's Notice of Occupational Disease and Claim for Compensation form across the internet using the existing Electronic Data Interchange process. Maintenance shall include:

4.6.1.1 Maintaining and establishing EDI interfaces with trading partners.

4.6.1.2 Securing email interface with Injury Compensation Program Administrator (ICPA) personnel.

4.6.1.3 Security access and authentication.

4.6.1.4 Audit trailing capabilities.

4.6.1.5 Translation map from UDE to ASC X12 148 transaction set.

4.6.1.6 Web-based front-end screens.

4.6.1.7 Rewriting the SaFER application for the next generation DIUCS v3 system and maintaining our SCM (Software Control Manager) for the project.

4.6.1.8 Integrating new online forms such as the CA-7 (Claim for Compensation on Account of Traumatic Injury/Occupational Disease) and the CA-16 (Authorization for Examination and/or Treatment.)

4.6.1.9 Enhancing system to satisfy OSHA reporting requirements.

4.6.1.10 Testing on individual and integrated system components, including end to end testing with Department of Labor (DOL) as appropriate.

4.7 Provide Setup and Maintenance of Oracle BI Publisher Suite and COGNOS reports.

4.7.1 Setup and Maintenance of Oracle BI Publisher Suite. Maintain the Oracle BI publisher Suite and have experience with CONGNOS and Oracle BI Publisher tool. Maintain current COGNOS, Oracle and XML reports and all current COGNOS reports into Oracle BI Suite Reports. Maintenance shall include:

4.7.1.1 Developing reports as needed for the DOD customer.

4.7.1.2 Providing the customer the tools needed to develop their own adhoc reports.

4.7.1.3 Maintaining the data access credentials.

4.8 Provide maintenance of the Field Advisory Services (FAS) application.

4.8.1 Serve as the Field Advisory Services (FAS) Application Administrator.

4.8.1.1 Set up and maintain the FAS database application for our FAS customers.

4.8.1.2 Obtain experience with Oracle Application Server, Oracle J2EE and Oracle Database Administration. The FAS Application Administrator is the Information Systems Division (ISD) point of contact for all of FAS Web Inquiry applications tasks. The Field Advisory Services (FAS) application Administrator’s primary responsibilities include:

4.8.1.2.1 Ensuring the FAS Oracle middle-tier, database server, and application programs are online and accessible to FAS users.

4.8.1.2.2 Creating new user accounts, lock user accounts when needed, and make sure the ASPECT phone dispatch server is working with the FAS Oracle database.

4.8.1.2.3 Coordinating with FAS business contacts to understand their new business requirements and then develop new screens (Oracle Forms), new reports (Oracle Reports) to enhance online production FAS Web Inquiry system.

4.8.1.2.4 Troubleshooting and resolving any FAS application runtime errors.

4.8.1.2.5 Coding data load scripts to load data files to insert/update the FAS Valid Lookup tables.

4.8.1.2.6 Tuning application SQL to improve querying time performance.

4.9 Provide Maintenance of the Safety Data Extract Process for DoD customers.

4.9.1 Provide the expertise to maintain the extraction of safety data for different agencies within DoD and make it available for the customer to retrieve the same. Maintenance shall include:

4.9.1.1 Maintaining and establishing safety interfaces with safety customers.

4.9.1.2 Maintaining and establishing Security access and authentication for the safety customers.

4.9.1.3 Rewriting the Safety data extract process to include potential new partners.

4.9.1.4 Testing on individual and integrated system components, including end-to-end testing with safety customers.

4.10. Facilitate Data Imports and Exports.

4.10.1 Maintain data load processes for required weekly, biweekly and quarterly data loads from various outside sources and establish new ones when required. The data imported is used to directly support the Defense Injury and Unemployment Compensation System (DIUCS).

4.10.2 Maintain the data load process using Bash and Korn Shell scripting, Oracle PLSQL and Oracle SQL Loader utility. Update the data load procedure manual document if a data loads change.

4.11 Submit Weekly Status Reports. This report shall address:

4.11.1 Data Loads completed and planned Data loads for the next week.

4.11.2 System Information Assurance/Cyber Security and Security Patch updates.

4.11.3 The system accomplishments to include the health of the servers and application environment and planned future work.

4.11.4 The OBIEE accomplishments to include the health of OBIEE report servers and planned future work.

4.11.5 Database and System Administration completed tasks and planned future work.

4.11.6 Maintenance scheduled outages and reported issues if any.

4.11.7 System Availability.

4.11.8 Scheduled meetings for the team.

5.0 DELIVERABLES

(No later than)

4.9, 4.10 2 days after code development

6.0 CONTRACTOR MANPOWER REPORTING

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Department of Defense Civilian Personnel Policy/Defense Civilian Personnel Advisory Services via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at: http://www.ecmra.mil

7.0 CONTRACTOR TRAVEL

No funds are included in this requirement for Contractor travel.

8.0 SECURITY

8.1 Perform onsite and offsite work with Personally Identifiable Information (PII) on Information Technology (IT) systems that comply with the Risk Management Framework (RMF) for Department of Defense (DoD) IT and/or DoD Information Assurance Certification and Accreditation Process (DIACAP) requirements. Systems must be continually maintained and updated with corresponding security requirements to include Defense Technology Security Agency (DISA) Secure Technical Implementation Guides (STIG), Information Assurance Vulnerability Alerts (IAVA), CYBERCOM TASKORDs and other Federal Government, DoD and industry best-practice standards, guidelines and directives. Systems must obtain and/or maintain an Authority to Operate (ATO) or if acceptable to the government, an Interim Authority to Operate (IATO).

8.2 Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall comply with DoD Directive 8500.01 Cyber Security, DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD IT, and additional Directives as stated in section 12.0 in this document.

8.3 Contractor shall ensure the confidentiality, integrity and availability of all government data on assigned applications, systems and networks. Contractor shall ensure the appropriate administrative, technical, and physical safeguards to protect all nonpublic Government information and information systems.

8.4 Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data. Handling of PII shall comply with the Privacy Act (5 U.S.C. 552a) and the DoD Privacy Program (DoD 5400.11-R).

8.5 Contractor systems and information networks that receive transmit, store, or process nonpublic government data must be accredited according to DoD I 8510.01 RMF IT and/or DoD Information Assurance Certification and Accreditation Process (DIACAP). Contractor must provide evidence of compliance with the annual Federal Information Security Management Act (FISMA). All Contractor owned systems subject to RMF must present evidence of Certification and Accreditation (C&A). The Contractor will be responsible for the cost of Cyber Security C&A and FISMA requirements for Contractor owned and operated network, facility and/or application processing DoD information.

8.6 Contractor personnel with access to or responsibility for nonpublic Government data under this contract must comply with HSPD-12 issuance requirements, known as the Common Access Card (CAC) for DCPAS and must:

8.6.1 Be CAC ready prior to reporting for work. At minimum all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing. Obtaining CAC ready status is the responsibility of the contracting agency. It is the responsibility of the contracting agency to notify DCPAS when this is complete.

8.6.2 Be citizens of the United States.

8.6.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

8.7 If at any time, any Contractor person requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, the Contractor shall immediately notify the DCPAS Information Technology Services Division (ITSD) to remove such person from work under this contract.

8.8 The Contractor shall immediately report Privacy beaches and violations to the DCPAS Privacy Official and Contracting Officer Representative (COR).

8.9 The Contractor shall meet and maintain DoD cybersecurity requirements and certifications for all cybersecurity positions (full time and embedded) in accordance with DoD Regulation 8570.01M and all future DoD guidance and directives for cybersecurity training, certification and education associated with the National Initiative for Cybersecurity Education (NICE) standards.

8.10.1 Contractor shall complete all DoD Computer User Training as required by DoD and/or DCPAS.

8.10.2 Contractor must have DoD-approved cybersecurity workforce certifications appropriate for assigned category and level as listed in the current version of DoD 8570.01-M; and

8.10.3 Contractor must have appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

8.10.4 Upon request by the Government, the Contractor shall provide documentation supporting the cybersecurity certification status of personnel performing cybersecurity functions.

8.10.5 Contractor Personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions.

8.10.6 If applicable, Contractor shall agree to abide by the DCPAS Privileged-Level Access Agreement and Acceptable Use Policy.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION

9.1 The Government will provide each contractor employee with a laptop equipped with virtual private network capability if it is appropriate for the work to be performed, or if the work is sensitive in nature and performed in a location other than a DCPAS office. The laptop will contain all necessary software.. When in DCPAS office space, contractor personnel will have access to the Internet, other office software, telephones, fax machines, scanners, and printers necessary to perform this requirement.

9.2 The contractor personnel will be provided the authority to access all information required to perform duties. The COR will provide coordination and assistance to the contractor personnel in accessing required information and meetings.

9.3 The Government will provide the specific information, functional and program documentation, requirements, manuals, texts, access to relevant Government organizations and individuals, and briefs and other associated materials necessary to perform required work. The Government will also provide Oracle software upgrades, associated support utilities, and sufficient disk space

10.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

11.0 QUALITY ASSURANCE

11.1 The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS. The Government will make every effort to ensure that the surveillance methods described below are conducted in an objective, fair, and consistent manner.

11.1.1 Periodic Surveillance. This action occurs when the COR or other Government official observes a deficiency. Examples include evidence from accidents, incidents, or delays. Regardless of where in the line-of-duty the COR observes contractual procedures not being followed, he/she has an obligation to document and report the deficiency to the Contracting Officer.

11.1.2 Customer Complaint Surveillance. This action is instituted when the COR receives a complaint from a stakeholder regarding contractor service. The COR will obtain the complaint in writing and then conduct an investigation to determine its validity. If the complaint is deemed valid, the COR will immediately notify the contracting Officer for action. The COR will notify both the Contract Manager and the complainant of the Government’s response to their complaint.

11.2 Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

12.0 APPLICABLE DOCUMENTS